A good password system relies on hashing (1-way encryption) and so cannot check to see if existing passwords comply with rules about criteria (video here:https://youtu.be/yoMOAIzBSpY and here: https://youtu.be/8ZtInClXe1Q)
1) Roll out validation checks based on new criteria for any new passwords created.
2) Email all users telling them that the criteria for secure passwords will change in 1 month and advising them to check that theirs complies and how to change it ahead of time. Those users that do so will have to face the new validation check for their new password.
3) Three weeks later, email those that haven't changed passwords (by checking account activity for password changes) telling them that they need to change their password to comply with new security measures and that they now have 1 week to do so.
This should deal with the majority of your users.
4) On the day you change over fully to the new criteria, force log out anyone left and push them through a "change password" tunnel when they log back in (bear in mind that this could potentially be years after they last used your site - you may also need to add a policy covering dormant accounts).
The forced log out should be the last measure but will be necessary if you intend to maintain a secure system. It's not a nice thing to do to users who've opted to stay logged in but it's the only way to force those last few users to adopt the new criteria for passwords.
Signalling the intention to change and allowing users to do so in their own time is a great way to let your users feel that they are still in control of their own account.