FCA tells financial firms to start post-quantum migration before the deadline clock bites

The Financial Conduct Authority has urged firms to begin post-quantum cryptography work now, aligning with National Cyber Security Centre milestones for planning by 2028, high-priority migration by 2031 and full migration by 2035. It says organisations should understand where cryptography is used, set risk-based objectives and test migration changes.

The warning is operational rather than speculative. Cryptography is embedded in applications, hardware, certificates, third-party services and long-lived data. A firm cannot prioritise migration until it has a credible inventory of algorithms, keys, protocols, owners and dependencies, including systems that suppliers control.

The FCA is trialling a supervisory self-assessment with an initial sample of firms and intends to consult on cyber-resilience guidance that includes post-quantum controls. It also notes that failed change projects accounted for around a fifth of incidents reported to it in 2025, reinforcing the need to manage migration as a resilience programme.

For AI360, the programme route is a financial-services migration workshop rather than a general quantum forecast. Ask firms to show discovery coverage, data-harvest exposure, prioritisation, crypto-agility, supplier commitments and rollback. The FCA dates are milestones, not permission to wait until the final year.

AI for Leaders: Governance, Risk & Why Strategy Must Come First

Is your organisation adopting AI without a defined strategy or governance? If so, you're not alone — and the consequences range from data breaches to reputational damage to safeguarding failures. AI is a strategic risk, not a silver bullet, and definitely not a magic data fairy. Without clear ownership, rules, and accountability, AI can proliferate across your organisation in ways that cost more — in time, money, and trust — than not using it at all. Speakers: Craig Clark, Director at Clark & Company Information Governance Services, and Stewart Tinson, Project Director, AI-360. You'll learn: Why "understand your why" must precede any AI rollout Which risks senior leaders most commonly overlook — from data leakage to safeguarding How to measure AI value through outcomes, not adoption metrics Why accountability for AI governance sits with the C-suite, not IT or compliance Key topics: AI strategy • Risk appetite • Data protection • Bias & fairness • Safeguarding • AI literacy • Governance models • Return on investment • Executive accountability • AI use case tiering For CISOs, CIOs, and senior leaders who need to govern AI responsibly — before it governs them.

BrightTALK