Logical qubits make quantum computers usable for insurers for the first time—enabling more accurate solvency models, more precise pricing, and earlier fraud detection. However, this same technology breaks the encryption on which core systems, interfaces, and customer data rely today. FINMA therefore expects a roadmap for quantum-secure cryptography by mid-2027. Thomas Schubert explains why this requirement will serve as a springboard for tomorrow’s competitive edge.
Welcome to a journey into the world of tomorrow. Quantum computers—or rather, logical qubits.
Quantum computing is transforming the insurance industry in two ways. Error-corrected quantum computers will accelerate solvency modeling, rate setting, and fraud detection. The same technology breaks the asymmetric encryption widely used today.
FINMA therefore recommends that Swiss insurers develop a PQR roadmap for quantum-secure encryption by mid-2027 at the latest. The first step is to conduct a cryptographic inventory.
The opportunity lies in error correction; the requirement is in effect now
Quantum computing is usually discussed in the insurance industry as a computational issue. This view is too narrow. For executive management and the board of directors, two questions arise, each with a different time horizon.
The first is the opportunity. Quantum algorithms such as quantum amplitude estimation promise a quadratic speedup over classical Monte Carlo methods in stochastic simulations. This is relevant for solvency calculations under the Swiss Solvency Test (SST) and Solvency II. This advantage requires fault-tolerant hardware.
The second is the obligation. A cryptographically relevant quantum computer can break RSA (an encryption algorithm) and elliptic curves, which form the basis of TLS, VPNs, digital signatures, and API connections. This obligation does not wait for the hardware, because data is already being intercepted today and will be decrypted later.
Those who combine the two turn a compliance task into a regulatory lever: The cryptographic inventory that regulators expect is the very same data and governance foundation that every productive quantum project needs.
Logical qubits mark a turning point
Today’s quantum processors operate with physical qubits, which are prone to errors. A logical qubit bundles multiple physical qubits and continuously corrects their errors. Only with enough logical qubits and long, error-free computation sequences can the theoretical advantages be put to practical use.
For insurers, logical qubits mean three changes.
- Capital modeling. SST and Solvency II calculations involving 100,000 or more stochastic paths can now be performed with fewer approximations and estimates. The result is more accurate capital requirements and greater scope for sensitivity analyses.
- Optimization. Portfolio and reinsurance structures subject to numerous constraints can be modeled mathematically, whereas today simplifying assumptions are necessary.
- Cryptography. These same error-correcting machines are what make attacks on today’s encryption systems possible. Estimates of the resources required have fallen by a factor of more than 200 since 2019. Every new scientific publication brings us one step closer.
The technology that accelerates the solvency model breaks the encryption that protects that model.
Here is an overview of recent milestones in quantum research.
| Milestone | Contents | Status |
| Quantinuum Helios (November 2025) | 98 physical qubits, 48 error-corrected logical qubits with a coding ratio of 2:1 | Commercially available, according to the manufacturer |
| IBM Starling (Roadmap) | 200 logical qubits, 100 million quantum operations | Planned for 2029 |
| IBM Blue Jay (Roadmap) | 2,000 logical qubits, 1 billion operations | Planned to follow Starling |
| Gidney, Google Quantum AI (May 2025) | RSA-2048 with fewer than 1 million noisy physical qubits in less than a week | Resource Estimate |
| Iceberg Quantum (February 2026) | RSA-2048 with fewer than 100,000 physical qubits | Simulation; not validated on hardware |
The regulatory authority has stated its expectations
In Switzerland, FINMA published its expectations regarding quantum computing in Supervisory Circular 05/2026 dated July 9, 2026. From November 2025 to January 2026, 60 institutions—including banks, insurers, managers of collective investment schemes, and financial market infrastructures—were surveyed. More than two-thirds expect quantum risks to become directly relevant within seven years. 72 percent have not yet planned or implemented any concrete measures.
FINMA lists six measures: strategy and roadmap, institution-specific risk analysis, cryptocurrency inventory, protection of critical data against “harvest now, decrypt later” attacks, involvement of external service providers, and crypto-agility.
The roadmap is expected to be available by mid-2027 at the latest. The communication does not establish any new rules. It is based on existing, technology-neutral requirements for governance and risk management. Responsibility for outsourcing remains with the institution (FINMA-RS 2018/3).
The Digital Operational Resilience Act (DORA) has been in effect in the European Union since January 2025. Delegated Regulation (EU) 2024/1774 requires, in Article 6, an encryption directive with provisions that update cryptography in light of advances in cryptanalysis. Recital 9 explicitly mentions threats posed by advances in quantum computing. Article 7 requires a registry of all certificates.
The EU roadmap published by the NIS Cooperation Group in June 2025 is thus directed at EU member states. It calls for protecting foundational systems by the end of 2026, high-risk applications by the end of 2030, and medium-risk applications by the end of 2035.
The table provides an overview of the instruments intended to address the use of quantum computing.
| Instrument | Level | Binding nature | Deadline |
| FINMA Supervisory Bulletin 05/2026 | Switzerland | Regulatory Expectations | Roadmap through mid-2027 |
| FINMA Guidelines 2018/3: Outsourcing | Switzerland | Binding for Supervised Entities | In effect |
| Art. 8 DSG, Data Security | Switzerland | Law | In effect |
| DORA, pursuant to Delegated Regulation (EU) 2024/1774 | EU | Regulation | Since January 17, 2025 |
| EU PQC Roadmap (NIS Cooperation Group) | EU Member States | Coordinated Recommendation | 2026, 2030, 2035 |
| EU AI Act, high-risk as defined in Annex III | EU | Regulation | December 2, 2027, in accordance with the political agreement reached in May 2026 |
| EU Quantum Act (scheduled for Q3 2027) | EU | Bill Announced | Draft planned for 2026, with a focus on research, industry, and the supply chain |
There are no plans to enact a law specifically addressing quantum finance in Switzerland. FINMA is incorporating this issue into its ongoing oversight.
There is no case law; liability applies
There are no court rulings on quantum risks or post-quantum cryptography in either Switzerland or the EU. Liability arises under existing regulations.
Under Art. 716a of the Swiss Code of Obligations (OR), overall management is a non-delegable duty of the board of directors.
Art. 754 of the Swiss Code of Obligations (OR) governs its liability. Art. 8 of the Swiss Data Protection Act (DSG) requires data security commensurate with the risk. Art. 61(c) of the DSG imposes a fine of up to CHF 250,000 on the responsible person for willful noncompliance with the minimum requirements.
The supervisory notice shifts the standard of due diligence. Starting in mid-2027, it will be difficult to justify the absence of a roadmap.
Quantum-based decision-making models are also subject to requirements regarding explainability: Art. 21 of the DSG on automated individual decision-making and FINMA Supervisory Circular 08/2024 on AI governance. For EU companies, the AI Act also applies, which classifies risk assessment and pricing in life and health insurance as high-risk activities.
Compliance Is Becoming an Architectural Challenge
| Task | Action | Responsibility |
| Creating Transparency | Cryptographic Inventory: Algorithms, Keys, Certificates, Data Flows, Partner Interfaces | CIO with Risk |
| Prioritizing Risk | Classify data by retention period, prioritizing long-term data from life and health records first | Data Protection in Collaboration with Business Units |
| Embed the strategy | PQC roadmap, approved by the Board of Directors, with milestones | Executive Management, Board of Directors |
| Involve partners | Incorporate migration requirements into contracts, release cycles, and service level agreements (SLAs) with service providers | Procurement in collaboration with Legal |
| Ensure flexibility | Cryptoagility: Interchangeable methods without system restructuring; NIST standards FIPS 203 and 204 | IT architecture |
| Mastering Models | Validation and audit trail for quantum-assisted models, hybrid-classical verification | Actuarial Science, Compliance |
| Verifying effectiveness | Tests and red teaming with quantum scenarios, reporting to the Board of Directors | Internal Audit |
The table shows why this issue cannot be resolved within a single silo. The Legal department focuses on the contract, IT on the algorithm, Risk on the data class, and management on the budget. In this context, breaking down silos means having a single inventory, a single roadmap, and a single point of responsibility.
The insurance market is undergoing a realignment
In the short term, cyber underwriting is changing. Crypto-agility and the protection of long-lived data are becoming risk factors. Insurers who have their own migration under control are better able to assess these same issues for their clients with greater credibility.
In the medium term, competition will shift to the models. Those who use error-corrected quantum computers to calculate capital more accurately will tie up less equity. Those who detect fraud and fraud networks earlier will lower their loss ratio. The advantage belongs to those whose data is ready when the hardware is.
For customers, this means more personalized pricing and fewer false positives in fraud screening, combined with the right to transparent decisions.
The broker evolves from an intermediary to a decision-maker
Brokers are directly connected to insurers’ core systems via interfaces and manage large customer databases themselves. For the insurer, each of these interfaces is part of its cryptographic inventory. Questions regarding encryption, certificates, and migration plans are therefore forwarded to the brokers.
This presents an opportunity. A broker who can assess the “quantum readiness” of their corporate clients provides insurers with better risk profiles and clients with better coverage. They no longer just sell coverage; they sell insight.
The process for insurers consists of three stages
| Level | Time Horizon | Application |
| Today | NISQ phase, error-prone qubits | Pilot projects and hybrid methods: portfolio optimization, graph analysis for fraud networks, expertise development. No proven production advantage. |
| Starting around 2028 | First fault-tolerant systems with hundreds of logical qubits | Stochastic capital models, reserving, optimization of reinsurance structures |
| Thereafter | Thousands of logical qubits | Quantum machine learning in underwriting and claims management, high-resolution climate risk models |
The Quantum Edge Starts with Basic Testing
Discussions are currently underway regarding the development of a quantum-based fraud detection system, Q-Fraud. The first step in this process is not quantum-related. It involves a fundamental review of data, networks, and governance. What data is available, what is its quality, through which channels does it flow, who is responsible for it, and how quickly and reliably can the data be analyzed more effectively?
This is the ambidexterity that the topic demands. One hand examines the fundamentals. The other builds the model on top of them.
Whoever compiles the cryptographic inventory for FINMA is laying that same foundation. The 2027 requirement is the runway for the 2030 lead.
Questions and Answers at a Glance
- What case law exists regarding quantum computing? None. Liability arises under Art. 716a OR, Art. 754 OR, and Art. 8 DSG.
- What governance framework is already in place? FINMA Supervisory Circular 05/2026, FINMA Guidance Note 2018/3, Article 8 of the DSG; for EU companies, DORA with Delegated Regulation 2024/1774.
- What are Switzerland and the EU planning? Switzerland is not planning a special law. The EU has announced a Quantum Act focused on research, industry, and supply chains and has adopted a PQC roadmap for member states.
- By when? FINMA: Roadmap by mid-2027. EU: High-risk applications by the end of 2030, medium-risk applications by the end of 2035.
- What difference do logical qubits make? They make quantum advantages in capital models and optimization practically usable, while also enabling attacks on today’s encryption.
One question remains unanswered, and the inventory does not provide an answer: Which of your data will still need to be kept confidential in 2040?
TURNING REGULATION INTO VALUE!
Thomas Schubert, Mr. #DeedsCountMore
See also: The Blind Spot in Acquisitions: How a Lack of GRC Makes Life Difficult
Search:
Sponsors:
