Quantum risk for boards and executives

Not under that name, anywhere. The duty arrives through the general ones. UK directors must promote the success of the company under section 172 of the Companies Act 2006, and from financial years beginning 1 January 2026 Provision 29 of the Corporate Governance Code asks the board to declare the effectiveness of its material controls. NIS2 Article 20 makes management bodies approve and oversee cyber risk measures and lets Member States hold them liable. DORA Article 5 puts ultimate responsibility for ICT risk on the management body of a financial entity. The SEC asks US-listed companies to describe board oversight of cybersecurity risk every year. A board that has never minuted a discussion of cryptographic risk to its long-lived data is exposed under all of them.

Two things. Item 1.05 of Form 8-K requires disclosure of a material cybersecurity incident within four business days of the company deciding it is material. Regulation S-K Item 106 requires the annual report to describe the processes for assessing, identifying and managing material cybersecurity risk, the material effects of threats and past incidents, management's role and the board's oversight. The rules do not name quantum. A company that holds data worth stealing for decades and relies on RSA or elliptic curve cryptography to protect it has a risk that fits the Item 106 description, and a board that cannot explain its oversight of that risk has a thin paragraph to write.

Three things. Management bodies of essential and important entities must approve the cybersecurity risk-management measures taken under Article 21, oversee their implementation, and follow training so they can identify risks and assess the measures. Member States may hold the members liable for infringements. The transposition deadline was 17 October 2024, so the duties are in national law in most Member States now. Cryptography and encryption are among the Article 21 measures, which is how a post-quantum policy becomes a board approval item rather than a technical choice.

The management body defines, approves, oversees and is responsible for the implementation of the ICT risk management framework; it sets the risk tolerance, approves the policy and the budget, and keeps itself informed. Article 5(4) requires members to actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including through specific training on a regular basis. DORA has applied since 17 January 2025. A board that delegates quantum risk entirely to the CISO has not met the first requirement; one that has had no training has not met the second.

Provision 29. The board must monitor the risk management and internal control framework, review its effectiveness at least annually and, in the annual report, describe how it did so, declare whether the material controls were effective at the balance sheet date and describe any that were not. It applies to financial years beginning on or after 1 January 2026, a year after the rest of the Code. Cryptography that protects long-lived data is a control, and whether it is material is a question the audit committee should answer in writing rather than leave open.

For most companies it is a risk factor rather than an incident, and the honest answer is that the position should be decided, not assumed. Three questions settle it: does the company hold data that must stay confidential beyond 2030, does it rely on quantum-vulnerable cryptography to protect that data, and would a reasonable investor want to know how the board is overseeing the migration. If the answer to all three is yes, Item 106 and Provision 29 both point the same way. General counsel should write the position down before the next annual report, and the course on legal liability from cryptographically vulnerable data retention is built for that task.

The only published government figure is OMB's: approximately $7.1 billion in 2024 dollars to migrate prioritised US federal civilian systems between 2025 and 2035, excluding national security systems, with agencies updating the estimate annually. For a company the number depends on inventory coverage, how much cryptography sits with suppliers and how crypto-agile the estate is, which is why discovery comes first and is cheap relative to the rest. Our cost benchmarks article sets out ranges by company size. The board's job in year one is to fund discovery and insist on a multi-year estimate by day 90.

Nobody can answer that from the outside, and the board should not accept an answer from the inside without the wording. The questions for the broker are whether a cryptographic failure counts as a security failure under the policy, how the retroactive date and notification clauses treat data taken years before it is read, and whether the D&O policy responds to a claim that the board failed to oversee a known, dated risk. Get the answers in writing and put them in the quarterly pack.

Five numbers. The value and volume of records that must stay confidential beyond 2030. The share of in-scope systems with a completed cryptographic inventory. How many critical suppliers have a post-quantum roadmap on file and how many have not answered. Spend against the multi-year estimate and milestones against 2028, 2030 and 2035. Whether the disclosure position is current and what the policies cover. If management cannot produce the first two within 90 days, that is the finding.

Everything on this page. The two-minute readiness check scores your board's oversight and routes you to the right next step. The free tools, including the HNDL Risk Calculator and the Third-Party Cryptographic Exposure Model, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

It depends on the role. Board members, NEDs and executives start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. CFOs, general counsel and audit committees take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. General counsel and data protection officers who need the legal position take Legal Liability from Cryptographically Vulnerable Data Retention, a full-day course. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the Certified Quantum Business Professional bootcamp for a board or executive team. Board and committee workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Two routes. QSECDEF membership gives your directors and executives the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving boards and executive teams who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed, about 22 hours in total. The legal liability and insurance courses are full-day sessions of six hours.