BSI's 2030-2035 End Dates and FINMA's Mid-2027 Roadmap: What They Mean for Data Already in the Archive
The tape cartridge written in a European data center last night has a service life nobody in the room thought about. It will sit in a magazine, in the dark, at controlled humidity, and parts of it will still be legally required reading in 2050 — a pension entitlement, a clinical record, a notarised instrument, an insurance claim file. It was encrypted before it was written. The key that unwraps it was itself wrapped by a key-encrypting key, and that key was protected by RSA or elliptic-curve cryptography chosen at a time when nobody had to name a year in which it would stop working.
Two European authorities have now named years: Germany's federal cybersecurity agency and Switzerland's financial supervisor.
Practical takeaway. BSI's dates are end-2031 for classical key agreement and encryption, end-2030 where protection needs are high, and end-2035 for classical signatures. FINMA's date is mid-2027, for a roadmap, and it is a recommendation rather than a rule. The confidentiality dates fall on the asymmetric cryptography an archive uses to protect its keys; the 2035 date falls on the signature chains that make an archive provable. How much work each one implies depends on how the site's key hierarchy and payload cipher were built, and neither side of it is fixed by a software update somewhere else.
11 February 2026: BSI put an end date on classical asymmetric cryptography
Germany's Federal Office for Information Security published its annual update of the cryptographic guideline TR-02102 on 11 February 2026 and, for the first time, attached an expiry to classical asymmetric procedures. The press release is titled BSI empfiehlt Ende klassischer asymmetrischer Verschlüsselungsverfahren. For key agreement and encryption the office names Ende 2031, and Ende 2030 where protection requirements are high. Classical signature procedures get a longer run, bis Ende 2035. After those dates the classical schemes are not to be used alone; the recommendation is hybrid use alongside post-quantum algorithms.
The two-track structure is the part that matters for an archive, and it is easy to flatten. The 2030 and 2031 dates are about confidentiality: they fall on classical asymmetric key agreement and encryption, and so on any part of a key hierarchy that depends on RSA or elliptic-curve operations. The 2035 date is about provability: it falls on classical signatures, and so on backup catalogue integrity, retention proofs, firmware signing and qualified electronic signatures on archived documents. Which of the two bites harder at a given site depends on how that site's archive was built, but a plan treating them as one deadline will be five years out on one of them.
TR-02102 is a technical guideline and BSI presents these as recommendations; the release carries no statutory force, and this post does not claim any for it. What it fixes is a reference point, because TR-02102 is the document in which BSI states which cryptographic procedures it considers adequate and for how long, and this is the first edition to name years at which the classical asymmetric ones stop qualifying. The reason BSI gives is progress in error-corrected qubits: migration plans should no longer be drafted, they should be run.
9 July 2026: FINMA surveyed 60 institutions and found 72 per cent had done nothing
The Swiss Financial Market Supervisory Authority published Guidance 05/2026 on quantum computing on 9 July 2026. It rests on a survey run between November 2025 and January 2026 across 60 authorised banks, insurance companies, managers of collective assets and financial market infrastructures. Around two thirds expect to be directly affected by quantum-related cyber risk within seven years, and around two thirds expect that within ten years at the latest a quantum computer will break RSA-2048 within 24 hours. Seventy-two per cent stated that they had not yet planned or implemented any measures relating to quantum-safe encryption. Twenty-eight per cent had taken a strategic decision, and 20 per cent also had a project running. Eight per cent had a specific roadmap, and those institutions generally expect four to five years before critical data and processes are quantum-safe.
The register the document speaks in is worth preserving, because it is not the register of a deadline. Section 3 is headed “Recommendations”, and FINMA writes that it “recommends that a PQC roadmap be drawn up by mid-2027 at the latest”, resting on “a strategy adopted by the board of directors, from which an implementation plan setting out milestones and priorities is derived”. The binding layer sits underneath and is older: Swiss financial market law already imposes technology-neutral, principles-based requirements for governance and risk management, and FINMA states that those requirements cover quantum risk as well. The guidance is an interpretation of an existing duty, not a new one.
Its scope is the reason it belongs in an archive discussion. FINMA recommends an inventory that covers “the encryption of data during transmission (e.g. VPN, TLS, HTTPS, etc.) as well as stored data”, together with digital signatures, key management and authentication. It asks institutions to identify data needing long-term guarantees of confidentiality, integrity or non-repudiation, and to weigh the risk of harvest-now-decrypt-later collection, where material encrypted today is taken now and decrypted later. Section 3.5 extends the same reasoning to outsourcing and external interfaces.
We covered the guidance on the day it landed, as a date written into the quantum-safe finance calendar: what mid-2027 means for a supervised Swiss institution and where it sits among the other national deadlines. That piece reads the guidance as a finance-sector instrument. This one reads it against BSI's two-track ladder and asks what the two together imply for material that is already stored, in any sector with a long retention duty.
Why the transmission half is moving on its own and the archive is not
Part of the transition can arrive with a software update rather than a decision, because TLS negotiates. The OpenSSL 3.5 LTS release of 8 April 2025 added ML-KEM, ML-DSA and SLH-DSA, and a hybrid group sits in the default group configuration that applications inherit unless they override it, which is itself configurable per application. So the narrow claim is this: an application built on updated OpenSSL, left on the default group configuration and talking to a peer that also supports and enables a common hybrid group, will negotiate one without a separate migration decision. Everything outside that description — applications that pin their own groups, software not yet updated, peers without support, internal protocols, embedded devices and anything already written to disk — is unaffected, and the claim says nothing about how much live traffic it covers today. We described the tooling side of the same effect in network monitoring learning the cryptography that is being replaced.
Storage has no equivalent mechanism. The LTO Program's media shipment report recorded 176.5 exabytes of compressed tape capacity shipped in 2024, up 15.4 per cent, a fourth consecutive record year attributed to unstructured data growth around machine-learning workloads. That figure measures media sold, not data written, encrypted or retained — and ordinary LTO is rewritable, with write-once behaviour a property of WORM media and of retention policy rather than of tape as such. What it does establish is direction: the archival layer under the AI estate is growing, not shrinking, and each cartridge added to it inherits whatever key hierarchy the site had at the time of writing.
Key-encrypting keys, and key material that is thirty-seven times larger
The best case in an archive is envelope encryption. Data is encrypted under a symmetric data key; that key is wrapped by a key-encrypting key; where the exposed operation is the asymmetric one, only the wrapped keys have to change, and a site moves kilobytes of key material instead of re-encrypting exabytes of data.
Two conditions have to hold before that shortcut is available, and neither is universal. The first is that an asymmetric operation is what actually protects the hierarchy. Where key-encrypting keys are themselves symmetric and held inside a hardware security module or a key-management service, the RSA or elliptic-curve exposure sits somewhere else — in transport to the appliance, in external key exchange, in the signatures over the catalogue — and re-wrapping does not reach it. The second is that the payload cipher still has margin. Grover's algorithm gives at most a quadratic speed-up on exhaustive key search, which is why symmetric cryptography is generally described as surviving the transition, and it is also why AES-128 is the weak case: a quadratic speed-up applied to a 128-bit key is a different proposition from the same speed-up applied to AES-256. An archive written under AES-128 may face re-encryption of the data itself rather than a key-wrapping exercise, and that is the expensive version.
Where re-wrapping is available, it still depends on every component in the chain carrying the larger post-quantum material. An ML-KEM-768 public key is 1,184 bytes under FIPS 203; an X25519 public key, under RFC 7748, is 32 bytes. Key-management servers, backup appliances, self-encrypting drives and the interfaces between them were built, sized and tested around the smaller number, so the constraint that surfaces in practice is not whether an algorithm exists but whether a given appliance, drive firmware or key-management integration handles the new key material at all. Deduplication sharpens it: conventional content-aware deduplication generally has to run before encryption, since encrypted blocks do not deduplicate, so in those designs the encryption an archive relies on often sits inside a vendor's appliance, which puts part of the migration schedule in a supply contract rather than an engineering plan — precisely the dependency FINMA's section on external service providers points at.
The signature side we have written about separately, and will not repeat here: the gap between a dated signing operation and the algorithm underneath it was the subject of Windows dating post-quantum signing while leaving the algorithm open, and the BSI and FINMA ladders as they bear on signature schemes were the frame of our read of what copy-based resilience costs a signature scheme. This post is about the confidentiality half and the custody of keys.
What a retention duty measured in decades does to a 2031 date
Read the instruments together and the arithmetic is uncomfortable rather than dramatic. In the Netherlands, article 7:454(3) of the Burgerlijk Wetboek requires a medical file to be kept for twenty years from the last change, or longer where good care requires it. Under the European basic safety standards directive, Council Directive 2013/59/Euratom, records of occupational radiation exposure are kept until the worker reaches or would have reached the age of 75, and in any case for at least thirty years after the work ends. Pension entitlements outlive the working life they record. A file written to an archive this quarter is routinely expected to remain confidential, intact and provable well past the last date on BSI's ladder.
This is where a technical schedule becomes a civic question. The people whose files these are — patients, pensioners, claimants, anyone who has signed something notarised — made no decision about cryptography and cannot inspect the result. They rely on an institutional promise that a record produced today will still be readable, and still provably theirs, in forty years. Harvest-now-decrypt-later collection is aimed at exactly that promise, which is why FINMA names it in the paragraph on critical data rather than in a threat annex. We took the medical end of the same problem apart in our earlier piece on harvest-now-decrypt-later in health data; what is new here is a dated supervisory ladder attached to it.
How Quentir Reads It
The useful shift in these two documents is not that Europe is moving faster than Washington on post-quantum policy. It is that the migration object changed. Through 2024 and 2025 the discussion was about algorithms and protocols: which scheme NIST selects, when a library ships it, whether a handshake negotiates it. BSI's two-track ladder and FINMA's inventory point somewhere else, at custody and format — who holds which keys, in which appliance, under whose contract, protecting which records for how long. Algorithm availability stopped being the binding constraint some time ago.
That also suggests why a financial supervisor moved first, though the guidance does not say so and this is our inference rather than FINMA's. Banks and insurers already maintain asset, system and vendor registers under operational-risk and outsourcing supervision. FINMA still has to ask them to create a cryptographic inventory, which it does; but it is asking institutions that already have a register habit and a supervisory channel for extending one. A hospital group with twenty-year file duties, thirty-year exposure records and imaging archives measured in petabytes has the harder version of the problem, and in this year's supervisory output we have not seen a comparable dated instrument aimed at health-sector record-keeping. The FINMA number worth carrying is not the 72 per cent who have done nothing. It is the 8 per cent with a specific roadmap, who expect four to five years before critical data and processes are quantum-safe. Measured from FINMA's own mid-2027 date, four to five years of work lands in 2031 or 2032 — past BSI's confidentiality dates, and that is the estimate from the institutions furthest ahead.
Our Signature Report, the PQC Migration Roadmap, is where these dates become an operating document: fixed scope, an executive summary, the dated evidence spine behind each national and supervisory deadline, refresh triggers for the ones still moving, and an internal-use licence so it can circulate inside an organisation. This post gives the two instruments and the reading; the report gives the schedule and the evidence behind it. The running free coverage stays on Quentir Intelligence.
One question a records-holding institution can answer this quarter, without a migration budget: of everything written to long-term storage in the last twelve months, what is the latest date on which any of it must still be confidential, and what is the latest date on which any of it must still be provable? Those are two different answers, and under BSI's ladder they now have two different deadlines.
Sources: Bundesamt für Sicherheit in der Informationstechnik, “BSI empfiehlt Ende klassischer asymmetrischer Verschlüsselungsverfahren”, press release of 11 February 2026, accompanying the annual update of Technical Guideline TR-02102 (page read 30 August 2026; the end-2031, end-2030 and end-2035 dates, the split between key agreement/encryption and signature procedures, and the hybrid-use recommendation are taken from that release). FINMA Guidance 05/2026, “Quantum computing”, 9 July 2026 — the guidance PDF itself, retrieved and read on 30 August 2026; all FINMA statements here are from that document: the survey of 60 authorised institutions run between November 2025 and January 2026 (section 2), the two-thirds/seven-year and two-thirds/ten-year expectations, 72 per cent with nothing planned or implemented, 28 per cent with a strategic decision, 20 per cent with a project running and 8 per cent with a specific roadmap expecting four to five years, the recommendation that “a PQC roadmap be drawn up by mid-2027 at the latest” on a board-adopted strategy (section 3.1), the inventory covering data in transmission “as well as stored data” (section 3.2), critical data and harvest-now-decrypt-later (section 3.3), crypto-agility (section 3.4) and external service providers (section 3.5). FINMA's own announcement page of the same date carries the summary. FINMA's recommendations sit on the existing technology-neutral governance and risk-management requirements of Swiss financial market law, as the guidance states in section 1; this post does not treat mid-2027 as a legal deadline. LTO Program Technology Provider Companies (Hewlett Packard Enterprise, IBM and Quantum Corporation), annual tape media shipment report for 2024, published July 2025: 176.5 exabytes of total compressed capacity shipped, 15.4 per cent growth over 2023, a fourth consecutive record year (read 30 August 2026). The figure is shipped media capacity, not data written or retained. OpenSSL 3.5 LTS release announcement, 8 April 2025, for ML-KEM, ML-DSA and SLH-DSA support, together with the OpenSSL 3.5 group-configuration documentation for the point that the default group list is per-application configurable. Key sizes are from NIST FIPS 203 (ML-KEM-768 encapsulation key, 1,184 bytes) and RFC 7748 (X25519 public key, 32 bytes). Grover's algorithm is described here as at most a quadratic speed-up on exhaustive key search, with the resulting distinction between AES-128 and AES-256 for long-lived data; that is the standard treatment and is not a claim about any specific archive. Retention duties: article 7:454(3) Dutch Burgerlijk Wetboek (twenty years from the last change to a medical file, longer where good care requires it) and Council Directive 2013/59/Euratom, article 43 (occupational exposure records kept until the worker reaches or would have reached 75, and at least thirty years after the work ends). Retention periods differ by jurisdiction and by record type; the two cited here are examples of the horizon, not a general rule. The description of envelope encryption, deduplication order and key-management interfaces is a general account of how archival storage is built, not a claim about any named product.
Published intelligence, built to inform your own decisions. Published: August 30, 2026.