Maturity check: quantum security and AI governance

Twelve questions on the requirements FINMA sets out in supervisory notice 05/2026 and in Guidance 08/2024. Rate each statement honestly. You see the result immediately, nothing is transmitted and nothing is stored.

The assessment runs entirely in your browser. No data leaves the page, no entries are stored and no cookies are set. The check is an orientation and neither an audit nor a confirmation of supervisory compliance.

Block A

Quantum security

A quantum security strategy has been approved by executive management, with priorities and target dates.

A cryptographic inventory records all methods in use across in-house, outsourced and purchased systems, and it is kept current.

For data with a long protection period, the "harvest now, decrypt later" attack has been assessed and the migration order derived from it.

Critical data is protected in hybrid form during the transition, meaning a classical and a quantum-safe method at the same time.

Cryptographic agility is a binding requirement for new systems and for procurement.

Outsourcing contracts contain requirements on the PQC maturity of service providers as well as exit strategies.

Block B

AI governance

There is an inventory of all AI applications in use.

The AI applications are risk-classified according to consistent criteria.

Accuracy, stability and bias are tested and monitored on an ongoing basis.

For each application it is documented which data and rules a result rests on and who signed it off.

Material AI applications are reviewed independently, separate from development.

It is defined where models and data are operated and which data may not leave the house.

0 of 12 statements answered. The result appears once every statement is rated.

This check is a non-binding orientation based on publicly available supervisory documents. It is not an audit, not a review and not a confirmation that requirements are met. It does not replace legal, tax or investment advice.