This topic has a guaranteed boredom score of 12 (where “10” represents catatonic). But its could make a difference to my own life score is 15 (where “10” represents “Yikes!”).
Data encryption is the peg on which the possibility of all modern financial and healthcare-related activity hangs. Without standard encryption algorithms like AES and RSA:
The contents of every exchange of information between you and your bank’s website would be visible to anyone on the internet.
The passwords you use to authenticate to your digital accounts would be readable by anyone with access to any node between you and your account’s host.
The sensitive data stored by any financial, healthcare, or government organization would be visible to anyone with access to their host systems - access made possible by decrypted passwords (see above).
Encrypted data contains all the original information. But its value lies in the assumption that the underlying algorithm is so complex that it would require the use of powerful computers and hundreds of years to crack it.
For the past 50 years, that assumption has held up well. But the theoretical existence of quantum compute resources - which can execute exponentially more compute operations than traditional processors - presents a theoretical threat to existing algorithms.
In other words sometime within the next 10-20 years, quantum compute devices will be powerful enough to brute-force the end of modern encryption. That’s sounds scary.
But it’s arguably not even the real problem. That, as Tyler Cowan recently wrote in the Free Press, would be the recent explosion of AI-driven discoveries in mathematics. Such events have introduced concerns about the odds encryption security could be compromised in months rather than years.
Frontier AI models are now at least making progress solving longstanding mathematical problems. The pace of discovery seems to be growing and it seems inevitable that someone somewhere will turn a powerful AI model on the algorithms we rely on.
So what are Canadian governments and institutions doing to prepare? Is it time to invest in survival kits, or are high-quality passwords and off-side data backups still good enough?
The government of Canada’s roadmap for the migration to post-quantum cryptography describes their official plan for collaboration with the U.S. National Institute of Standards and Technology (NIST). The goal is for all government agencies to apply post-quantum cryptography (PQC) mitigations according to this schedule:
April 2026: Develop an initial departmental PQC migration plan
Beginning April 2026 and annually after: Report on PQC migration progress
End of 2031: Completion of PQC migration of high priority systems
End of 2035: Completion of PQC migration of remaining systems
Even if this (worthwhile) initiative breaks with public service tradition and completes on time, the “on time” goalposts might have shifted long before 2035.
Canada’s Office of the Superintendent of Financial Institutions (OSFI) has its own guide for Canada’s banks. Last updated in March 2026, the guide is designed to raised awareness and assist private institutions achieve PQC goals. The guide also sets 2035 as a target for completing the transition.
Back in June 2026, the Bank of Canada reported on the initial report from G7 central-bank working group on quantum technologies. However, that report provided an analytical framework, not a binding migration schedule.
On the other hand, there have been sightings of Canadian banks (CIBC, for instance) advertising jobs with descriptions that include responsibilities for:
Preparing for the Post-Quantum Cryptography (PQC) era
Evaluating and implementing new post-quantum cryptography tecnologies
That suggests serious counter measures are already in motion. And my failure to find any explicit references to specific milestones in bank filings is hardly surprising. It would be irresponsible to make too much detail public.
The OSFI, at least, is absolutely aware of the risk potential here:
“Frontier AI models can locate and exploit more vulnerabilities, enabling adversaries to launch coordinated, large-scale attacks across systems, applications, and third-party ecosystems…These technologies reduce the time available for institutions to detect and respond to threats while simultaneously providing the potential for enhanced detection and patching of vulnerabilities before they are exploited.”
The potential for disruption is real. But it looks like large institutions are at least headed in the right direction. What can we do? It wouldn’t hurt to ask your bank about their official policies and contingency plans. Starting conversations can always help.
And why not? Go ahead and round up some bottled water and a few extra blankets.
Terms and Conditions: How Canadian Banks Override Their Customers' Property Rights
You know those “I have read and agree to the terms and conditions described in this document” boxes we all click before opening new accounts? Well it turns out that there’s actually stuff in those documents. And in the case of Canadian banks, that stuff could one day come back and bite us.
How Resilient Are Canadian Provinces?
Suppose one fine day the federal government was unable to show up for work. Perhaps it wasn’t feeling well. Or maybe it had borrowed so much money that it maxed out its line of credit, defaulted on its interest payments, and just couldn’t pay its bills. What then?
