AMF's 2026 Priorities: France's Securities Regulator Will Start Inspecting for Quantum Risk

On 14 January 2026, the Autorité des marchés financiers, France's securities and financial-markets regulator, published its supervisory priorities for the year in a release titled "The AMF sets its priorities for 2026 for deeper, safer and more resilient financial markets open to innovation." Inside the cybersecurity section of that document, AMF states that it will conduct inspections to ensure the robustness of regulated market participants' cybersecurity systems, and that these inspections "will begin to include anticipation of the impact of quantum computing." It is a forward-looking supervisory commitment inside a real, dated annual planning document, not a completed migration mandate, a published standard, or a cryptographic inventory requirement, but it is a concrete, named line item in what a European securities regulator says it will actually go and inspect for.

Where the quantum commitment sits in the document

The passage sits inside a section AMF titles "Creating the conditions for an even more safe and resilient financial centre," one of four top-level priority themes in the 2026 release. The full paragraph reads:

"In the area of cybersecurity, the AMF will support the implementation of the European DORA Regulation on digital operational resilience in the financial sector. It will conduct inspections to ensure the robustness of regulated market participants' cybersecurity systems. It will begin to include anticipation of the impact of quantum computing in these inspections."

Three sentences, each narrowing scope: first DORA implementation support generally, then AMF's own cybersecurity inspection program for the market participants it regulates, then quantum computing specifically as a new dimension of that existing inspection program. The document gives no specific timeline for when these quantum-aware inspections begin, no named list of which regulated entities will be inspected first, and no scope definition beyond "these inspections," meaning the cybersecurity inspection program AMF already runs. There is no companion CBOM requirement, no inventory obligation, and no compliance deadline attached to the commitment anywhere in the release.

The other three priorities for 2026

AMF's 2026 release is organized around four top-level themes, and the quantum-computing line sits inside only one of them:

• Fostering the development of European capital markets and the attractiveness of the Paris financial centre, covering AMF's work on EU capital-markets policy and competitiveness.
• Providing a framework conducive to innovative finance in the age of artificial intelligence, covering AMF's supervisory approach to AI adoption by regulated firms.
• Creating the conditions for an even more safe and resilient financial centre, the section containing the DORA and quantum-computing passage above, alongside AMF's broader cybersecurity and resilience work.
• Accelerating the AMF's transformation to fulfil its role as a pillar of trust, covering AMF's internal modernization as an institution.

That structure matters for how to read the quantum mention: it is not an isolated announcement bolted onto a press release, but one specific, named commitment inside a section AMF devotes to cybersecurity and resilience generally, itself one of four pillars of a real annual strategic planning document that also covers AI policy and capital-markets competitiveness. Reading it in that context is useful for calibrating its weight: it sits at the same level of specificity as AMF's other named 2026 commitments, not elevated above them and not a throwaway aside either.

Not AMF's first mention of quantum risk

This is not the first time quantum computing has appeared in AMF's own writing. AMF's general annual risk-mapping report, a separate recurring publication that surveys emerging risks across the markets it supervises, already lists quantum computing as an emerging risk to encryption standards. That risk-mapping mention is thinner: a line item flagging a future risk category, without an accompanying supervisory action attached to it. The 2026 priorities release is a step beyond that: the same underlying risk (quantum computing's eventual impact on cryptography) now has a specific, named supervisory activity attached to it (cybersecurity inspections), even though that activity has neither a start date nor a defined scope yet. Two AMF documents, a year or so apart in the same institution's own output, moving from naming a risk to naming an inspection that will account for it, is itself a real signal about how the topic is moving through the regulator's internal priorities, independent of any binding mandate.

AMF and ACPR jointly convened a quantum computing session in October 2025

Separately from AMF's own written releases, AMF co-organized a public event addressing quantum computing risk to finance in the months before the 2026 priorities release. On 9 October 2025, AMF and the Autorité de contrôle prudentiel et de résolution (ACPR), France's banking and insurance supervisor, jointly held the sixth edition of their annual Forum Fintech ACPR-AMF, part of the French FinTech Weeks. This research independently verified the event via ACPR's own event pages (the original PDF program link had gone stale), which confirm the forum's morning session included a roundtable titled, in French, "Informatique quantique face à la finance : levier d'innovation ou menace cryptographique ?" ("Quantum computing facing finance: innovation lever or cryptographic threat?"). A separate ACPR recap page for the same sixth edition describes the session under the shorter working title "La menace quantique" ("The quantum threat"), noting it was the first time the topic had appeared at the Fintech Forum, with a five-person panel drawing on financial institutions, solution providers, and public authorities, including Banque de France sharing its own quantum-related experiments and ANSSI outlining its guidance for the transition to post-quantum cryptography.

The Fintech Forum is a public discussion event, not a rulemaking or inspection process, so it does not itself create any obligation for regulated firms. What it does establish, independently of the January 2026 priorities release, is that AMF (jointly with ACPR) was already convening its own supervised ecosystem to discuss quantum computing's cryptographic implications for finance three months before AMF wrote quantum-aware cybersecurity inspections into its formal 2026 supervisory priorities, which is consistent with the priorities document reflecting a topic AMF had already been actively engaging with rather than a one-off addition.

What this is, and isn't

AMF's 2026 priorities release commits the regulator to a direction, not a standard. There is no published PQC migration roadmap comparable to ANSSI's phased hybridization guidance, no cryptographic inventory or CBOM requirement comparable to what this tracker has documented in India or under EU-level DORA technical standards, and no compliance deadline for regulated firms to act by. What exists is a named, dated statement from the securities regulator itself that its inspection program will start accounting for quantum computing, embedded inside a real annual planning document alongside AMF's other stated 2026 priorities, and preceded by a public forum at which AMF's own staff were already engaging with the topic substantively. That is meaningfully more than a passing mention in a risk register, and meaningfully less than a supervisory mandate with teeth.

How this fits with France's other regulators

AMF is one of several French authorities now on record about quantum computing risk to finance. ANSSI, France's national cybersecurity agency, has published the most concrete artifact of the group: a phased hybridization roadmap enforced through its security-visa and product-qualification scheme, though that applies only to vendors seeking ANSSI certification rather than economy-wide. Banque de France, through the payment-security oversight body it chairs, has published its own study recommending post-quantum algorithm adoption and has run cross-border PQC pilot experiments. ACPR, the banking and insurance supervisor and AMF's co-host at the Fintech Forum, separately launched a 2026 cycle of consultations inviting institutions to advance their own PQC migration roadmaps. AMF's contribution sits alongside these: a securities regulator naming quantum computing as a new dimension of its existing cybersecurity inspection program, one part of a broader pattern of French financial authorities engaging with the topic without, so far, any single one of them issuing a binding, dated, economy-wide migration mandate. See the France country page for how this tracker scores the combination of ANSSI, Banque de France, ACPR, and AMF activity together.

Primary source: AMF, "The AMF sets its priorities for 2026 for deeper, safer and more resilient financial markets open to innovation" (14 January 2026). Additional sources: ACPR, "Forum Fintech ACPR-AMF 2025" event page; ACPR, "6e édition du Forum Fintech ACPR-AMF" recap.