Sweden's Central Bank Flags Quantum Risk: What the Riksbank's Financial Stability Report Actually Says

On 29 May 2026, Sveriges Riksbank, Sweden's central bank, published Financial Stability Report 2026:1 and, for the first time in the report's history, named quantum computing as a threat to today's encryption. The relevant passage reads: "Utvecklingen av kvantdatorer, och deras förmåga att i framtiden forcera många av dagens avancerade krypteringsalgoritmer, är ett annat exempel på hur teknikutvecklingen kan förändra hotbilden. Även om dagens kvantdatorer ännu inte har tillräcklig kapacitet är det viktigt att koordinerat och i takt med givna tidsrekommendationer övergå till kvantsäkra krypteringsalgoritmer." In English: "The development of quantum computers, and their ability to in the future break many of today's advanced encryption algorithms, is another example of how technological development can change the threat picture. Even though today's quantum computers do not yet have sufficient capacity, it is important to transition, in a coordinated manner and in line with given time recommendations, to quantum-safe encryption algorithms." This is not a regulation, a binding directive, or a cryptographic inventory requirement. It is a risk statement in an official biannual policy report, from an institution whose job is to assess threats to financial stability, not to write technical standards. That distinction matters for how much weight to put on it, and this article works through exactly what was said, where it sits in the report, and what it does and doesn't commit anyone to.

Where the passage actually sits

The quantum sentence is easy to overstate if you only see it quoted out of context, so it's worth being precise about its placement. Financial Stability Report 2026:1 runs 55 pages, structured around four chapters: the macrofinancial situation, the household and corporate sector, the Swedish financial system, and a summary stability assessment up front. The quantum-computing sentence appears in Chapter 2 ("Det makrofinansiella läget," the macrofinancial situation), inside a boxed sidebar titled "FAKTA – Geopolitisk oro och snabb teknisk utveckling förstärker cyberriskerna" ("Geopolitical unrest and rapid technological development amplify cyber risks"), on page 17.

That sidebar's main subject is cyber risk broadly, not quantum computing specifically. Most of the box is about the war in the Middle East turning American tech companies, which serve as critical third-party vendors to Swedish and European financial firms, into targets for physical and digital attacks, and about the rapid pace of AI capability growth (the box cites Anthropic's Mythos model, held back from commercial release specifically because of its unusually high capability at finding and exploiting software vulnerabilities, as a live example). The quantum-computing sentence is the last substantive point in that box, framed explicitly as "ett annat exempel," another example of how fast-moving technology can change the threat picture, alongside AI. It gets two sentences and two footnotes. It is not its own section, not in the report's front-matter stability assessment, and not repeated in the higher-level summary section (1.3, "Geopolitisk oro och teknisk utveckling ökar cyberhotet") that precedes it, which covers the same geopolitical and AI risks at length but does not mention quantum computing at all. The quantum risk, in other words, is real and dated, but it is currently a footnote-level addendum to the report's cyber-risk discussion, not a headline finding.

What "givna tidsrekommendationer" actually points to

The most substantive research question here is what timeline the report means by "givna tidsrekommendationer," given time recommendations, since the sentence itself doesn't name a source. Footnote 12, attached directly to that clause, answers it: "EU:s samarbetsgrupp för nät- och informationssäkerhet rekommenderar att övergången ska vara klar 2030 för högriskfall och 2035 för övriga fall." Translated: "The EU's cooperation group for network and information security recommends that the transition be complete by 2030 for high-risk cases and 2035 for other cases."

That is a direct citation of the EU's NIS Cooperation Group and its Coordinated Implementation Roadmap for the transition to post-quantum cryptography, which sets exactly that two-tier deadline structure across the EU: 2030 for high-risk use cases, 2035 for the general case. It is worth being precise that the Riksbank's footnote cites the EU roadmap, not NCSC Sweden's national guidance directly, even though NCSC Sweden's own 2026 recommendations ("Nationella rekommendationer för övergången till kvantsäker kryptografi") land on the same 2030/2035 structure, covered in depth on this tracker's Sweden country page. The Riksbank is not creating a new deadline of its own; it is pointing Swedish financial-sector readers at a timeline that already exists at EU level and is mirrored in Sweden's own national guidance, and asking that the migration happen in a coordinated way rather than piecemeal across institutions.

First mention, not a new posture

To check whether this was a genuinely new development rather than a restated position, this tracker downloaded and text-extracted both of the two preceding editions of the Financial Stability Report, 2025:1 (28 May 2025) and 2025:2 (13 November 2025), and searched them for any mention of quantum computing. Neither report contains the word "kvant" in any cryptography-related context; the only matches in either document are unrelated references to "kvantitativa åtstramningar" and "kvantitativa lättnader," quantitative tightening and quantitative easing, standard monetary-policy terms that happen to share a root word in Swedish. Financial Stability Report 2026:1 is, as far as this tracker's direct-source verification can confirm, the first edition in which the Riksbank's Financial Stability Report names quantum computing as a threat to cryptography.

The same 2026:1 report puts quantum risk in explicit company with a second emerging-technology risk it treats at much greater length: the rapid growth of AI model capability. The report cites external research (Kwa et al. 2026, from AI safety research group METR, "Measuring AI ability to complete long software tasks") for the specific claim that AI models' capacity to complete long, complex tasks has on average doubled every seven months over the past six years, and that the pace has been accelerating, and frames this as evidence that new technology can shift the balance between defenders and attackers faster than security organizations can adapt. Quantum computing gets two sentences framed as "another example" of that same dynamic; AI gets several paragraphs, a named model, and a cited empirical growth-rate study. The comparison is useful context: the Riksbank clearly sees quantum-safe migration as a real, worth-flagging risk, but treats AI-driven cyber risk as the more immediate and better-evidenced concern in this particular report.

The working paper is a different thing entirely

Separately from the Financial Stability Report, Riksbank's research division published Working Paper No. 398, "Quantum Technology for Economists," by Isaiah Hull, Or Sattath, Eleni Diamanti, and Göran Wendin, first in December 2020 and updated in November 2021. It is worth being precise about what this document is and isn't, because it's easy to conflate with the FSR statement and the two carry very different institutional weight.

The working paper is a broad, academic survey aimed at introducing quantum computing, quantum cryptography, and quantum money concepts to an economist audience; it is not a policy statement or a risk assessment. It does discuss the cryptographic threat directly, noting in a footnote that "Shor (1994) introduced a near-exponential quantum speedup to prime factorization, which compromises the commonly-used RSA encryption algorithm," and that "cryptocurrencies, such as Bitcoin, are also subject to attack from quantum computers (Aggarwal et al., 2018)." That is a substantive and correctly cited technical point, five and a half years before the FSR's own quantum-risk statement.

But the working paper carries the standard disclaimer printed on every paper in Riksbank's Working Paper Series: "The opinions expressed in this article are the sole responsibility of the author(s) and should not be interpreted as reflecting the views of Sveriges Riksbank." That is not boilerplate to skim past. It is the difference between an academic paper hosted on the Bank's website and an official position of the institution. Financial Stability Report 2026:1, by contrast, is published under the Riksbank's own name, is one of the Bank's two flagship biannual publications, and represents the institution's assessment, not one researcher's. The working paper is useful as evidence that Riksbank's research staff were tracking the Shor's-algorithm threat to RSA and to Bitcoin as early as 2020, which is a reasonable data point on how long this risk has been visible to people inside the Bank. It is not evidence of an institutional position, and this tracker treats it as background context rather than as a scored regulatory signal.

How this fits with Sweden's other quantum-risk sources

This is not Sweden's primary quantum-readiness source. That remains NCSC Sweden's national guidance, hosted at FRA (Försvarets radioanstalt), which sets the same 2030/2035 deadline structure in a dedicated, purpose-built recommendations document and is what this tracker scores against for Sweden. The Riksbank's FSR statement is a second, independent signal: Sweden's central bank, in its own institutional capacity and for its own financial-stability reasons, has now flagged the same risk and pointed at the same underlying EU timeline, without being asked to and without citing NCSC's document directly. That two separate authorities converged on the same 2030/2035 structure from different institutional angles, one a national cybersecurity guidance body, one a central bank's financial-stability process, is itself a signal worth noting, even though the FSR statement carries no inventory requirement, no compliance deadline of its own, and no enforcement mechanism.

For comparison, see how other central banks and financial regulators are approaching the same question: RBI's Q-SAFE committee in India was convened with an explicit mandate to build a cryptographic inventory and recommend a binding roadmap, a materially more active posture than a risk-statement sentence in a stability report. See the Sweden country page for the full scoring detail and how this Riksbank entry factors into the country's overall assessment.

Primary source: Sveriges Riksbank, Finansiell stabilitetsrapport 2026:1 (29 May 2026), p. 17. Prior editions checked for comparison: Finansiell stabilitetsrapport 2025:1 (28 May 2025); Finansiell stabilitetsrapport 2025:2 (13 November 2025). Academic context: Hull, Sattath, Diamanti, and Wendin, "Quantum Technology for Economists," Sveriges Riksbank Working Paper No. 398 (December 2020, updated November 2021).