Does Switzerland have a post-quantum cryptography (PQC) law?

No. Nothing published for Switzerland carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is FINMA (Eidgenössische Finanzmarktaufsicht) and NCSC/BACS (Bundesamt für Cybersicherheit).

What is Switzerland's PQC migration deadline?

2027. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from FINMA (Eidgenössische Finanzmarktaufsicht) and NCSC/BACS (Bundesamt für Cybersicherheit).

Does Switzerland require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

CHGuidance

Switzerland

Switzerland's FINMA issued non-binding supervisory guidance (9 July 2026) recommending that supervised financial institutions have a board-strategy-based PQC migration roadmap in place by mid-2027, following a survey finding most lacked one; the NCSC/BACS has separately published informational technical guidance on PQC.

Switzerland's post-quantum cryptography posture is classified as guidance, led by FINMA (Eidgenössische Finanzmarktaufsicht) and NCSC/BACS (Bundesamt für Cybersicherheit), with a migration target of 2027. It scores 50/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

FINMA (Swiss Financial Market Supervisory Authority) published Guidance 05/2026 (9 July 2026) on quantum computing, following a survey of 60 Swiss financial institutions (Nov 2025–Jan 2026) that found most lacked a clear roadmap for migrating to quantum-safe encryption. As supervisory guidance, not a binding legal mandate, FINMA recommends that supervised institutions base their PQC transition on a strategy adopted by the board of directors, and that a PQC roadmap be drawn up by mid-2027 at the latest. Separately, the Swiss NCSC (since rebranded BACS, Bundesamt für Cybersicherheit) published a technology brief on quantum computers and post-quantum cryptography (dated December 2025, preceding the FINMA guidance).

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source is explicitly supervisory guidance: FINMA "recommends" institutions base their PQC transition on a board-adopted strategy, not a binding legal requirement with penalties, so this sits at the guidance/non-binding end of the scale.
Deadline concreteness	20/20	A specific year is stated: "FINMA recommends that a PQC roadmap be drawn up by mid-2027 at the latest."
Scope of coverage	10/20	Coverage is limited to a single regulated sector, Swiss financial institutions supervised by FINMA (confirmed by the survey of 60 Swiss financial institutions), not economy-wide or all critical infrastructure.
Inventory/CBOM requirement	10/20	The source does not name an explicit cryptographic inventory/CBOM mandate; it calls for a board-adopted strategy and migration roadmap, which plainly implies an inventory of cryptographic assets would be needed to execute it, matching the 'implied via general obligation' tier.
Regulatory activity	10/20	FINMA is a named authority with an active program (survey of 60 institutions, published guidance) but the source frames its roadmap expectation as a recommendation institutions should 'take into account' rather than describing fines, audits, or certification enforcement mechanisms.
Total	50/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Swiss National Bank (SNB)
Not yet addressed, a gap to watch
Not yet addressed directly. SNB's oversight pages for systemically important financial market infrastructure contain no post-quantum cryptography or cryptographic-inventory content.
SIX Group
Has published guidance
SIX published a detailed post on how it protects Swiss payment infrastructure against the quantum threat, naming "harvest now, decrypt later" explicitly, describing an inventory-style review of where cryptography is used across its interfaces, protocols, and hardware security modules, referencing NIST's ML-KEM (FIPS 203) standard, and citing a 2030/2035 timeline for deprecating legacy algorithms. This is real, substantive, dated technical guidance from a critical payments-infrastructure operator, though not a regulator issuing a binding mandate.
"Quantum Computers and Post-Quantum Security: How the Swiss Payment Transactions System Is Protecting Itself" →Read the full breakdown →

FAQ: Switzerland and PQC

Does Switzerland have a post-quantum cryptography (PQC) law?: No. Nothing published for Switzerland carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is FINMA (Eidgenössische Finanzmarktaufsicht) and NCSC/BACS (Bundesamt für Cybersicherheit).
What is Switzerland's PQC migration deadline?: 2027. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from FINMA (Eidgenössische Finanzmarktaufsicht) and NCSC/BACS (Bundesamt für Cybersicherheit).
Does Switzerland require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.