A mathematical AI is making notable progress. But what if it ultimately breaks post-quantum encryption?
Asked about this at the Cybersecurity Assizes, Philippe Coué did not deny the existence of such a risk. But, he argues, this should not prevent Crédit Agricole from preparing for the famous Q-Day—an as-yet-hypothetical milestone when quantum computers would become powerful enough to crack current asymmetric encryption algorithms.
Timeframes for 2030 and 2035
Philippe Coué is Group COO Cybersecurity & Risk IT. “In charge of everything related to transformation, awareness, and innovation on IT risks and topics,” as he defines himself.
It’s been “a year and a half, two years” that Crédit Agricole has been weighing the issue of post-quantum encryption. As a systemic bank, it faces deadlines in 2030 for its critical assets and in 2035 for the remainder of its fleet. For now, these are recommendations—found, for example, in a G7 roadmap. There are no regulatory obligations yet. “But the ECB is already starting to ask us questions,” it notes.
A first crypto-agile PoC in insurance
Crédit Agricole has also begun collaborating with its technology partners on a roadmap, while embedding PQC requirements into every new contract. It is currently in an inventory phase, which began with a macro-level survey of the main encryption usages and data requiring protection for more than 10 years.
A PoC with CryptoNext Security kicked off in the first half of 2026. It covers a “restricted but representative” perimeter. Specifically, an application in the insurance domain, with “business lines in France and abroad [and] different technologies.”
“The goal is to take advantage of the move to post-quantum to introduce the notion of cryptographic agility,” explains Florent Grosmaitre, president of CryptoNext. In other words, moving toward configurable cryptography, centrally managed, with the algorithm choice made at execution time based on a policy.
Crédit Agricole is not there yet: “Today, switching from one algorithm to another in our infrastructures is a mountain because cryptography is hard-coded,” summarizes Philippe Coué.
Hybridization, a means, not an end
For applications whose code cannot be changed, the group is exploring an alternative TLS overlay mechanism. It involves routing the original flow through a post-quantum tunnel managed by a proxy.
If hybridization isn’t the immediate target, the approach has already been tested with its subsidiary, CACEIS, which specializes in financial services for institutional investors. It could serve as a workaround “if we cannot migrate in time, which is, unfortunately, often the case.”
Crédit Agricole plans to structure a program mode for 2027, with a budget, while broadening the scope to payments and investment banking. As for the possibility that major cryptographic libraries will eventually embed crypto-agility directly, Philippe Coué adopts the same stance as with the mathematical AI: “We must experiment.”
Unresolved architectural questions as of now
“I hate to say it, but we lack agility in setting up testing environments, admits the executive. We are very industrial. […] We still lack the mindset or lab environments that would let us test in a hands-on way new technologies and new use cases.”
The first experimentation was “more technical than business-focused.” Talking about the impact of post-quantum encryption on performance is therefore “a bit premature,” asserts Philippe Coué. What is certain is that architectural questions arise, as the experimental options present a single point of failure…
