Workshop Description
Healthcare boards do not need to understand lattice-based cryptography. They need to understand that the NCSC published a three-phase migration roadmap in March 2025 with a Phase 1 deadline of 2028, that NIS2 places hospitals under mandatory risk management obligations enforceable with fines of up to EUR 10 million, and that the harvest-now-decrypt-later threat means patient data being collected today may be exposed in a future breach even if current encryption is adequate by today's standards. An NHS trust CIO with a 5-year capital planning cycle can map those phases directly to budget cycles. That is actionable in a way that 'start thinking about quantum' is not.
The investment case for quantum readiness is not simply about risk mitigation. McKinsey estimates quantum computing will create $200 to $500 billion in value for life sciences by 2035. Health systems that build computational quantum capability now, in genomics, drug discovery partnerships, and clinical trial acceleration, will compete differently from those that do not. This workshop frames both sides: the security obligation that is already arriving through NIS2 and NCSC guidance, and the strategic opportunity that early-adopter health systems are beginning to capture. Participants leave with a board reporting template, a regulatory obligation checklist by jurisdiction (UK, EU, US), and a framework for commissioning a quantum readiness programme without over-spending on speculative capability.
What participants cover
- NCSC March 2025 three-phase migration roadmap: translating Phase 1 (to 2028) into an NHS board action item
- Regulatory exposure map: NIS2 (EUR 10M penalties), GDPR, NHS DSP Toolkit, HIPAA enforcement timelines
- Investment sequencing: where to start now (PQC), what to pilot 2026-2028 (simulation), what to defer (fault-tolerant QC)
- NHS and global comparators: which health systems are ahead on quantum readiness and what they have done
- Board governance for quantum risk: reporting frameworks, risk register language, and non-technical communication
- Commissioning a quantum readiness programme: scope, budget indicatives, and avoiding consultant-led scope creep