Workshop Description
Executive governance briefing for city council technology leads and elected officials on smart city boards. Covers NIS2 Article 21 and GDPR Article 32 quantum security obligations for local authorities, PQC procurement clause drafting, vendor quantum readiness assessment, and long-lifetime infrastructure risk for traffic controllers, smart meters, and tunnel SCADA.
City authorities face a governance problem that commercial organisations do not. Smart city infrastructure has exceptionally long operational lifetimes: traffic signal controllers remain in service for 15-20 years, smart meters for 10-15 years, and tunnel SCADA systems for 20 years or more. Technology procured today under current contracts will still be operational when cryptographically relevant quantum computers arrive. If those procurement contracts do not include quantum readiness requirements, the city will face expensive retrofit programmes or accept quantum-vulnerable critical infrastructure. NIS2 Article 21 requires essential service operators (which includes many local authority functions) to implement "state of the art" security measures. As NIST PQC standards (FIPS 203/204/205) enter European procurement frameworks, "state of the art" will include post-quantum cryptography. GDPR Article 32 requires "appropriate technical measures" for personal data, and city authorities hold some of the longest-retention personal datasets in any sector: council tax records, housing applications, social services case files, and electoral rolls. This briefing equips decision-makers with the regulatory knowledge, procurement language, and vendor assessment criteria needed to embed quantum readiness into city technology governance before current contracts expire.
What participants cover
- NIS2 Article 21 obligations: when "state of the art" security measures will mandate PQC for essential services operated by local authorities
- GDPR Article 32 quantum risk: long-retention personal data (council tax, housing, social services) encrypted with quantum-vulnerable algorithms
- Procurement governance: drafting quantum readiness clauses for cloud, IoT, and managed service contracts before current frameworks expire
- Vendor assessment: evaluating technology suppliers on cryptographic agility, PQC roadmap maturity, and hybrid deployment capability
- Long-lifetime infrastructure: traffic controllers (15-20 years), smart meters (10-15 years), and tunnel SCADA (20+ years) must survive the quantum transition
- National guidance alignment: NCSC (UK), ANSSI (France), and BSI (Germany) PQC recommendations mapped to city authority governance frameworks