Japan, South Korea And Australia: Three Different Routes

Japan, South Korea and Australia are often grouped together as advanced Asia Pacific economies, but on cryptography and AI they have taken quite different paths. Japan’s financial regulator has moved from a study report to a direct request that banks start post-quantum work now. South Korea has put a horizontal AI law into force but has no verified national post-quantum deadline. Australia’s signals directorate has the earliest government date of the three for retiring today’s public-key cryptography.

This article compares the three as of October 2026, labelling each instrument by its legal weight. It is general information, not legal advice. The regional overview shows where they sit among other jurisdictions.

Japan: From Study To Supervisory Request

Japan’s Financial Services Agency (FSA) has built its position in steps.

Cybersecurity Guidelines for the Financial Sector (Supervisory, 4 October 2024). Among the baseline items, section 2.3.3 covers the choice of encryption method and the lifecycle management of keys and certificates, pointing institutions to the CRYPTREC list, Japan’s government-recommended list of ciphers.¹

Study group report on post-quantum cryptography (Guidance, 26 November 2024). An FSA study group on deposit-taking institutions recommended a stocktake of where and which algorithms are used, and said high-priority systems should be able to use post-quantum algorithms by around the mid-2030s, while watching technical progress and overseas rules.²

Request to start now (Supervisory, published 24 June 2025). In notes from a meeting with new-type banks (banks without traditional branch networks), the FSA said institutions should start immediately on a roadmap with their IT vendors, build an inventory listing which cryptography each information asset uses, and assess the risk, including harvest now, decrypt later. It added that banks should not wait for an industry roadmap template.³ The FSA follows this up through its monitoring.

Government systems (Draft). A Cabinet Secretariat interim summary dated November 2025, marked as a draft, says government agencies should in principle migrate to post-quantum cryptography by around 2035, with a roadmap to be drawn up in fiscal year 2026.⁴ The FSA’s 2026 Strategic Priorities of 15 September 2026 commit it to promoting a smooth transition in the financial sector (Guidance).⁵

South Korea: AI Law First

South Korea’s Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation of Trust (Act No. 20676) was promulgated on 21 January 2025 and took effect on 22 January 2026 (Binding).⁶ It makes South Korea one of the few jurisdictions with a horizontal AI statute in force. Japan’s AI Promotion Act, fully in force since 1 September 2025, is a promotion law with no penalty provisions.⁷ AI regulation at a glance compares both laws with others.

On post-quantum cryptography, the picture is thinner. The Ministry of Science and ICT and the Korea Internet and Security Agency (KISA) supported pilot use of post-quantum cryptography in energy, health care and public administration in 2025, and in January 2026 announced 2026 pilot conversion projects in telecommunications, finance, transport, defence and space (Announcement).⁸ Reports of a national master plan with a 2035 target could not be traced to a primary government document for this article, so no Korean post-quantum date is given here.

Australia: The Earliest Government Date

ASD guidance (Guidance). The Australian Signals Directorate’s publication “Planning for post-quantum cryptography”, last reviewed on 22 September 2025, explains that ASD’s Information Security Manual (ISM) advises organisations to stop using traditional asymmetric cryptography, including RSA, Diffie-Hellman, ECDH and ECDSA, by the end of 2030.⁹ The ISM’s cryptography guidelines, in their September 2026 edition, back this up: controls ISM-0472, ISM-0474, ISM-0475 and ISM-0476 stop approving those algorithms after 2030.¹⁰ ASD also sets two interim steps, a refined transition plan by the end of 2026 and a transition under way by the end of 2028.⁹ That is earlier than the 2035 end dates that the UK, EU and US set for completing migration, although the EU and US also target 2030 for their highest-priority systems.

APRA (Guidance and Binding). The Australian Prudential Regulation Authority’s guide CPG 234 (June 2019) expects algorithms from well-established international standards, key lengths sized against current computing power, and managed key lifecycles. It does not mention quantum computing.¹¹ APRA’s binding information security standard, CPS 234, has applied since 1 July 2019 and requires controls that protect information assets in proportion to the threats they face, without naming particular algorithms.¹² CPS 230 on operational risk management, also a binding prudential standard, commenced on 1 July 2025; targeted amendments finalised on 30 April 2026 took effect on 1 July 2026.¹³ No APRA quantum statement was found.

Cyber Security Act 2024 (Binding). Assented on 29 November 2024, it introduced, among other measures, mandatory reporting of ransomware payments.¹⁴ It does not set cryptography requirements.

Deadlines To Watch

What This Means In Practice

The three countries agree on one thing even though their instruments differ: the first task is to know where cryptography is used. Japan’s FSA has asked for that inventory directly, and both the ASD and APRA expectations assume it, because algorithms cannot be retired or keys resized without it. Cryptography Compliance covers how such an inventory is built, and AI Governance And Regulation covers the AI frameworks in depth.