Windows 11 still requires TPM 2.0, but the component providing that security function is changing on new AMD and Qualcomm platforms. According to Windows Latest’s October 27 report by Abhijith M B, Microsoft’s documentation now says that, beginning with 2026 silicon, Pluton no longer serves as the TPM on those platforms. A vendor firmware TPM or a discrete TPM supplies that functionality instead.
For buyers and IT teams, the important question is not whether Windows is abandoning TPM protection. It is who maintains the implementation, how fixes reach each device, and how long that update path remains supported.
What changes, and what stays the same
The reported documentation change separates two roles that are easy to confuse: having Microsoft Pluton in a processor and using Pluton as the system’s TPM. Pluton remains a supported security processor for a hardware-isolated Windows security environment. Its presence no longer means it provides TPM services on the affected new platforms.
Windows 11’s TPM 2.0 requirement remains unchanged. BitLocker and Windows Hello do not become obsolete because a compatible firmware or discrete TPM takes over the role. These features rely on supported security capabilities, rather than requiring every PC to use the same TPM implementation.
Existing systems are a separate case. Microsoft’s note, as quoted by Windows Latest, says devices using 2025 or earlier AMD and Qualcomm silicon that shipped with Pluton configured as their TPM remain serviced and supported. This is not an instruction to replace a working PC or change its firmware configuration.
Do not assume every laptop sold in 2026 is affected
The wording concerns silicon generations, not simply the date on a sales receipt. Windows Latest notes that Microsoft has not identified exactly which chips fall within the new boundary. That matters when a processor is announced in one year and laptops containing it reach customers in the next.
The report also distinguishes AMD and Qualcomm from Intel. Microsoft names AMD and Qualcomm in the change to Pluton’s TPM role; the broader reference to Intel describes firmware or discrete TPM provision. It should not be interpreted as proof that Intel underwent the same transition.
For procurement, ask about the exact laptop model and processor configuration. A general claim that a product includes Pluton is not enough to establish which TPM Windows actually uses.
Why the firmware update path matters
A TPM protects cryptographic material and supports functions such as measured boot and drive protection. Implementations differ: a discrete TPM uses a separate chip, while a firmware TPM operates within a protected processor environment. Meeting TPM 2.0 requirements does not make every design identical in its resistance to every attack.
Pluton’s update architecture has been a prominent part of Microsoft’s pitch. Windows Latest describes how newer Pluton firmware can be delivered through Windows Update and loaded during startup. With a vendor firmware TPM, fixes commonly arrive through a PC manufacturer’s BIOS or UEFI release.
That distinction is about responsibility, not necessarily the download interface. An OEM firmware package may itself be distributed through Windows Update. The underlying question is whether the manufacturer has incorporated, validated, and released the relevant fix for your specific model.
Windows Latest cites AMD’s August disclosure of two high-severity issues affecting its firmware TPMs, with users directed to their OEM for model-specific BIOS updates. That example illustrates the dependency; it does not establish that every new AMD laptop is vulnerable or that Pluton would eliminate all security risks.
Check your current PC without changing it
Start with observation rather than firmware experimentation:
- Press Win + R, enter tpm.msc, and open TPM Management.
- Check the status and look for Specification Version 2.0 under TPM Manufacturer Information.
- Record the manufacturer information alongside the PC’s exact model and BIOS version.
- Consult the manufacturer’s support page for relevant firmware releases and security advisories.
Manufacturer information is a useful starting point, but it may not explain the complete hardware design. For a managed fleet, confirm the implementation against vendor documentation rather than drawing conclusions from one field alone.
Do not clear the TPM, disable it, or switch between available implementations just to investigate this news. Such changes can disrupt access to protected keys and trigger recovery requirements. A supported, functioning existing configuration does not need an unsolicited migration.
Treat BIOS updates as security maintenance
Before applying a firmware update, confirm that your BitLocker recovery key is backed up and accessible somewhere other than the encrypted PC. Firmware changes can trigger a recovery prompt, and discovering that the key is unavailable after a restart is avoidable disruption.
Follow the manufacturer’s instructions, including any guidance about temporarily suspending BitLocker protection. On work devices, use the organization’s approved process rather than changing encryption settings independently. IT teams should test updates on representative hardware, confirm recovery-key access, and check protection status afterward.
For new purchases, evaluate firmware support duration, security advisory quality, release history, and deployment tooling alongside processor specifications. The practical buying criterion is a maintained security platform, not a logo alone.
Microsoft has not explained the reason for this change in the material reported by Windows Latest. Until that explanation and a clearer chip list appear, the sensible response is straightforward: keep TPM protection enabled, verify the actual implementation, and make firmware maintenance part of routine Windows security management.