Quantum Risk Is Already Here for Data That Must Stay Confidential

My kids think "quantum" is something out of a Marvel movie. And honestly, for a long time, I think a lot of the business world saw it the same way: interesting, a little unsettling, and always about ten years away. 

But here's what concerns me. We are spending so much time talking about AI that we may be overlooking the next emerging technology that could fundamentally change how we secure information, build products, and operate businesses over the next decade.  

Unlike some of the conversations around AI, we already know a significant part of what needs to happen with quantum. We just haven't started doing enough about it. 

On June 24, 2026, the White House Office of Management and Budget issued Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography. It gave federal agencies 120 days to submit their migration plans, with that deadline falling on October 22, 2026.

But I don't think the October 22 deadline is the most important part of this story. The more pressing question is why so many organizations are waiting for a regulatory deadline to begin addressing a risk they already know is coming. 

Quantum Is a Knowledge Problem Before It’s a Compliance Problem 

We recently attended a World Economic Forum meeting where quantum was a major topic and what struck us most from the conversation wasn't the technology itself. It was how much uncertainty still exists among business leaders, regulators, and even people working in this space. 

There is international debate about standards, questions about how quickly governments will move, and considerable uncertainty about what organizations should actually be doing today. Many leaders understand that quantum computing will eventually affect their businesses, but far fewer know where to start, what to prioritize, or how much to invest. 

We've seen this play out before with AI. Technology advances, organizations experiment, adoption accelerates, and then everyone scrambles to establish governance, standards, and accountability. Regulators around the world are now trying to get ahead of quantum to avoid repeating the reactive response they experienced with AI. Industry is also looking for proactive ways to establish responsible practices before regulations are finalized. 

We don't need to wait for regulation to tell us that understanding our risk is good business. And we certainly don't need to wait until everyone else is competing for the same talent and resources to start preparing.

Why Quantum Risk Matters Before the Computer Exists

Quantum risk doesn't begin the day a cryptographically relevant quantum computer becomes operational. 

Today, much of our digital infrastructure relies on public-key cryptography such as RSA and elliptic curve cryptography. These technologies protect communications, authenticate identities, secure software, and support the trust mechanisms behind modern commerce. A sufficiently powerful quantum computer could break many of these protections. 

Most importantly, an adversary doesn't necessarily have to wait until that computer exists. They can collect encrypted information today and potentially decrypt it years from now. It's called "harvest now, decrypt later." 

Think about medical records, intellectual property, financial transactions, government information, or any sensitive data that needs to remain confidential for the next ten or twenty years. If the information needs to remain protected longer than the time it takes to develop quantum capabilities, the risk already exists. 

The good news is that we aren't starting from zero. NIST finalized its first three post-quantum cryptography standards in 2024: ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures. We have a technical foundation, but having standards available and having organizations ready to implement them are two very different things. 

The hard part isn't choosing a new algorithm. It's changing everything that depends on the old one, which is a challenge within itself that many executives underestimate. 

Cryptography isn't sitting neatly in one application waiting for someone to update it. It's embedded throughout our businesses, in certificates, networks, APIs, cloud environments, hardware, firmware, devices, third-party software, and systems that may have been operating for decades. 

Some Cryptography Is Locked Inside Systems Built to Last 

Think about a manufacturer with encryption keys embedded directly into devices. Or a medical technology company with products expected to remain in service for fifteen years. Or a cloud provider supporting thousands of customers who all depend on the same underlying cryptographic infrastructure.

Moving to post-quantum cryptography isn't necessarily a software update. Some organizations will need to redesign hardware, account for larger keys and signatures, address processing and memory constraints, and rethink how their systems communicate. 

That's expensive, complicated, and time-consuming. It's also why I think crypto agility deserves a lot more attention than it's getting. 

In simple terms, crypto agility is the ability to change cryptographic algorithms and implementations without having to redesign your entire system. It involves building flexibility into the architecture so that as standards evolve, your technology can evolve with them. 

I would much rather invest in designing that flexibility today than discover five years from now that a critical product cannot be upgraded without replacing the hardware. And for organizations with long product lifecycles, five years may not be very much time at all. 

The OMB Memo Is Only the Starting Point for Quantum Risk Globally 

The OMB memorandum is an important milestone. It establishes a phased approach for federal agencies, with major risk reduction objectives by 2030 and additional migration milestones extending into the following years. It also has implications for cloud providers, federal contractors, and technology companies supporting government systems. 

But quantum risk doesn't recognize national borders. 

Organizations in Europe, the UK, Japan, India, and elsewhere are navigating their own standards, regulatory priorities, and technology decisions. There is still debate about how international standards will develop and whether different governments will align on their expectations. As global businesses, we cannot assume that one country's timeline will dictate everyone else's. 

This type of international uncertainty makes early preparation more important. Standards and regulatory expectations will continue to evolve, and some markets will move faster than others. But the underlying challenge is the same whether you're operating in Washington, London, Bengaluru, or Tokyo: How do you protect information and systems that were designed for a world where today's cryptography was considered secure? 

The organizations that begin understanding their exposure now will be better positioned to adapt as standards and requirements evolve. They will also have more flexibility to make technology investments based on their business needs rather than reacting to whichever regulatory deadline comes first. 

Why AI and Quantum Belong in the Same Conversation 

We tend to discuss AI and quantum as separate technological revolutions, but they may increasingly accelerate one another. 

AI is already being explored for applications such as quantum system design, control, and error correction. And advances in quantum computing could eventually open new possibilities for AI optimization, simulation, and certain machine learning workloads. There is still a lot of research between those possibilities and practical, large-scale applications, but imagine the implications of two technologies advancing together rather than independently. 

Right now, AI is understandably consuming much of the attention and investment in boardrooms. Its impact is immediate, visible, and already changing how we work. Quantum feels further away, and that makes it easy to push down the priority list. 

But that might be the wrong approach. The investments we make in security architecture today could determine how prepared our organizations are ten or fifteen years from now. AI may be changing how we operate today, but quantum could change what we're able to protect tomorrow. We need to be capable of thinking about both simultaneously. 

Questions Every Board Should Ask About Quantum Risk Today 

I wouldn't limit this conversation to technology companies or federal contractors. If your business relies on cryptography, which is essentially every modern business, there are some fundamental questions worth asking now: 

1. Do we actually know where cryptography exists in our organization? You cannot protect or migrate what you cannot find. That means understanding your systems, applications, certificates, hardware, and third-party dependencies. Building toward a Cryptographic Bill of Materials, or CBOM, is a practical way to create that visibility and maintain it over time. 

2. Which information needs to remain confidential for the next ten or twenty years? Not every system carries the same risk, so not everything needs to be migrated at once. Understanding the sensitivity and useful life of your data allows you to prioritize the areas where quantum exposure matters most. 
3. Can our systems support new cryptographic algorithms without major redesign? This is the crypto agility question, and for organizations building hardware or long-life products, I would be asking it immediately. If the answer is no, that should influence technology decisions being made today. 

I'd also want to know what our vendors are doing. Have we asked for their post-quantum roadmaps? Do we understand their dependencies and expected timelines? "We're looking into it" isn't much of a strategy, particularly when your ability to migrate may depend on someone else's technology. 

Finally, have we accounted for this in our investment plans, and who is accountable for making progress? Migration will take people, time, testing, and money. Starting early gives organizations the ability to incorporate these changes into normal technology refresh cycles instead of paying for emergency replacements later. This cannot live exclusively with a cryptography specialist or the security team. The CIO, CISO, product leaders, procurement teams, finance, and ultimately executive leadership all have a role. 

These aren't questions that require a fully developed quantum strategy to begin answering. They are questions that help you determine whether you need one, how urgently you need it, and where to start. 

Leadership Must Come Before Compliance 

At Schellman, we spend a lot of time helping organizations navigate emerging technologies, security requirements, and assurance expectations. One thing I've learned is that the strongest organizations don't treat compliance as the starting point for every decision. They understand their risks, make thoughtful investments, and build the right controls before someone requires them to. 

Quantum should be no different. 

I don't believe every company needs to launch a massive post-quantum migration tomorrow. And I certainly don't think we should encourage organizations to spend millions of dollars without understanding their exposure. But I do believe every organization should be able to answer a relatively simple question: What is our quantum risk, and what are we doing about it? 

That is a leadership question, not just a technical one. 

There is also an economic reality here that I don't think we're talking about enough. The longer organizations wait, the greater the possibility that they will be competing for the same specialized talent, technology, and implementation resources as everyone else. We don't know exactly how those costs will evolve, but waiting until migration becomes urgent limits your options. 

The organizations that begin now have the opportunity to learn, prioritize, budget, and make changes on their own terms. The ones that wait may find themselves making expensive decisions under pressure, with fewer options and less time. 

So yes, October 22, 2026, is an important deadline for federal agencies. But for the rest of us, the deadline isn't really 2030, 2035, or whatever date eventually appears in a regulation. The real question is when we stop treating quantum as somebody else's problem and start treating it as our responsibility. 

The organizations that start now get to migrate on their own schedule. The ones that wait will migrate on someone else's. 

I'd love to hear how other leaders are approaching this. Has quantum risk made it into your boardroom conversations yet, or is AI still taking up all the oxygen? For organizations looking for a starting point, NIST has published resources and guidance on post-quantum cryptography at nist.gov/pqc.