September 13, 2026
The cryptography that protects most of the world's data will eventually break. That much is settled. The migration to post-quantum algorithms is already underway.
What is not settled is who oversees the migration.
Every other high-stakes automated decision happens inside a domain that already has oversight. Financial decisions have regulators. Medical decisions have institutional review boards. Security decisions have auditors. Aviation decisions have the FAA. Nuclear decisions have the NRC.
Quantum migration has none of that. Not yet.
The Four Questions
Governance is not a policy document. It is not a committee. It is not a press release. Governance is the ability to answer four questions, at any time, for any decision.
What was decided? The specific action taken. The algorithm replaced. The system upgraded. The certificate rotated.
Who decided it? The human. The system. The automated process. The delegation chain. The authority that approved the action.
Why was it decided? The rule that fired. The policy that applied. The threshold that was crossed. The rationale that justified the choice.
Can it be proven? The record must be replayable. The chain must be intact. The proof must survive scrutiny — by an auditor, a regulator, or a court.
Governance without proof is administration. Administration without proof is trust. Trust without proof is the absence of governance.
The Oversight Vacuum
There is no auditor trained to review a cryptographic transition record. There is no regulator with explicit authority over migration decisions. There is no court precedent for what a compliant migration looks like. There is no certification body that recognizes a compliant migration when it sees one.
The standards are being written now. The oversight bodies are forming now. The question of how to prove a migration was performed correctly is being asked for the first time.
Most organizations will answer that question with a policy document. They will show a plan. They will show a vendor's assurance letter. They will show a project completion report.
None of those are proof. They are statements of intent. They are promises. They are the same kinds of documents that regulators have already stopped accepting in every other high-stakes domain.
Why This Is Different
Every other regulated industry went through the same transition. First, the technology arrived. Then, the incidents happened. Then, the regulators responded. Then, the standards were written. Then, the proof requirements emerged.
Quantum migration is at the first stage. The technology is arriving. The incidents have not happened yet. The regulators have not responded.
But the deadline has been set. January 1, 2027. New National Security Systems must support post-quantum algorithms upon delivery. The procurement gate is already in force.
The oversight is missing. The deadline is not.
What Comes Next
The first dispute over a non-compliant migration will happen. It may be a contract dispute. It may be a procurement challenge. It may be a lawsuit over an actual breach that occurred because a system was not migrated properly.
When that dispute arrives, the question will be the same one that every regulated industry eventually faces: can you prove it?
The organizations with a deterministic audit trail will answer yes. The organizations with a policy document will answer no.
The Governance Gap
Quantum governance is not a technology problem. The algorithms exist. The standards exist. The migration paths exist.
Quantum governance is an oversight problem. There is no one to oversee. No one to audit. No one to certify. No one to enforce.
The first organizations to build verifiable migration records will set the standard. The first regulators to require those records will create the oversight. The first courts to accept them will establish the precedent.
Until then, the only thing that exists is the deadline. And the question of who will be able to prove they met it.
Founder & CEO, Decision Security Layer
https://seais-decision-core.onrender.com
Contact: decseclayer@gmail.com
Top comments (0)