Racks of servers lit in blue, with rows of status lights seen at a steep angle.

For CISOs, heads of AI, ML platform and MLOps leads, data protection and AI governance leads, and the boards of organisations building or deploying AI

Quantum risk in AI security

Your model is the most expensive secret you hold. Know what protects it, and for how long.

In fifteen minutes you will know which model weights, training data, prompts and keys are already exposed to harvest now, decrypt later collection, what the EU AI Act, the GPAI Code of Practice, NIS2 and the NIST and NCSC AI guidance let a regulator, a customer or an auditor ask about the cryptography around your AI systems, and the first 90 days of a plan your board can sign.

Check your readiness in 2 minutes See the 90-day plan

Your exposure, model by model and dataset by dataset
The evidence the AI Office, a NIS2 authority and your customers can ask for
A 90-day plan your board can approve
The right training for each role

1,500+: professional members
900+: organisations represented
40+: countries
Vendor-neutral: based on evidence, not hype

Proud to recommend our expert members

A close view of a graphics card with orange-lit fans and a copper-toned heat sink in a dark case. — Trained over years. Copied in an afternoon. Read when the key falls.

Step 1 of 5

Know which model weights and training data are already exposed

A model is unusual among corporate secrets. It costs years of data collection and compute to make, fits on a single drive, and loses most of its value the moment a competitor or a hostile state has a copy. The AES-256 that encrypts your checkpoints at rest will hold. What will not hold is the RSA or elliptic-curve key that wrapped the data key, the TLS handshake that moved a dataset from the lake to the training cluster, the ECDSA signature on the artefact in your registry, or the token that authorised an inference call. Anyone recording that traffic now can read it when a cryptographically relevant quantum computer arrives. If the model, the dataset or the log still matters then, it is exposed today.

AI assets that must stay confidential beyond the post-quantum deadlines
What you hold	How long it stays sensitive	Confidential until, if created in 2026
Model weights and checkpoints of a proprietary or frontier model	Until the model is released or securely deleted; the GPAI Code of Practice protects unreleased parameters for exactly that long	No fixed end; most organisations have never set one
Training datasets containing personal, clinical, financial or client data	Inherits the retention of the source records, commonly ten years or more, and the personal data never stops being personal	2036+
Fine-tuning, RLHF and preference data	Shows how the model was shaped and what it was told to refuse; sensitive for the life of the model line	Several model generations, well into the 2030s
Prompts, system prompts and inference logs	AI Act Article 19: at least six months for high-risk providers; enterprise retention is usually longer, and the contents are your customers' data	2027 at minimum, often years
Technical documentation, evaluation and red-team results (AI Act Article 18)	Ten years after the high-risk system is placed on the market or put into service	2036+
API keys, service tokens and the signing keys for your model registry	The life of the key; a signing root for artefacts is commonly five to ten years, and every model signed beneath it inherits it	2031 to 2036+

Statutory periods from Article 18 and Article 19 of the AI Act; model parameter protection from the GPAI Code of Practice, Safety and Security chapter. Model and key lifetimes are common practice, not statute; read them against your own data retention schedule and key management policy.

Where your exposure sits, and what you will know

Lines of colour-highlighted program code on a dark monitor, seen at an angle.

The model: weights, checkpoints, registries and signing

Weights sit in object storage and model registries under a key hierarchy whose root is an RSA or ECC key in a KMS or HSM. The GPAI Code asks providers of systemic-risk models to keep a registry of every copy and to encrypt parameters with at least 256-bit security, which is the right answer at rest and silent about the wrapping key above it. Artefact signatures in your registry are ECDSA.

You will know which models sit beneath which wrapping keys, which signing roots fix the order of your migration, and where ML-DSA or a hash-based signature belongs in your registry today.

A row of tall server cabinets with red network cables visible behind the doors.

The pipeline: data lakes, training clusters, MLOps and the model supply chain

Datasets move from lake to cluster over TLS with classical key exchange, which is the harvest now, decrypt later surface. The May 2025 AI Data Security guidance from NSA, CISA, FBI and partners asks you to sign datasets used in training, fine-tuning and RLHF with quantum-resistant signatures. Most pipelines sign nothing, and pull models and packages from public registries on the strength of an RSA signature.

You will know which data transfers carry the longest-lived data, where provenance and signing are missing, and what to ask your model and package suppliers for.

A four-legged robot standing on a polished floor in a corridor lined with chairs.

The runtime: inference APIs, agent tool calls, identity and tokens

Every inference call and every tool call an agent makes rides a TLS session and an API key or token signed with RSA or ECDSA. OWASP's 2025 LLM Top 10 lists sensitive information disclosure, supply chain and excessive agency; all three get worse when the credentials behind them can be forged. Hybrid key exchange is available at most cloud edges and off by default on most model-serving stacks.

You will know which endpoints can take X25519MLKEM768 this quarter, which tokens and service identities to re-sign first, and how to measure the share of inference traffic that is already post-quantum.

Step 2 of 5

Know what the AI Act, NIS2, the AI agencies and your customers will expect, and when

2023
The AI frameworks arrive
NIST releases AI RMF 1.0 on 26 January. The NCSC and CISA publish the Guidelines for secure AI system development on 27 November with 21 other agencies from 18 countries, covering secure design, development, deployment and operation.
2024
Standards and the Act
The Commission Recommendation on PQC arrives on 11 April. NIST releases the Generative AI Profile (AI 600-1) and SP 800-218A in July and FIPS 203, 204 and 205 in August. The AI Act enters into force on 1 August. The Cyber Resilience Act enters into force on 10 December.
2025
Obligations start
AI Act prohibitions and AI literacy apply from 2 February. The UK publishes its AI cyber security code on 31 January and renames its institute the AI Security Institute on 14 February. The NCSC timeline lands in March, the AI Data Security guidance in May, the EU PQC roadmap in June and the GPAI Code of Practice on 10 July. GPAI obligations apply from 2 August.
2026
The Act applies, the Omnibus moves the rest
Executive Order 14412 in June. The AI Omnibus enters into force on 27 July and the AI Act becomes generally applicable on 2 August, with the AI Office and national authorities enforcing. CRA reporting obligations apply from 11 September. NIST IR 8547 is final on 27 October. EU national PQC roadmaps are due by the year end.
2027 to 2028
High-risk rules bite
Annex III high-risk AI rules, Article 15 included, apply from 2 December 2027. The CRA's main obligations apply from 11 December 2027. Annex I product-embedded AI follows on 2 August 2028. The NCSC expects discovery complete and a migration plan in place by 2028.
2030 to 2035
Deprecated, then disallowed
EU high-risk use cases migrated by the end of 2030. US high value assets on PQC key establishment by 31 December 2030. NIST deprecates RSA and ECC after 2030 and disallows them after 2035. The NCSC timeline and the EU roadmap, with as many systems as feasible migrated, both end in 2035.

Key facts for AI security, checked 30 October 2026

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and became applicable on 2 August 2026. Prohibitions and AI literacy obligations applied from 2 February 2025 and the governance rules and GPAI obligations from 2 August 2025. The AI Omnibus, proposed on 19 November 2025 and in force since 27 July 2026, moved the Annex III high-risk rules to 2 December 2027 and the Annex I product-embedded rules to 2 August 2028. European Commission
Article 15 requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity and to perform consistently in those respects throughout their lifecycle, and to be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. It names no algorithm. AI Act Service Desk
Article 55(1)(d) requires providers of general-purpose AI models with systemic risk to ensure an adequate level of cybersecurity protection for the model and the physical infrastructure of the model. AI Act Service Desk
The GPAI Code of Practice, published on 10 July 2025, has three chapters; its Safety and Security chapter applies to systemic-risk models. Commitment 6 covers security mitigations, Measure 6.1 asks providers to define a Security Goal that includes insider threats, and Appendix 4.2 asks for a registry of every copy of unreleased model parameters and for parameters to be encrypted in transport and storage with at least 256-bit security and keys held in a TPM. Exfiltration of model weights is a serious incident to report within five days. European Commission
The Cyber Resilience Act entered into force on 10 December 2024. Reporting obligations for actively exploited vulnerabilities apply from 11 September 2026 and the main obligations from 11 December 2027. AI-enabled products with digital elements are in scope. European Commission
The Commission Recommendation of 11 April 2024 (C(2024) 2393) asks every Member State to adopt a national post-quantum strategy and to deploy post-quantum cryptography, hybrid where needed, across public administration systems and critical infrastructure. European Commission
The EU Coordinated Implementation Roadmap, published through the NIS Cooperation Group on 23 June 2025, asks Member States to start the transition and have national roadmaps in place by the end of 2026, to migrate high-risk use cases by the end of 2030 and as many systems as feasible by the end of 2035. European Commission
Securing Tomorrow, Today, the joint statement of cyber security agencies from EU Member States first issued in November 2024 and re-issued with further signatories in July 2025, treats the quantum threat as part of cyber security risk management now and calls for hybrid post-quantum deployment. BSI
The Guidelines for secure AI system development, published on 27 November 2023 by the NCSC and CISA with 21 other agencies from 18 countries, cover secure design, secure development, secure deployment and secure operation and maintenance for any system that uses AI, built from scratch or on others' models and services. UK NCSC
The UK Code of Practice for the Cyber Security of AI, published by DSIT on 31 January 2025, sets baseline principles for organisations developing and deploying AI and was submitted to ETSI as the basis for TS 104 223. The UK AI Safety Institute became the AI Security Institute on 14 February 2025. UK Government
The UK NCSC's timeline of 20 March 2025 expects discovery and an initial migration plan by 2028, the highest-priority migration activities complete by 2031 and migration to PQC complete by 2035. UK NCSC
NIST released AI RMF 1.0 on 26 January 2023 and the Generative AI Profile, NIST AI 600-1, on 26 July 2024. Both are voluntary and both ask organisations to map, measure and manage security risk across the AI lifecycle; neither names a cryptographic algorithm. NIST
NIST SP 800-218A, published July 2024, profiles the Secure Software Development Framework for producers of generative AI and dual-use foundation models, the producers of systems that use them and their acquirers, including protection of model weights and training data as development artefacts. NIST
AI Data Security, the joint information sheet of 22 May 2025 from NSA's AI Security Center, CISA, the FBI and the Australian, New Zealand and UK agencies, asks organisations to adopt quantum-resistant digital signature standards to authenticate datasets used in training, fine-tuning, alignment and RLHF, to use TLS with AES-256 or post-quantum encryption for data in transit, and to keep a cryptographically signed provenance ledger. CISA
Executive Order 14412 of 22 June 2026 requires PQC key establishment on federal high value assets by 31 December 2030 and PQC signatures by 31 December 2031, and orders a proposed FAR rule requiring contractors to meet PQC-compliant FIPS by 31 December 2030. GovInfo
The final NIST IR 8547, published 27 October 2026, deprecates quantum-vulnerable public-key cryptography after 2030 and disallows it after 2035. NIST
The OWASP Top 10 for LLM Applications 2025 lists prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. OWASP GenAI Security Project

The silhouette of a person with raised arm writing equations on a whiteboard.

The evidence you will be able to show the AI Office, a NIS2 authority, a customer and your board

AI Act Article 15 and NIST AI RMF

Cryptographic risk inside the AI risk file

You show: Quantum cryptanalysis named in the Article 15 cybersecurity evidence and the AI risk register, with an owner, the confidential-until dates for each model and dataset and the migration milestones.

GPAI Code, Appendix 4.2, and SP 800-218A

A registry of every copy, under keys you can move

You show: A register of every copy of each model's parameters, the wrapping key over each, the RSA or ECC wraps marked, and the provider roadmap for moving each key type to ML-KEM.

AI Data Security, May 2025

Signed data, signed artefacts, a provenance ledger

You show: Datasets, fine-tuning sets and model artefacts signed, a plan to move those signatures to ML-DSA or a hash-based scheme, and a signed provenance ledger behind the training run.

NIS2 Articles 20 and 21

A management body that has approved, and a hybrid share

You show: A board paper on quantum exposure in the AI estate, a cryptography policy that names ML-KEM, ML-DSA and hybrid key exchange, and the measured share of inference calls on X25519MLKEM768.

UK organisations. The AI Act reaches you if you place AI systems on the EU market or your outputs are used in the EU. At home the Code of Practice for the Cyber Security of AI of 31 January 2025 sets the baseline, the NCSC guidelines cover the lifecycle, and the AI Security Institute studies the frontier risks. The NCSC timeline sets the pace for the cryptography: discovery and a plan by 2028, highest-priority migration by 2031, complete by 2035. Read the NCSC position explained.

Model providers and labs

If you train general-purpose models, Article 55(1)(d) and the Code's Safety and Security chapter are your text: a registry of every copy of unreleased parameters, encryption with at least 256-bit security, keys in a TPM, hardened and rate-limited interfaces to the weights and an insider threat programme. The Code says nothing about the asymmetric keys that wrap, sign and transport those parameters, so put ML-KEM wrapping and ML-DSA signing into your Security Goal yourself. Read the AI infrastructure analysis.

Deployers of high-risk AI

A grid-management model, a clinical triage tool or a credit scoring system falls under Annex III, and the Article 15 cybersecurity duty runs for the lifecycle, not the launch. From 2 December 2027 the conformity file has to show it. Treat the cryptography around the model as part of that evidence, and the Article 18 ten-year retention of your documentation and test results as a confidentiality period in its own right. Read the AI Act and quantum security analysis.

Teams running inference APIs and agents

An agent is an API client with a credential and a set of tools. Its tool calls ride the same TLS and the same RSA or ECDSA tokens as everything else, and OWASP's excessive agency entry is a reminder that a forged credential now does more than read data. Start with hybrid key exchange at the inference edge and a plan to re-sign service identities with ML-DSA. Our AI APIs and inference infrastructure course covers model serving TLS, API key authentication and the OWASP intersections in a day. Read the API gateway analysis.

What the platforms have already published

Public documentation from the providers your models run on, checked on 30 October 2026. Your customers and your auditors read these too.

June 2025

AWS

AWS KMS supports hybrid post-quantum TLS with ML-KEM on its endpoints and adds ML-DSA key specs, which is where the wrapping keys over model storage on AWS live.

Source: AWS documentation →

August 2026

Google Cloud

Roadmap to full post-quantum readiness by 2029, with Cloud KMS generally available for ML-KEM and ML-DSA and a stated plan to integrate post-quantum protections across its AI services.

Source: Google Cloud roadmap →

July 2025

GPAI Code signatories

Providers who signed the Safety and Security chapter commit to Commitment 6 security mitigations for unreleased model parameters, including a registry of every copy, 256-bit encryption with keys in a TPM and reporting of weight exfiltration within five days.

Source: European Commission →

Step 3 of 5

Build a plan your board can sign off in 90 days, starting with the model

By day 30

It has an owner and a scope

A PQC migration lead with authority across the AI platform, security and data protection, and a sponsor on the management body.
Inventory scoped to model storage and its wrapping keys, registry signing roots, training data transfers and every inference and agent endpoint.
Every model and dataset given a confidential-until date, mapped to the algorithms protecting it today.

By day 60

You have the evidence

Discovery running and the key hierarchy drawn from HSM root to model artefact, with every RSA or ECC wrap marked and each provider's PQC roadmap recorded.
A PQC questionnaire with every model, cloud, GPU, registry and MLOps supplier, and PQC requirements in the next tender.
X25519MLKEM768 enabled on one inference endpoint, with the negotiated group logged.

By day 90

Your board has a plan to approve

Models and datasets ranked by confidentiality lifetime, exposure, customer demand and AI Act category.
ML-DSA signing piloted on one model release and dataset revision, and cryptographic risk written into the Article 15 evidence and the AI risk register.
A roadmap with 2027, 2030 and 2035 milestones, ready for sign-off.

Who will deliver it? See step 4 →

The five numbers to show your board

Inventory coverageThe share of models, datasets, registries and inference endpoints with a completed cryptographic inventory.
Exposed modelsHow many models and training datasets still sit beneath an RSA or ECC wrapping key, and how long each must stay confidential.
Signed artefactsThe percentage of model releases and dataset revisions signed, and how many signatures are already ML-DSA or hash-based.
Hybrid shareThe percentage of inference and agent calls negotiating X25519MLKEM768 or another hybrid group, measured not estimated.
Plan statusBudget committed, cryptographic risk in the AI risk register and milestones met against the 2027, 2030 and 2035 dates.

How to phase the work, 2026 to 2035

2026Discover, date and switch on the edgeOwner, inventory, confidential-until dates, the key hierarchy over model storage and the supplier questionnaire. Hybrid key exchange on inference endpoints where the platform already supports it. Cryptographic risk added to the AI risk register before the EU's end-2026 roadmap date.
2027Sign and re-wrapEvery model artefact and dataset revision signed, ML-DSA piloted on one release, wrapping keys over the most sensitive models moved to a quantum-safe hierarchy where the provider offers it. Article 15 evidence ready for the 2 December 2027 Annex III date and PQC clauses in supplier contracts.
2028 to 2030Migrate the estateRegistry signing roots, service identities and tokens on ML-DSA or a hash-based scheme, remaining wrapping keys re-wrapped, training cluster and data lake transfers on hybrid key exchange. NCSC discovery complete by 2028; EU high-risk use cases and US high value assets done by the end of 2030.
2031 to 2035Complete and retireLegacy models, archived checkpoints and long-retention logs re-encrypted or securely deleted, classical algorithms removed before NIST disallows RSA and ECC in 2035, and the GPAI and AI Act evidence kept current for the Article 18 ten-year window.

Dates from the Commission's AI Act page, the NCSC timeline and NIST IR 8547. For budget ranges, see our PQC migration cost benchmarks; for the engineering detail, the model weights and training infrastructure course.

Free tools to do it this quarter

Third-Party Cryptographic Exposure ModelScore the exposure that sits with your model providers, cloud and GPU suppliers, registries and MLOps vendors.Open the tool →Crypto Asset Prioritisation MatrixDecide which models, datasets and endpoints to migrate first, with reasons a board will accept.Open the tool →HNDL Risk CalculatorSee how long your models and training data must stay confidential, and whether they already outlast the threat.Open the tool →Algorithm Sunset TimerSee when each algorithm in your AI stack expires under NIST IR 8547.Open the tool →NIST PQC Algorithm SelectorMatch ML-KEM, ML-DSA, SLH-DSA or a stateful hash-based signature to key wrapping, artefact signing and TLS.Open the tool →PQC Readiness ChecklistRun a 40-point assessment across your AI estate.Open the tool →PQC Migration Decision TreeWork through hybrid or pure, re-wrap or re-encrypt, and buy or wait, one decision at a time.Open the tool →Q-Day Timeline Risk CalculatorFind how much time your organisation has left to migrate.Open the tool →

Need help delivering the plan? Our expert members are peer-reviewed suppliers, integrators and advisers. Meet the expert members →

Step 4 of 5

Equip the people who will deliver it

A migration succeeds or stalls on people. Match each role to the outcome you need from them.

For your programme lead

Your programme lead can run the migration across the model, the pipeline and the runtime

Inventory and CBOM auditing for model storage, registries, training pipelines and inference endpoints
Risk prioritisation by confidentiality lifetime, exposure and AI Act category
Crypto-agile architecture and GRC integration for Article 15, NIS2 and NIST AI RMF evidence
Supplier management and a tabletop exercise with your scenario

CPQCPM, Certified Post Quantum Cryptography Programme Manager. Ten hours live online over five weeks, small cohorts, delivered by Chris Basener of Argus Advisory and certified by QSECDEF. See the full course →

$1,450 a seat · $1,087.50 for members

QSECDEF training · CPQCPM

Watch the overview, then get the brochure, dates and costs

Your brochure, the next cohort dates and the costs are ready on the next page.

Boards, executives and management bodies

Your board can challenge the plan and approve the budget with confidence.

Certified Quantum Business Professional

Self-paced, no physics background. Covers PQC, policy and PQC risk and migration management.

Free first session · included in membership

Get Session 1 free

Security, ML platform and MLOps teams

Your teams understand the threat, the NIST standards and hybrid TLS before they touch the model stack.

Introduction to Quantum Cyber Security

Six modules, 4 to 5 hours, certificated.

Free first module · included in membership

Get Module 1 free

AI, data and GRC leaders

Your AI governance, data protection and risk leaders can put cryptographic risk into the AI risk file and defend it.

AI Security and Resilience Leadership Bootcamp

Twenty live online lectures of 40 minutes, Tuesdays from 1 December 2026. Sessions are free and open to all; members can earn the CASRP credential.

Free sessions · CASRP credential for members

Training the whole AI team? Put everyone on one plan.

Team membership brings your board, programme lead, platform engineers and governance leads up to speed together, tracks what each person has completed and certifies across the group. The courses above are included, plus 170+ expert lectures and the weekly call, and members pay less for CPQCPM.

See team membership

Step 5 of 5

Compare notes with peers securing the same models

A members-only structured Q&A for CISOs, CTOs, chief AI officers and AI governance leaders at organisations with models in production and quantum risk on the register. It runs under the Chatham House Rule and is facilitated by Anna Beata Kalisz Hedegaard, Founder of QSECDEF.

Where the AI governance and quantum security agendas overlap in practice, and who owns the intersection
How peers set a confidentiality lifetime for a model when no regulation gives them one
What model providers, cloud platforms and registry vendors have committed to, and what those commitments mean for the organisations building on them
Where inference APIs and agent tool calls are most exposed, given the tokens and handshakes in use today
How to document cryptographic risk in an Article 15 file or an AI RMF profile so a regulator recognises it

A QSECDEF symposium panel on stage in front of an audience — Practitioner panels, on the record

QSECDEF members and speakers together outside the Arc de Triomphe in Paris — Peers you can call afterwards

Panellists in discussion at a QSECDEF symposium — Questions taken from the floor

A speaker presenting slides at the QSECDEF World Symposium — Briefings on what is changing

A keynote speaker at the QSECDEF World Symposium lectern — QSECDEF World Symposium, Paris

Lectures from people doing this work

Practitioner lectures from the QSECDEF library that matter most to AI and security leaders: quantum machine learning and quantum AI at scale, AI and privacy, data protection, cryptographic inventory and compliance management.

Expert contributors represent leading organisations worldwide

Expert Membership

Builders, consultancies and technology vendors serving AI security: talk to us

Expert membership brings you into an open community working across sectors, opening up industry conversations, knowledge and access to experts. If you are building technology or consulting capabilities in this sector relevant to Quantum or Advanced AI, we want to hear from you.

Talk to us about Expert Membership View all membership tiers

Access to all Industry Conversations
Speaker opportunities at the annual Paris Symposium
Enhanced expert profile with lecture archive
Co-branding opportunities and social amplification
25% off partner training and events

Everything you need, in one place

Our analysis and programmes for AI security

Policy and mandates

AI Act, Regulation (EU) 2024/1689: the regulatory framework and application timeline, as amended by the AI Omnibus of 27 July 2026 European Commission
AI Act Article 15: accuracy, robustness and cybersecurity AI Act Service Desk
AI Act Article 55: obligations of providers of general-purpose AI models with systemic risk AI Act Service Desk
AI Act Article 113: entry into force and application, as amended AI Act Service Desk
General-Purpose AI Code of Practice, 10 July 2025, including the Safety and Security chapter European Commission
Cyber Resilience Act: in force 10 December 2024, reporting from 11 September 2026, main obligations from 11 December 2027 European Commission
Recommendation on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, C(2024) 2393, 11 April 2024 European Commission
A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, 23 June 2025 NIS Cooperation Group
Securing Tomorrow, Today: joint statement of EU Member State cyber security agencies on the transition to PQC, 2024 and 2025 BSI, ANSSI and partners
NIS2, Directive (EU) 2022/2555 EUR-Lex
Guidelines for secure AI system development, 27 November 2023 UK NCSC, CISA and 21 partner agencies
Code of Practice for the Cyber Security of AI, 31 January 2025 UK DSIT
AI Security Institute UK DSIT
Timelines for migration to post-quantum cryptography UK NCSC
AI Risk Management Framework 1.0, 26 January 2023, and the Generative AI Profile NIST AI 600-1, 26 July 2024 NIST
NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile NIST
SP 800-218A: Secure Software Development Practices for Generative AI and Dual-Use Foundation Models, July 2024 NIST
AI Data Security: Best Practices for Securing Data Used to Train and Operate AI Systems, 22 May 2025 NSA AI Security Center, CISA, FBI and partners
OWASP Top 10 for LLM Applications 2025 OWASP GenAI Security Project
MITRE ATLAS: adversarial threat landscape for AI systems MITRE
Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks, 22 June 2026 GovInfo
FIPS 203: ML-KEM NIST
FIPS 204: ML-DSA NIST
FIPS 205: SLH-DSA NIST
NIST IR 8547: Transition to Post-Quantum Cryptography Standards, final, October 2026 NIST

Questions leaders ask

Does the EU AI Act require post-quantum cryptography?

Not by name. Article 15 requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle and to resist attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. Article 55(1)(d) requires providers of general-purpose AI models with systemic risk to protect the model and its physical infrastructure. Neither article names an algorithm. The published state of the art does: NIST finalised FIPS 203, 204 and 205 in August 2024 and IR 8547 in October 2026 deprecates RSA and ECC after 2030. A high-risk system whose data pipelines, model storage and inference APIs still rest on quantum-vulnerable cryptography has a gap to explain in its conformity file.

When do the AI Act's high-risk obligations actually apply?

Later than the original text said. The Act entered into force on 1 August 2024 and became generally applicable on 2 August 2026, with prohibitions from 2 February 2025 and GPAI obligations from 2 August 2025. The AI Omnibus, proposed on 19 November 2025 and in force since 27 July 2026, moved the Annex III high-risk rules, Article 15 included, to 2 December 2027 and the Annex I product-embedded rules to 2 August 2028. Article 18 then requires providers to keep the technical documentation for ten years after the system is placed on the market, and Article 19 to keep automatically generated logs for at least six months.

What does the GPAI Code of Practice say about protecting model weights?

The Safety and Security chapter, published with the Code on 10 July 2025, applies to providers of general-purpose AI models with systemic risk. Commitment 6 commits signatories to an adequate level of cybersecurity for the model and its infrastructure across the lifecycle. Measure 6.1 asks them to define a Security Goal naming the threat actors in scope, insiders included. Appendix 4.2 asks for a registry of every copy of unreleased model parameters, encryption in transport and storage with at least 256-bit security and keys held in a TPM, and decryption only into non-persistent memory. Appendix 4.3 hardens interface access to the weights, with output rate limiting. Exfiltration of model weights is a serious incident to report within five days. The Code is silent on the asymmetric keys that wrap, sign and transport those parameters, which is where the quantum exposure sits.

Why are model weights a harvest now, decrypt later problem if they are encrypted with AES-256?

Because AES-256 is not what fails. The data key that encrypts the weights is itself wrapped by an RSA or elliptic-curve key in your KMS or HSM hierarchy, the checkpoint moved between storage and cluster over a TLS session with classical key exchange, and the artefact in the registry carries an ECDSA signature. An adversary who records those exchanges now can unwrap the data key once a cryptographically relevant quantum computer exists. A model has no statutory retention period, so most organisations have never decided how long it must stay secret. Decide, then compare that date with 2030 and 2035.

Is training data exposed in the same way?

Yes, and for longer. Training data inherits the retention and sensitivity of its source records: clinical, financial, legal or client data that must be kept for ten years or more. The transfers that moved it from the lake to the GPU cluster used TLS with RSA or ECDH key exchange, and de-identification does not make a recording unreadable later. The May 2025 AI Data Security guidance from NSA, CISA, FBI and partners asks for quantum-resistant digital signatures on datasets used in training, fine-tuning, alignment and RLHF, TLS with AES-256 or post-quantum encryption in transit, and a cryptographically signed provenance ledger.

What about inference APIs and agents?

Every inference call carries a prompt and an answer over TLS, authenticated by an API key or a token signed with RSA or ECDSA. An agent is a client with a credential and a set of tools, so its tool calls ride the same handshake and the same signature. OWASP's 2025 LLM Top 10 lists sensitive information disclosure, supply chain and excessive agency; forged credentials make all three worse. Hybrid key exchange, X25519MLKEM768, is standardised and available at most cloud edges, and a customer can test your endpoint from a browser. Turn it on, measure the share, then plan to re-sign service identities with ML-DSA.

Where does the AI supply chain come in?

Your pipeline pulls base models, datasets, packages and container images from registries you do not run, on the strength of signatures you do not control. OWASP lists supply chain and data and model poisoning in the LLM Top 10, and NIST SP 800-218A profiles the Secure Software Development Framework for producers and acquirers of generative AI and foundation models. NIS2 Article 21(2)(d) makes supply chain security your measure, and the Cyber Resilience Act reaches AI-enabled products with digital elements from 11 December 2027. Ask every model, cloud, GPU, registry and MLOps supplier for a PQC roadmap and write algorithm agility into the next tender.

What do the NIST AI RMF and the NCSC guidelines require on cryptography?

Nothing specific, which is the point. AI RMF 1.0 of January 2023 and the Generative AI Profile of July 2024 are voluntary and ask you to map, measure and manage security risk across the lifecycle. The NCSC and CISA guidelines of November 2023 cover secure design, development, deployment and operation and point to secure-by-default practice. Both leave the algorithm choice to the cryptographic state of the art, which NIST now defines in FIPS 203, 204 and 205 and IR 8547. Add quantum cryptanalysis to the AI risk register with an owner and a date, and the frameworks hold it.

What does the UK expect of organisations building or deploying AI?

The Code of Practice for the Cyber Security of AI, published by DSIT on 31 January 2025, sets baseline principles for developers and deployers and was submitted to ETSI as the basis for TS 104 223. The NCSC guidelines of November 2023 cover the lifecycle, and the AI Security Institute, renamed from the AI Safety Institute on 14 February 2025, studies frontier risks. On the cryptography the NCSC timeline sets the pace: discovery and a plan by 2028, highest-priority migration by 2031, complete by 2035. UK organisations placing AI systems on the EU market, or whose outputs are used there, owe the AI Act as well.

Where should an organisation building or deploying AI start?

With four things: a cryptographic inventory of model storage and its wrapping keys, registry signing roots, training data transfers and every inference and agent endpoint; a confidential-until date for each model and dataset, compared with the algorithms protecting it; hybrid key exchange on one inference endpoint with the share measured; and PQC roadmaps requested from every model, cloud and registry supplier. Those four give the board the evidence to set priorities and the AI governance team something to put in the Article 15 file.

What does QSECDEF offer organisations building or deploying AI for free?

Everything on this page. The two-minute readiness check scores your AI estate and routes you to the right next step. The free tools, including the HNDL Risk Calculator and the Crypto Asset Prioritisation Matrix, run in your browser with no registration. The AI Security and Resilience Leadership Bootcamp is twenty live online lectures of 40 minutes, Tuesdays from 1 December 2026, free and open to all. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

Which QSECDEF course should an AI team take first?

It depends on the role. Boards and management bodies start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, ML platform and MLOps teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. AI, data and GRC leaders join the AI Security and Resilience Leadership Bootcamp, twenty live lectures from 1 December 2026, with the CASRP credential for members. Engineers who own the model stack take PQC Protection for AI Model Weights and Training Infrastructure or Cryptographic Security of AI APIs and Inference Infrastructure, each a full day. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Can QSECDEF run private training or a workshop for our AI team or company?

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your ML platform, MLOps and AI security teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

How do we find vetted suppliers or consultants for an AI PQC migration?

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Is QSECDEF membership relevant to an AI company or an organisation deploying AI?

Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call, the CASRP pathway and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving AI security who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

Is QSECDEF selling a migration product?

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

How much time does the training take?

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed. The AI bootcamp is twenty 40-minute lectures on Tuesdays. The AI engineering courses are full days of six hours, listed with their formats on the training pages.

Ask a practitioner, live

The free weekly call runs every Tuesday at 15:00 CET. Bring your question.

Join the Tuesday call →

Deployment guidance and frameworks

The Applied Quantum PQC Migration Framework: Universal Framework and sector extensions Applied Quantum, QSECDEF expert member
The PQC Migration Handbook, second edition, November 2024 AIVD, CWI and TNO
TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths, version 2026-01 BSI
Follow-up position paper on post-quantum cryptography, December 2023 ANSSI
Post-Quantum Cryptography: Integration Study ENISA
ETSI TR 103 619: Migration strategies and recommendations to Quantum Safe schemes, 2020 ETSI
Next steps in preparing for post-quantum cryptography UK NCSC
Quantum-Readiness: Migration to Post-Quantum Cryptography, 21 August 2023 CISA, NSA and NIST
Product Categories for Technologies That Use Post-Quantum Cryptography Standards, 23 January 2026 CISA

Pick your next step

2 minutesScore your readinessGet your top three priorities for the models, the pipeline and the runtime.Programme leadGet the CPQCPM brochureDates, costs and the five-week syllabus.FreeJoin the AI bootcampTwenty live lectures from 1 December 2026, open to all.

Several colleagues with laptops and papers around a long light table in a meeting room.

For your organisation

Need it built around your models, your pipeline or your governance framework?

When your board, your AI governance committee or your largest customer needs something specific, we shape the workshop, the training or the engagement around your models, your data and your conformity obligations. Independent of any vendor.

Custom workshops

Your leadership leaves with an agreed position on quantum risk to AI

In-person sessions for AI and machine learning teams covering quantum machine learning, quantum threats to federated learning, cryptographic security of inference infrastructure and PQC protection for model weights, drawn from the five-course artificial intelligence programme.

Private training

Your whole AI team trained on one plan

Private CPQCPM cohorts, live online or in person for your required delegates, private deliveries of the AI engineering courses, and team membership for the self-paced courses and the CASRP pathway.

Consulting

A migration programme specified and staffed correctly

Cryptographic inventory of the AI estate, PQC migration planning, model supply chain review and specialist teams sourced from 1,500+ members across 900+ organisations.

Prefer email? Write to info@qsecdef.com and tell us about your timeline.

Photos: Pexels (panumas nikhomkhai, Matheus Bertelli, Godfrey Atima, Brett Sayles, Vladimir Srajber, ThisIsEngineering, Keysi Estrada, Walls.io) and QSECDEF, converted to black and white or brand duotone.