Post-quantum
cryptography.

The threat model is simple enough to explain to a board in two sentences. An adversary with storage and patience intercepts encrypted traffic today and keeps it. When a cryptographically relevant quantum computer exists, they decrypt it.

What that means practically is that the relevant question is not when will quantum computers break RSA. It is how long does our data need to stay confidential. If the answer is a decade or more — medical records, government material, legal files, trade secrets, long-term contracts, biometric data that cannot be reissued — then your exposure is already live regardless of what date the machine arrives. Waiting for certainty about the date is choosing to be exposed for the interval.

The algorithms at risk are the public-key ones: RSA, and the elliptic-curve algorithms underpinning most key exchange and digital signatures on the internet today. Symmetric encryption such as AES is affected far less severely — the practical guidance there is to use longer keys rather than to replace the algorithm.

NIST completed the first round of its standardisation process and published three final standards in August 2024. Unlike most of this subject, these are settled, implementable and shipping in mainstream libraries.

FIPS 203 — ML-KEM, a lattice-based key-encapsulation mechanism derived from CRYSTALS-Kyber, for establishing shared keys. This is the one that matters for the harvest-now problem, because it protects the confidentiality of traffic.

FIPS 204 — ML-DSA, a lattice-based digital signature scheme derived from CRYSTALS-Dilithium, and the general-purpose signature standard.

FIPS 205 — SLH-DSA, a stateless hash-based signature scheme derived from SPHINCS+. Larger and slower, and valuable precisely because its security rests on different mathematical assumptions — a hedge in case the lattice family is weakened.

NIST's draft transition guidance deprecates the algorithms offering roughly 112 bits of classical security — RSA-2048 among them — around 2030, and disallows all quantum-vulnerable public-key algorithms, including ECC P-256, by 2035. Further schemes are following the first three standards. Government deadlines in various jurisdictions sit inside that window. For a large estate, a migration of this kind runs two to five years, which is what makes 2030 a near date rather than a distant one.

Directly, in two places worth naming. First, an AI system is usually a large aggregation point: retrieval indexes, embeddings and logs concentrate data that was previously scattered across systems, which makes the transport and storage protecting them a higher-value target than any individual source. Second, model weights and training data are themselves long-lived confidential assets — a proprietary fine-tune captured in transit today has a decade of value to an adversary.

The practical implication is unremarkable and easy to act on: when you build AI infrastructure now, include it in the cryptographic inventory from the start and prefer hybrid key exchange where your stack supports it. It is a configuration decision at build time and an expensive retrofit later. It is also, incidentally, one more argument for keeping the data path short — a system that never transmits data outside your building has a much smaller surface for anyone to harvest in the first place.