The Compliance Gap: Quantum-Safe Regulations

As quantum computing approaches, a compliance gap is opening: regulations expect organisations to protect sensitive data, but most do not yet explicitly require quantum-safe encryption. That gap is closing — and organisations that wait for explicit mandates will be too late.

The Current State of Quantum Regulation

Most cybersecurity regulations today require "reasonable" or "appropriate" safeguards but do not name post-quantum cryptography. However:

• The expectation of reasonable foresight is expanding to include quantum risk.
• Standards bodies (NIST, ENISA, NCSC) have published PQC standards and guidance.
• Sector regulators are beginning to reference quantum risk in expectations.

The direction is clear: what is today "guidance" will become "requirement".

Where the Gap Already Closes

United States

• NSM-10 already requires federal agencies to inventory and plan migration.
• NIST FIPS 203/204/205 are mandatory federal standards.
• CISA guidance extends expectations to critical infrastructure.
• NYDFS and financial regulators treat foreseeable cyber risks as in-scope — quantum is increasingly foreseeable.

European Union

• NIS2 requires risk management for critical and important entities; quantum risk fits the duty.
• DORA requires operational resilience for finance, including cryptographic resilience.
• GDPR accountability expects organisations to consider foreseeable risks to personal data.
• ENISA guidance is the reference for what "good" looks like.

United Kingdom and Israel

• NCSC and INCD guidance sets expectations that regulated entities are expected to follow.

The Foreseeability Argument

Regulators and courts increasingly apply a foreseeability standard: if a risk is foreseeable and a reasonable safeguard exists, failing to apply it can be negligence. Quantum risk is now foreseeable — NIST has published standards, major vendors are deploying hybrid TLS, and guidance is public. The argument that "nobody saw it coming" is weakening.

This means that even without an explicit quantum mandate, an organisation that ignores quantum risk may already fall short of its duty of care.

The Compliance Gap in Practice

The gap appears in several ways:

• Audit checklists lag standards: auditors may not yet ask about quantum, but they soon will.
• Procurement lags guidance: contracts may not require quantum-readiness, but customers will demand it.
• Board reporting lags risk: boards may not yet ask, but fiduciary duty is catching up.
• Insurance lags exposure: cyber policies may not yet exclude quantum, but they will.

The Cost of Being in the Gap

Organisations in the gap face:

• Sudden regulatory catch-up: when guidance hardens into rules, laggards scramble.
• Contract loss: customers and governments add quantum-readiness to procurement.
• Liability exposure: if quantum risk was foreseeable and ignored, breaches become harder to defend.
• Insurance complications: ignoring a known risk may affect coverage.

How to Close the Gap Proactively

1. Treat guidance as requirement. If NIST, ENISA or NCSC recommend it, plan to do it.
2. Document your quantum-risk assessment. Demonstrating foresight and a plan is itself compliance.
3. Adopt the standards now. Using NIST PQC standards shows due diligence.
4. Update internal policies to reference quantum risk before regulators force it.
5. Brief auditors and boards so expectations align with emerging guidance.
6. Include quantum-readiness in procurement before customers require it of you.

The Strategic Advantage of Early Compliance

Organisations that close the gap early gain:

• Trust from customers and regulators.
• Contract wins where quantum-readiness becomes a differentiator.
• Smoother audits when requirements arrive.
• Lower long-term cost by migrating on their own schedule, not a regulator's.

Bottom Line

The quantum compliance gap is real but temporary. Regulations are catching up to the technology, and the foreseeability standard is already extending duty of care to include quantum risk. Organisations that treat today's guidance as tomorrow's requirement will be ready; those that wait for an explicit mandate will find it arrives with a deadline they cannot meet.