EU AI Act and Long-Term AI Security: Quantum Readiness with a QBOM
The EU AI Act expects high-risk systems to stay robust and secure over their lifecycle. For long-lived AI and the data it protects, that means planning for the post-quantum transition, tracked with a QBOM.
- Article 15 requires high-risk AI to be robust and cybersecure, consistently, across its lifecycle.
- Long-lived models and sensitive training data face harvest-now-decrypt-later exposure.
- A QBOM rates the quantum resistance of the cryptography protecting an AI system and tracks migration.
- NIST post-quantum standards and the IR 8547 milestones give a timeline to plan against.
Lifecycle robustness under the AI Act
Article 15 of the EU AI Act, Regulation (EU) 2024/1689, requires high-risk AI systems to perform consistently and to be cybersecure throughout their lifecycle [1]. High-risk AI is often in service for years, and the datasets behind it can carry long confidentiality requirements. Cryptography that protects such a system today may not be safe for the whole of that lifecycle once quantum attacks become feasible.
Harvest now, decrypt later, applied to AI
Encrypted training data, model artifacts and inference traffic captured now could be decrypted later by an adversary with quantum capability. For sensitive AI data this is a present risk, not a future one. A QBOM identifies which parts of an AI system rely on quantum-vulnerable cryptography so you can prioritise them.
Planning against the standards
NIST has standardised post-quantum algorithms and, in NIST IR 8547, set out a transition that deprecates quantum-vulnerable cryptography around 2030 and disallows it after 2035 [2]. A QBOM lets an AI Act provider track migration coverage against those dates as evidence of durable robustness:
| QBOM signal | AI Act relevance |
|---|---|
| Quantum-vulnerable components | Scope of the robustness gap to close |
| Migration coverage % | A measurable readiness KPI for lifecycle security |
| Certificate expiry vs milestones | Planning renewals inside the system's service life |
How IntelliXBOM helps
IntelliXBOM derives a QBOM from the cryptography it discovers in a system, scores quantum readiness, buckets certificates against the NIST milestones, and reports migration coverage over time, next to the AI BOM, SBOM and CBOM for the same system. See preparing for post-quantum cryptography. It supplies evidence; AI Act conformity remains the provider's responsibility.
Frequently asked questions
Does the EU AI Act mention quantum computing?
Not by name. Article 15 requires high-risk AI to be robust and cybersecure across its lifecycle. For long-lived systems and sensitive data, a credible post-quantum plan is the practical way to meet that, and a QBOM evidences it.
Why would an AI system need post-quantum cryptography?
Because the data it protects, training data, model weights and inference traffic, may need to stay confidential for longer than classical public-key cryptography will remain safe.
What does a QBOM track for an AI system?
Which cryptographic assets are quantum-vulnerable, their migration status to post-quantum algorithms, and overall migration coverage against the NIST transition milestones.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/1689/oj
- AI Act Article 15: Accuracy, robustness and cybersecurityEU AI Act explorerartificialintelligenceact.eu/article/15/
- NIST IR 8547: Transition to Post-Quantum Cryptography StandardsNISTcsrc.nist.gov/pubs/ir/8547/ipd
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.