Abstract: This review paper discusses the regulatory risk that quantum computing presents to cloud security by using the United States (U.S.) and the European Union (EU) stances in the approach towards post-quantum cryptography (PQC). The industry infrastructures, such as healthcare, energy, and defence industries, are susceptible to quantum algorithms, as they pose a threat to the existing encryption practices. The U.S. and EU have built up different regulatory sets of rules, such as the National Institute of Standards and Technology (NIST) PQC standards and the General Data Protection Regulation (GDPR) and Network and Information Systems Directive 2 (NIS2) regulatory frameworks in the EU, although there is still a lack of synchronization between the two. A comparative legal study of current U.S. and EU practices is used to inform this review with the primary legal sources (agreements, treaties, etc.), policy documents and industry case studies considering the regulatory gaps and overlaps in the PQC regulations. The paper will introduce a novel insight into the regulatory model of cloud migration in the new post-quantum world, push to adopt a cross-compliance program that would complement the gaps in laws and promote international collaboration to oppose quantum decryption. The review combines regulatory tools, sector-based case studies and Schrems II implications, providing actual life analyses in analyzing quantum threats and safeguarding critical infrastructures by policymakers.
Abstract: This review paper discusses the regulatory risk that quantum computing presents to cloud security by using the United States (U.S.) and the European Union (EU) stances in the approach towards post-quantum cryptography (PQC). The industry infrastructures, such as healthcare, energy, and defence industries, are susceptible to quantum algorithms, as they pose a threat to the existing encryption practices. The U.S. and EU have built up different regulatory sets of rules, such as the National Institute of Standards and Technology (NIST) PQC standards and the General Data Protection Regulation (GDPR) and Network and Information Systems Directive 2 (NIS2) regulatory frameworks in the EU, although there is still a lack of synchronization between the two. A comparative legal study of current U.S. and EU practices is used to inform this review with the primary legal sources (agreements, treaties, etc.), policy documents and industry case studies considering the regulatory gaps and overlaps in the PQC regulations. The paper will introduce a novel insight into the regulatory model of cloud migration in the new post-quantum world, push to adopt a cross-compliance program that would complement the gaps in laws and promote international collaboration to oppose quantum decryption. The review combines regulatory tools, sector-based case studies and Schrems II implications, providing actual life analyses in analyzing quantum threats and safeguarding critical infrastructures by policymakers.
Abstract: Quantum computing poses a structural challenge to contemporary cryptographic infrastructures that underpin digital governance, financial systems, and cross-border data flows. As quantum capabilities advance, widely deployed encryption standards risk obsolescence, exposing systemic vulnerabilities within cloud architectures, blockchain ecosystems, and global data protection regimes. This paper critically explores the convergence of Quantum Computing, Post- Quantum Cryptography (PQC) and international regulatory frameworks. It analyses the preparedness of key jurisdictions such as the European Union, the United States, Japan, China and Singapore, in embedding quantum-resilient standards into cybersecurity and data privacy laws. The paper proposes prospective strategies for building harmonized governance mechanisms and developing agile regulatory mechanisms that can evolve alongside quantum technological progress. Securing data against quantum threats is not solely a technical imperative but a pressing legal and geopolitical priority in the evolving architecture of digital sovereignty. Keywords: Quantum Computing, Post-Quantum Cryptography, Data Protection, Cybersecurity Law, Cloud Ecosystems, International Legal Systems
The emerging threat to current cryptographic infrastructures supporting the world's data security and privacy regimes is the accelerating development of quantum computing. RSA and several other classical encryption systems are susceptible to quantum algorithms like the Shor algorithm, and thus to the quantum threat on the pillars of digital trust. The implications of these quantum threats on regulation have been critically reviewed in this paper by looking at the suitability of the current data protection and cybersecurity guidelines in combating the emerging risks. Even though, in the present legal system, as has been introduced, e.g. in the General Data Protection Regulation (GDPR) and the Digital Personal Data Protection (DPDP) Act, 2023, in India, the technology-neutral approach is applied, the disruptive capacity of quantum computing on the encryption standards is not directly addressed. The study adopts the policy-oriented perspective and assesses the phenomenon of harvest now, decrypt later and the effect it has on data security in the long term, intergenerational privacy, and regulation accountability. It examines the activity of the international work on the topic of post-quantum cryptography (PQC), in particular, it is also concerned with the projects that involve the National Institute of Standards and Technology (NIST) and identifies the inconsistency between the technical context of standards and the legal one.
The emerging threat to current cryptographic infrastructures supporting the world's data security and privacy regimes is the accelerating development of quantum computing. RSA and several other classical encryption systems are susceptible to quantum algorithms like the Shor algorithm, and thus to the quantum threat on the pillars of digital trust. The implications of these quantum threats on regulation have been critically reviewed in this paper by looking at the suitability of the current data protection and cybersecurity guidelines in combating the emerging risks. Even though, in the present legal system, as has been introduced, e.g. in the General Data Protection Regulation (GDPR) and the Digital Personal Data Protection (DPDP) Act, 2023, in India, the technology-neutral approach is applied, the disruptive capacity of quantum computing on the encryption standards is not directly addressed. The study adopts the policy-oriented perspective and assesses the phenomenon of harvest now, decrypt later and the effect it has on data security in the long term, intergenerational privacy, and regulation accountability. It examines the activity of the international work on the topic of post-quantum cryptography (PQC), in particular, it is also concerned with the projects that involve the National Institute of Standards and Technology (NIST) and identifies the inconsistency between the technical context of standards and the legal one.
With Shor’s and Grover’s algorithms compromising the mathematical core of legacy RSA and ECC, the active threat of ‘Harvest Now, Decrypt Later’ (HNDL) campaigns is already accelerating the rollout of Post-Quantum Cryptography (PQC). This paper examines the gap between EU compliance mandates, specifically NIS2 Directive and the Cyber Resilience Act, and the actual engineering of quantum-safe systems. We push 'hybrid cryptography’ as the immediate standard, layering NIST primitives like ML-KEM and ML-DSA over classical protocols to enforce redundancy in constrained environments. We use the NIST IR 8547 framework to organise migration into discovery, prioritisation, and modernisation. Using Portugal as a national case study, this paper examines how EU-level PQC governance is translated into national implementation through the CNCS, QNRC, and PTQCI frameworks. Ultimately, success depends on building PQC expertise in Portugal while rebuilding cryptographic foundations for the quantum era.
The advancement of quantum computing is increasingly recognized as a significant threat to classical public-key cryptographic systems, triggering a global shift toward Post-Quantum Cryptography (PQC). This article presents a topical survey and comparative analysis of the transition strategies adopted by leading cybersecurity agencies—including National Institute of Standards and Technology (NIST), Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI), Bundesamt für Sicherheit in der Informationstechnik (BSI), Cryptography Research and Evaluation Committees (CRYPTREC), and European Union Agency for Cybersecurity (ENISA). The technical foundations of standardized PQC algorithms (Module Lattice–Key Encapsulation Mechanism (ML-KEM), Module Lattice–Digital Signature Algorithm (ML-DSA), Fast-Fourier Lattice-based Compact Signatures over NTRU (FALCON), and Stateless Hash-based–Digital Signature Algorithm (SLH-DSA)) are reviewed, alongside a critical examination of hybrid cryptography, crypto-agility, and strategic alignment on standards and migration principles, despite jurisdictional differences in policy enforcement. The survey highlights shared priorities, such as phased implementation, backward compatibility, and risk mitigation via hybrid adoption. To enhance analytical depth, the study introduces the Institutional–Sectoral PQC Migration Convergence Framework, linking institutional pillars to sectoral readiness for reproducible comparative assessment. National strategies are shown to serve as potential roadmaps for global institutions, underscoring the importance of international coordination and adaptability. These insights support the development of secure, interoperable, and future-proof cryptographic infrastructures in the quantum era, operationalized via the proposed 10-step migration playbook.
The imminent emergence of quantum computers poses unprecedented challenges to the current cryptographic standards that secure vital digital communications and data worldwide. This paper addresses the vulnerabilities of existing cryptographic systems susceptible to quantum-based attacks and emphasizes a dedicated transition plan to post-quantum cryptography (PQC). We first examine the current state of cryptographic practices, highlight the quantum threat, and present the framework and need for PQC. In addition, a comprehensive strategy is presented that encompasses the identification, protection, detection, response, and recovery phases and integrates PQC into existing security infrastructures, specifically the Cybersecurity Framework Version 2.0 of the National Institute of Standards and Technology (NIST). Methods and technologies discussed include the development of robust PQC algorithms, tools for their large-scale implementation, and hybrid cryptographic systems that combine traditional and quantum-resistant techniques. Practical implementations on various hardware and software platforms are also presented in case studies that provide real-world insight into the challenges and innovations in using PQC. We conclude with a discussion of hybrid approaches, regulatory considerations, and recommendations derived from early adopters to guide future efforts to create a quantum-resilient digital landscape.