Public sector AI is being procured under two separate conversations. One asks who owns the model, where the data sits, and which foreign legal regime can reach the stack. The other asks when the cryptography protecting that stack has to be replaced. Different budgets, different consultants, different meetings. They concern the same asset.
Ask a ministry what its AI system is and the answer describes a use case: document triage, fraud detection, border analytics. That is the application. The asset is the pipeline underneath it. Training data containing personal and operational records. Model weights that encode those records in ways nobody can fully reverse and nobody can fully rule out. Inference traffic revealing what the state asks and when. Retrieval stores that amount to a searchable copy of the institution’s memory. Each is protected by classical public-key cryptography. Each has a confidentiality lifetime measured in decades.
Quantum risk does not wait for a quantum computer. It waits for someone with storage. Traffic captured in 2026 and decrypted in 2036 still matters if the material has a thirty-year sensitivity horizon: intelligence product, criminal investigations, diplomatic reporting, health records, anything concerning people who will still be alive and still be targets.
Government AI makes this worse by aggregating. A ministry’s data used to sit across a dozen incompatible legacy systems, which was bad for efficiency and quietly good for security. Building a unified retrieval layer for an AI assistant removes that accident. It creates one long-lived trove at the moment its cryptographic protection acquires a known expiry date.
The standards exist. NIST finalised ML-KEM, ML-DSA and SLH-DSA in August 2024, and the European Commission has pushed member states toward coordinated migration roadmaps with high-risk cases addressed by the end of the decade. What remains unsettled is whether anyone is applying this to the AI estate rather than to VPNs and web servers, which are the migrations that show up in an audit.
The link between the two conversations is this. Sovereignty determines who can lawfully compel access. Cryptography determines whether the ciphertext holds against someone who takes it without asking. Two adversary models, one failure. If a foreign jurisdiction can serve processes on your provider, your encryption posture is irrelevant to that threat. If your cryptography breaks in 2035, your hosting arrangement is irrelevant to that threat. A system is defensible only when both are answered about the same boundary.
That is why sovereign cloud branding needs harder scrutiny. Data residency means the bytes are in-country and says nothing about who administers the platform or what legal instruments reach the parent company. Operational sovereignty adds vetted local staff and no offshore administrative access, which depends on contract terms rather than technical impossibility. Jurisdictional sovereignty means the entity, the keys and the control plane sit outside foreign reach. Cryptographic sovereignty means you hold the keys in hardware you control and the provider cannot read the data whatever any court orders. Only the last makes the legal question mostly moot, and only while the algorithms holding it up survive. Sovereign key custody on classical cryptography is a promise with a countdown attached.
Migration is also harder here than in web PKI, where it looks like a certificate refresh. Model artefacts are signed, distributed and cached for years, so changing signature schemes means re-establishing provenance for everything in circulation, including artefacts in a research environment nobody has opened since 2023. Attestation for third-party models and datasets depends on external parties running their own timelines. Cross-departmental inference requires every participant to move together, so the slowest sets the level for all. Hardware security modules and accelerator firmware refresh on cycles longer than the software above them. None of this is impossible. All of it takes longer than a procurement cycle, which is why it has to start before there is an emergency to justify it.
There is an awkward point that belongs in the open. A sovereign, quantum-safe stack today usually means weaker models than the frontier commercial offering: slower, less capable, more expensive per unit of output. Denying that helps nobody. The response is segmentation. Publishing tourism content does not need this treatment. Classifying planning applications probably does not. Anything with long-lived confidentiality, national security exposure, or data on people who cannot meaningfully consent does, and for those a less capable model that is still secret in 2045 beats a better one that is readable by then.
Segmentation is the strategic work. It means classifying AI workloads by confidentiality lifetime rather than by department or by which demo impressed the minister, then matching hosting and cryptography to each tier. Most institutions have not done it. Those that start now will migrate over five years in an orderly way. The rest will do it later, in a hurry, at higher cost, after something has already been taken.
The post Sovereign by Design, Quantum-Safe by Default appeared first on Decent Cybersecurity.
