What Quantum Computing Does to Your AI Audit Trail (and What to Do Now)

Say you’ve done the governance work. Every AI decision on your books lands in a hash-chained ledger; every high-stakes action carries a signature proving who approved it. You can answer the question that matters — what did the AI do, and who authorized it?

Now here’s the one that comes next, and it’s the one people skip: will those signatures still prove anything in 2033?

Financial records live in a seven-year-plus retention window. The cryptography signing them today has a shelf life. Put those two facts next to each other and you get an uncomfortable overlap — records you’re creating right now will still be inside their retention window when the math that protects them may no longer hold. That’s not a reason to panic. It is a reason to know which parts of your trust layer are exposed and which aren’t, because they are not equally at risk.

The useful distinction is between your hashes and your signatures, because quantum computing treats them very differently.

Your hash chain — the thing that makes the ledger tamper-evident — holds up relatively well. The quantum attack against hash functions (Grover’s algorithm) is real but modest: it roughly halves the effective strength, so a 256-bit hash behaves more like 128-bit. Serious, but you fix it by using longer hashes. The chain survives.

The signatures are the exposure. Every signature that proves who authorized this almost certainly rests on elliptic-curve cryptography today, and elliptic curve is precisely what the severe quantum attack (Shor’s algorithm) targets — it can, in principle, derive a private key from its public key. When that becomes practical, non-repudiation doesn’t degrade, it collapses: every “this party signed this” becomes forgeable. So the honest framing is that quantum doesn’t break your ledger’s integrity soon — it breaks its authorship eventually. And authorship is the whole point of an audit trail.

This is also the part of the hardware-key story I’d rather say out loud than let a vendor gloss. A hardware security key gives you phishing resistance and physical attestation today, which is genuinely valuable and covered in its own piece. What today’s common hardware keys do not give you is quantum resistance — they sign with the same elliptic-curve scheme that’s exposed. The industry has shown the newer post-quantum algorithms can run on this class of hardware, but that’s a feasibility demonstration, not something you can buy and deploy yet; it needs a new hardware generation. So a hardware key buys strong classical security now, and the quantum gap closes when the next hardware lands — not before. Anyone selling you a physical key as “quantum-proof” today is ahead of what the hardware actually does.

The reason none of this is cause for alarm is that the migration path already exists — the standards bodies got there first. NIST finalized its post-quantum signature standards in 2024 (ML-DSA and a hash-based backup, SLH-DSA), and key-management tooling has started to add them — HashiCorp Vault, for instance, shipped experimental ML-DSA signing in its Enterprise transit engine. The sane strategy isn’t a rip-and-replace. It’s hybrid signing: sign each record with both the classical scheme and a post-quantum one at the same time, so the record stays verifiable under whichever survives. If a key-management layer already abstracts your signing, adopting a post-quantum algorithm becomes a configuration change, not a redesign — which is the whole argument for putting keys behind a proper vault before you need to. (One caveat worth tracking: that vault tooling now sits inside a much larger enterprise portfolio after IBM’s 2024 acquisition of HashiCorp, so watch how tier gating and pricing evolve.)

The one trap worth naming is a specific version of “harvest now, decrypt later.” An adversary doesn’t need to break anything today to hurt you later — they can simply store your signed records now and forge or repudiate them once the capability matures, while those very records are still inside their legal retention window. That risk is unusual in that it’s already running; the copy has, in effect, already been made. Hybrid signing is the answer here too: a record signed with a post-quantum algorithm today can’t be retroactively forged by tomorrow’s quantum attacker, even if they kept a copy.

So the practical position, without the drama: your tamper-evident ledger is in good shape and cheap to future-proof. Your signatures — machine and human alike — are the thing to migrate, on a multi-year horizon, using hybrid classical-plus-post-quantum signing, ideally behind key management that makes the switch a setting rather than a rebuild. Do that, and the records you’re signing this year are still defensible in the decade when someone finally asks.

Requirements first, technology second — and, for the records that have to outlive today’s cryptography, a little foresight about which signatures will still mean something when the question gets asked.

This is the long-horizon layer under our approach to governing AI that touches money — making sure the proof still proves something years from now.