When the Timeline Moves: Board Accountability in the Quantum Era

Dr Ivan Roche FRSS FRSA MInstP is Founder and Principal Advisor of Otopoetic Limited, a UK-based AI governance advisory practice, and a non-executive director and board adviser on AI and technology governance. He sits on the steering group of the Matrix NI Quantum Technologies Foresight Study that was produced by SAMI: Quantum Technologies in Northern Ireland - Matrix.

Most discussions of quantum readiness focus on the technology.

How quickly will quantum computing advance? When will a cryptographically relevant quantum computer emerge? How urgently should organisations migrate to post-quantum cryptography?

These are reasonable questions. They share a common assumption: that the primary challenge is making the right prediction.

It is not.

The harder challenge is ensuring that a decision made today remains defensible tomorrow, once the assumptions behind it have changed.

Foresight is not forecasting

A forecast attempts to identify the most likely future. Foresight accepts that several futures remain plausible and asks how an organisation can make sound decisions despite that uncertainty.

The distinction matters because quantum timelines are contested. Some experts anticipate major breakthroughs within a decade. Others expect practical impact considerably later. Meanwhile, the UK's National Cyber Security Centre and the US National Institute of Standards and Technology are already directing organisations to begin cryptographic discovery and migration planning now, not once the timeline resolves.

Boards therefore face a familiar governance problem. Decisions cannot wait for certainty.

Consider a board deciding in 2026 whether to accelerate post-quantum migration. The decision draws on the intelligence, expert advice, regulatory direction and risk appetite available at the time. Five years later, the landscape may look very different. Progress may have outpaced expectation, or slowed enough that early investment appears premature.

In either case, the question the board will face is not whether it predicted correctly.

The question will be whether it acted reasonably.

Why data shelf-life changes the arithmetic

Quantum risk is often discussed as a single countdown to a single event. It is better understood as two clocks running against each other.

The first clock is how long the organisation's data must remain confidential. The second is how long migration to post-quantum cryptography will actually take. The precedent is not encouraging: the SHA-1 hash function was declared weakened in 2005 and was still being removed from browsers, certificates and embedded systems more than a decade later, and that was a smaller change than the one now under way. Across a complex estate, five to ten years is a realistic planning figure.

Where the combined length of those two clocks exceeds the lower-bound estimate for a cryptographically relevant quantum computer, the board is not making a speculative bet by acting now. It is managing a present operational exposure. Cryptographers have used this inequality as a planning tool for the better part of a decade, and its unnerving feature is that two of its three terms are the organisation's own properties, knowable today. Only the third is contested, and for data with decades of confidential life the sum breaches almost any credible estimate of it.

This is the mechanism behind "harvest now, decrypt later." Sensitive information taken today may sit unread for years before a future capability makes it legible. The consequence may not be visible for a decade. The exposure exists from the moment the data is taken, not from the moment it is decrypted.

The record, not the forecast, is what gets tested

Directors are rarely judged on their ability to foresee the future with precision. Under the Companies Act 2006, a director must exercise the care, skill and diligence that a reasonably diligent person would exercise, with the general knowledge, skill and experience reasonably expected of someone in that role, and must have regard to the likely long-term consequences of any decision. Neither duty asks whether the director was right. Both ask what a reasonably diligent person, knowing what was known at the time, would have done.

That standard rewards a board that documented a risk assessment, weighed current guidance, and set clear triggers for revisiting the decision, even if a breakthrough later arrives sooner than expected. It does not protect a board that deferred action indefinitely on the grounds that the timeline was uncertain. Uncertainty is not an exemption from oversight. It is the condition oversight exists to manage.

The risk in quantum planning is therefore not failing to reach the correct conclusion. It is failing to create an evidential record showing why the conclusion was reasonable at the time it was made.

Many organisations document the decision. Few document the assumptions beneath it. Years later, the people in the room remember what they chose but cannot show the context that made the choice rational. That gap, not the technology, is the governance failure.

Four elements worth recording

For quantum-related decisions, four elements deserve explicit minuting.

What the minutes should capture

1.     1. Assumptions — What future conditions were treated as plausible. Which timelines carried credibility. Which uncertainties were left open rather than resolved by assumption.

2.     2. Evidence base — Which standards guidance, threat intelligence and expert advice informed the discussion, and which sources carried the most weight.

3.     3. Alternatives considered — What options were weighed and set aside, and why. A record that shows the discarded paths alongside the chosen one is a stronger record than one that shows only the outcome.

4.     4. Review triggers — What developments would bring the decision back to the table, and on what dates.

On the fourth point, the triggers no longer need to be invented. The NCSC has set 2028 for a complete initial migration plan, 2031 for migrating the highest-priority services, and 2035 for completing migration across all systems, services and products. NIST's transition guidance schedules the widely used RSA and elliptic-curve algorithms for deprecation by 2030 and disallowance by 2035. Sector regulators are following: the G7 Cyber Expert Group's financial-sector roadmap places cryptographic discovery in 2027 to 2028 and critical-system migration from 2030. A board minuting its review triggers in 2026 without naming the published dates for its own sector has a weaker record than one that does.

Meeting a trigger need not mean committing to full, immediate replacement of every system. It can mean investing first in cryptographic agility, knowing precisely where keys and algorithms sit across the estate, so that when a trigger is met, the organisation can act quickly rather than starting discovery from zero. Framed this way, early investment is not a bet that may be wasted. It is the infrastructure that makes later action possible on any timeline.

These four elements do not make the forecast more accurate. They make the reasoning demonstrable, which is the thing actually being tested when a decision is reviewed after the fact.

The governance question underneath the technical one

The task in front of a board is not to predict when a cryptographically relevant quantum computer will exist. It is to show that the organisation understood the uncertainty and acted in proportion to it.

Seen this way, quantum readiness sits alongside AI oversight and other emerging-technology risks as a single governance question with different technical surfaces. Forecasting tells a board what may happen. Foresight prepares it for several versions of what may happen. Governance ensures that when the future inevitably diverges from expectation, the organisation can still explain, on the record, why its decisions were reasonable at the time.

If it can't explain itself to a board, it shouldn't be trusted by one. The same test applies to the board's own decisions under uncertainty. That record of reasoning may prove as valuable, in the end, as the decision it supports.

Building that record is, in practice, a foresight exercise as much as a governance one: mapping plausible timelines, identifying cryptographic review triggers, and translating both into language a board can act on and defend. Quantum Foresight works with leadership teams on precisely this, running structured foresight sessions that produce not just a migration plan but the evidential record behind it.

Written by Dr Ivan Roche, an advisor to boards on governance under uncertainty across AI and emerging technology risk.

The views expressed are those of the author(s) and not necessarily of SAMI Consulting.

Achieve more by understanding what the future may bring. We bring skills developed over thirty years of international and national projects to create actionable, transformative strategy. Futures, foresight and scenario planning to make robust decisions in uncertain times. Find out more at www.samiconsulting.co.uk.

If you enjoyed this blog from SAMI Consulting, the home of scenario planning, please sign up for our monthly newsletter at newreader@samiconsulting.co.uk and/or browse our website at https://www.samiconsulting.co.uk