The post-quantum cryptography conversation is quickly shifting from “When will quantum computers become a threat?” to “What are we doing to prepare?”
In September 2026, the G7 Cybersecurity Working Group published Preparing for the Post-Quantum Era: A Call to Action, reinforcing a message governments and cybersecurity authorities worldwide have increasingly emphasized: organizations should not wait for cryptographically relevant quantum computers to arrive before beginning their post-quantum cryptography (PQC) transition.
The G7 calls for organizations across sectors, not only governments and critical infrastructure, to treat the quantum threat as a near-term risk that requires action today. It recommends beginning the PQC transition as soon as possible, recognizing that migration will require significant planning, coordination, technology changes, and time.
For organizations still treating PQC as a future technology initiative, the message is increasingly clear: the preparation window is already open.
Why Organizations Should Start PQC Migration Now
No one knows exactly when a cryptographically relevant quantum computer will become available. But organizations don’t need the precise date to understand the risk.
Much of today’s public-key cryptography, including RSA and elliptic curve cryptography, is vulnerable to sufficiently capable quantum computers. These technologies are deeply embedded across applications, certificates, identity systems, secure communications, infrastructure, devices, and software supply chains.
The G7 specifically highlights the risk of “harvest now, decrypt later” attacks. Adversaries can collect encrypted information today and retain it until future quantum capabilities make it possible to decrypt. That creates an immediate concern for data that must remain confidential for years, such as government information, personal data, intellectual property, financial information, and business secrets.
The threat also extends beyond confidentiality.
Future quantum capabilities could undermine authentication mechanisms and digital signatures that organizations rely on to establish identity and integrity. The G7 warns that this could enable attackers to impersonate trusted entities, compromise equipment, forge trusted data, or gain access to sensitive information. Because these systems are interconnected, cryptographic vulnerabilities can also cascade across customers, suppliers, partners, and other parts of the software supply chain.
That makes PQC much more than a cryptographic problem. It is becoming an enterprise risk-management problem.
How the G7 Recommends Starting the PQC Transition
Fortunately, preparing for PQC does not mean replacing every cryptographic implementation overnight.
The G7 recommends a phased, risk-based transition. Organizations should begin by understanding their existing cryptographic environment, identifying where their highest-value assets are located, and determining which systems should migrate first.
Specifically, the guidance recommends that organizations:
- Inventory their cryptographic assets.
- Map cryptographic dependencies.
- Identify systems protecting their most critical data and assets.
- Prioritize migration according to risk.
- Develop a structured PQC transition plan.
- Begin incorporating quantum-safe technology into normal system replacement and technology refresh cycles.
Starting early allows organizations to spread the transition across planned development and infrastructure changes instead of attempting a disruptive, organization-wide migration later. The G7 also notes that this approach could ultimately reduce the overall cost of PQC migration.
The first milestone in a PQC program should be understanding where cryptography is used, what is vulnerable, what matters most, and what needs to change first, not deploying PQC everywhere at once.
Why Cryptographic Discovery Is Only the Start of PQC Migration
Creating a cryptographic inventory is a critical first step, but an inventory by itself does not complete a PQC migration.
Large organizations can have cryptography distributed across thousands of applications, libraries, APIs, certificates, protocols, operating systems, containers, development environments, third-party components, and network services.
Simply discovering that RSA or ECC exists somewhere does not tell a security team whether it presents an immediate business risk.
Organizations also need context.
Is the cryptography actively executed in production? What application depends on it? What data does that application protect? Is the system externally exposed? Which business process depends on it? Is there already a quantum-safe alternative available? And what will happen to other systems if the implementation changes?
This is why cryptographic discovery must connect to prioritization and remediation.
SafeLogic CPM was built around this broader cryptographic lifecycle. It continuously discovers and inventories cryptographic assets and connects findings with application, runtime, exposure, and business context so organizations can determine where remediation should begin. From there, remediation can include configuration changes, replacing outdated cryptographic libraries, enforcing algorithm policies, deploying post-quantum cryptography, or updating certificates and protocols.
The goal is to move from Discovery → Inventory → Prioritization → Remediation → Governance rather than treating cryptographic discovery as a one-time assessment.
How PQC Readiness Is Becoming a Procurement Requirement
One of the most significant parts of the G7 guidance may have less to do with quantum computing itself and more to do with how organizations buy technology.
The G7 states that organizations delaying their PQC transition may eventually lose competitive advantages or become excluded from certain contracting opportunities, including public procurement. It also recommends incorporating PQC requirements into procurement frameworks to encourage vendors to begin transitioning the products and services they bring to market.
That should get the attention of technology vendors.
Increasingly, customers are likely to ask questions such as:
- Where does your product use quantum-vulnerable cryptography?
- Do you support NIST-standardized PQC algorithms?
- What is your roadmap for replacing RSA and ECC?
- Can your product support hybrid classical and post-quantum cryptography?
- How quickly can you change cryptographic algorithms as requirements evolve?
- Can you demonstrate and continuously govern your cryptographic posture?
PQC readiness may therefore become not only a cybersecurity differentiator, but also a requirement for maintaining access to certain customers and markets.
The G7’s recommendation is particularly important: PQC should be treated as an evolution of cryptographic best practices, not simply another standalone compliance requirement.
Build Crypto-Agility, Not Just PQC Compliance
Organizations should take another lesson from the PQC transition.
PQC will not be the last cryptographic migration.
Algorithms change. Vulnerabilities are discovered. Standards evolve. Regulatory requirements change. Cryptographic libraries reach end of life. New protocols emerge.
Organizations that solve PQC by hard-coding a new generation of algorithms into their applications may eventually face the same problem again.
Instead, the PQC transition presents an opportunity to build crypto-agility, the ability to identify, update, replace, and govern cryptography without redesigning applications every time requirements change.
For organizations beginning deployment, hybrid approaches can also bridge today’s cryptography and post-quantum algorithms. SafeLogic’s CryptoComply and SafePQ support NIST-standardized PQC algorithms including ML-KEM, ML-DSA, and SLH-DSA, along with hybrid migration approaches that allow organizations to introduce post-quantum protection while maintaining compatibility with existing environments.
The objective should therefore extend beyond simply checking a box labeled “PQC ready.”
Organizations should use this transition to establish the visibility, governance, and cryptographic flexibility required to adapt continuously.
Five G7 Priorities for the Post-Quantum Transition
The G7 identifies five priority areas for governments and industry as the transition moves forward:
Raising awareness. Organizations need to understand that quantum risk represents an economic and business concern, not only a highly technical cryptographic issue.
Developing national strategies. Governments need strategies that encourage both the availability and adoption of quantum-safe hardware and software.
Research and development. Continued investment in PQC technologies, implementation approaches, pilot programs, and test environments will be necessary.
Public-private partnerships. Governments, technology companies, academia, and other organizations will need to share expertise and lessons learned.
Integrating PQC into cybersecurity requirements. PQC adoption should increasingly become part of broader cybersecurity practices and procurement requirements.
Together, these priorities show that the transition will not happen through cryptographic standards alone.
Standards provide the algorithms. Organizations still need to decide where to deploy those algorithms, how to implement them, and how to manage the resulting cryptographic environment over time.
The Post-Quantum Transition Has Already Started
Organizations don’t need to know the exact date quantum computers will threaten today’s cryptography to start preparing. They need to know what cryptography they currently depend on. They need to understand which systems and data are most exposed. They need a strategy for prioritizing migration. And they need the ability to deploy and govern new cryptographic technologies as standards and requirements evolve.
The G7’s call to action makes the direction increasingly difficult to ignore; waiting for certainty creates more risk, not less.
Organizations that begin inventorying cryptography, prioritizing risk, deploying quantum-safe technologies, and building crypto-agility now can make PQC part of normal technology modernization rather than an emergency migration later.
The post-quantum transition is already underway.
The question is no longer whether organizations should prepare. It is whether they have the visibility, technology, and governance necessary to execute the transition successfully.
Start Your PQC Transition
SafeLogic helps organizations move from PQC planning to implementation.
With SafeLogic CPM, organizations can continuously discover and inventory cryptographic assets, prioritize quantum risk, guide remediation, and govern cryptographic change across complex environments. CryptoComply and SafePQ provide NIST-standardized post-quantum cryptography and hybrid migration capabilities for organizations ready to begin deploying quantum-safe cryptography.
Learn more about SafeLogic’s post-quantum solutions or request a SafeLogic CPM demo to see how your organization can move from cryptographic discovery to action.
