The answer, up front
Boards do not need to become quantum experts. They need to ask management twelve questions across four areas: risk exposure, strategy, governance and investment. Quantum risk is a fiduciary issue because nobody can give a date for a machine that breaks today's public-key encryption, and migration takes years. Insist on written answers with owners, dates and evidence.
Last verified: Sep. 30, 2026.
Why the board should ask now
Experts disagree on timing. In the Global Risk Institute's 2025 survey of 26 experts, the averaged chance of a cryptographically relevant quantum computer was 28% to 49% within 10 years 1. Those figures reflect opinion from a small sample, not a forecast. See What Is Q-Day? for the detail.
Governments already plan around migration time instead of a date. The UK NCSC asks for discovery by 2028 and high-priority migration by 2031 4. Those dates give a board a reasonable pace to test management against.
Questions about risk exposure
1. What is our exposure to harvest-now-decrypt-later attacks?
Attackers can copy encrypted data now and decrypt it once a capable quantum computer exists. The Canadian Cyber Centre defines the threat this way 5, and the U.S. executive order cites it as a reason to accelerate migration 3. No public source confirms which data sets attackers hold, so plan around the risk. Ask which data must stay confidential for 10 years or more. See Harvest Now, Decrypt Later.
2. Do we know where quantum-vulnerable cryptography exists?
Most organizations cannot answer with confidence. OMB calls a dynamic, continuously updated cryptographic inventory the foundation of the migration plan 2. If management cannot show one, that gap is itself a risk.
3. What are our critical vendors doing about post-quantum cryptography?
Part of your exposure sits in products and services you do not control. Ask which vendors have published a plan, which have declined to share one, and who owns each dependency.
Questions about strategic positioning
4. Are our competitors and peers investing in quantum?
Ask management for evidence, not anecdotes. Request a short benchmark of what peers and regulators in your sector are doing, with sources.
5. Have we identified business problems where quantum computing could create value?
Quantum computing targets specific problem types, such as optimization and molecular simulation. Ask whether management has screened for real use cases and whether a small, time-boxed experiment is warranted.
6. What is our multi-year strategy for building capability?
Readiness is a sustained posture, not a project with an end date. Ask how security migration and quantum adoption fit into one plan, and how it changes as the technology matures.
Questions about governance and accountability
7. Who owns quantum readiness?
Readiness spans security, technology, procurement and the business. Federal agencies must name a migration lead within 30 days of the executive order 3, and Canada's roadmap names executive and technical leads 5. ArcQubit guidance: name one accountable executive who reports to the board.
8. How does it connect to our risk and compliance frameworks?
Quantum risk belongs in enterprise risk management, not in a standalone report. Ask where it sits in the risk register and which committee reviews it.
9. What governance exists for quantum investment decisions?
Ask what spending thresholds trigger board review and how quantum work competes with other technology priorities.
Questions about investment and timeline
10. What is our planned three-year investment?
Ask for a range covering both migration and exploration, with the assumptions behind it. A number with no assumptions is not an answer.
11. What milestones show we are on track?
Expect measurable milestones: inventory coverage, systems migrated, supplier responses received and pilots started. OMB's first migration phase, 2026 to 2027, centers on discovery and inventory 2.
12. What happens if timelines compress?
Ask for a contingency plan. The Global Risk Institute reports that experts see the timeline accelerating compared with earlier editions 1. Crypto agility, the ability to swap algorithms without a rebuild, is what makes acceleration affordable.
Sample answers and evidence to request
ArcQubit guidance: a good answer is specific, dated and owned. Use this table to tell strong answers from weak ones.
| Question | A board-ready answer sounds like | Evidence to request |
|---|---|---|
| 1. Harvest-now exposure | "These data sets must stay secret beyond 10 years, and these links carry them." | Data-lifespan classification signed off by data owners |
| 2. Visibility | "Inventory covers a stated share of high-value systems, refreshed on a schedule." | Coverage percentage and last scan date |
| 3. Vendors | "We asked our critical suppliers; here are the responses and gaps." | Supplier responses and renewal clauses |
| 7. Ownership | "One named executive owns it and reports each half year." | Charter or role description |
| 11. Milestones | "Discovery finishes this year; first-wave migration follows." | Dated roadmap with progress metrics |
| 12. Acceleration | "We can re-sequence the first wave within a quarter." | Contingency plan and agility assessment |
If an answer is uncertain, treat that as information. It shows where to direct funding first. The Readiness Self-Assessment gives management a structured way to gather this evidence.
How to use these questions
These questions are conversation starters, not a compliance checklist. Put quantum readiness on the technology or risk committee agenda at least twice a year. Annual review is too slow for a topic with published government deadlines. The Global Mandates and Deadlines guide shows which dates may apply to you.
Common mistakes
- Waiting for a firmer date. The date will not firm up in time to help. Plan from data lifespan and migration time.
- Accepting verbal assurance. Require written answers with owners and dates.
- Treating it as a pure security project. Procurement, legal and the business own parts of it.
- Confusing adoption with migration. Exploring quantum computing and migrating cryptography are separate workstreams with separate owners and budgets.
How ArcQubit approaches it
ArcQubit's QuCode is enterprise discovery, sold directly, and produces a Quantum Exposure Report that ranks findings and shows whether your team or a supplier must fix each one. QuTrust is the migration system of record and keeps the roadmap and evidence current for ongoing board reporting. For strategy questions and board advisory, the AI & Quantum Consulting team can help.