Blog over Kunstmatige Intelligentie, Quantum, Deep Learning, Blockchain en Big Data Law

The Prode released its interview with Prof. Mauritz Kop on August 31, 2026: a thirty-five-minute conversation with host Ritwij Raj on the emerging quantum race and its implications for defense and national security. Kop compares the quantum-safe programs of the United States, the United Kingdom, and the European Union, and sets out the layered governance approach he has developed since his early work on quantum ethics. The full video is embedded in the article.

One deadline, twenty-seven starting points

Kop declines to rank classified networks and compares what is public. America's strength is its standards machinery; Britain published a clear 2028-2031-2035 sequence; the EU has a coordinated roadmap plus sectoral regulatory tools in finance and cybersecurity that can move whole industries at once. The hard part of European post-quantum migration is coordination: twenty-seven member states, different starting points, 2035 as the shared target horizon.

PQC first, QKD where it earns its place

China's Beijing-Shanghai backbone and Micius satellite are strategically real, and quantum key distribution still solves a narrower problem than the public-key systems Shor's algorithm threatens. Kop's ordering: standardized post-quantum cryptography as the broad foundation, QKD for the links where its cost and limitations make sense, combined with hardware-based entropic random number generation.

A layered framework instead of one grand quantum law

Governance begins with values and translates them through the Quantum-ELSPI framework Kop developed with Luciano Floridi — the framework he taught to TUM students the week before this interview. Standards encode requirements, procurement demands independent validation, quantum impact assessments surface dual-use and data risks before deployment, and existing law does much of the remaining work. The principles stay horizontal; the intervention fits the sector.

The boardroom instrument: Mosca's theorem

Add the years your information must stay secret to the years your migration takes, and compare the sum with the uncertain arrival of a capable machine. For European organizations that means a cryptographic inventory now — vulnerable public-key components, data whose sensitivity outlives the decade, systems hardest to replace — then crypto-agility, so the organization can change algorithms again without rebuilding its systems.

What Mauritz Kop wrote on 6 November 2025, and what GSA announced on 24 August 2026

On August 24, 2026 the General Services Administration described a laboratory that evaluates whether badge readers and employee credentials can survive a quantum-capable adversary, and an approved products list that federal buyers work from in the covered category. Driving this through purchasing rather than through a statute was set out in print nine months earlier, with the agency named: on November 6, 2025 Mauritz Kop, founder of the Stanford Center for Responsible Quantum Technology, published "A Bletchley Park for the Quantum Age" in War on the Rocks, asking that the General Services Administration, OMB and agency chief acquisition officers condition federal purchases on validated cryptographic modules, and that deployed systems be tested rather than vendor claims accepted. Ten months on, the machinery those propositions call for is being assembled by that agency, and the alignment is worth stating exactly: no post-quantum purchasing condition is in force yet, and GSA says the laboratory is starting to incorporate quantum-resistant algorithms. What exists is the route through which such a condition would travel.

Which American rules carry the obligation, and why Europe arrives through NIS2 instead

FAR 4.1302 directs agencies acquiring personal identity verification products to approved products, while permitting acquisition outside the named GSA process where compliance is independently ensured. OMB Memorandum M-26-15 supplies the schedule, with migration plans due on October 22, 2026 and access control systems built on asymmetric cryptography named among the systems agencies should include. Executive Order 14412 directs NIST to accelerate module validation, a route legally distinct from the FIPS 201 programme GSA runs, and its section 6(c) requires the FAR Council to propose a contracting rule tying covered contractors to post-quantum standards by December 31, 2030. Europe arrives differently. Article 21 of NIS2 requires policies on cryptography and, where appropriate, encryption, without naming post-quantum cryptography or fixing a migration date, and the Cyber Resilience Act works on products with reporting duties from September 11, 2026 and its main obligations from December 11, 2027. A centralized federal approval route can convert a test result into a category-wide condition. Distributed European procurement and horizontal regulation produce a slower and broader effect that reaches operators no purchasing rule touches.