Post-Quantum Audit for Critical National Infrastructure

The NCSC roadmap sets 2031 for cryptographic migration of high-priority critical national infrastructure (transmission, distribution, water, telecoms backbones, central banking systems) and 2035 for universal migration of all cryptographically-relevant systems in the UK. The roadmap is operator-led: each CNI operator owns its own inventory, sequencing, and evidence chain.

ML-KEM (FIPS 203, finalised 2024) is the post-quantum key encapsulation mechanism, used to replace classical key exchange (Diffie-Hellman, RSA-KEM). ML-DSA (FIPS 204, finalised 2024) is the post-quantum digital signature algorithm, used to replace classical signatures (ECDSA, RSA-PSS). Together they cover the cryptographic primitive replacements a CNI operator needs across confidentiality and integrity surfaces.

The first migration step is inventorying every system that uses TLS, code signing, document signing, VPN tunnels, IoT firmware signing, AI audit trails, or any other cryptographic primitive. The NCSC publishes guidance; the operator-side discipline is to enumerate by system, by primitive in use, by key custody, and by upgrade complexity, then sequence the migration against the 2031 and 2035 deadlines.

AI audit chains are typically signed using classical primitives (ECDSA, RSA-PSS) by AI vendors who do not control their own PQC roadmap. A regulator in 2031 walking a four-year-old audit trail signed with ECDSA would face a chain that is no longer cryptographically-relevant under NCSC guidance. The operator that lands AI audit signing on ML-DSA-65 today is ahead of the deadline structurally.

The Mickai substrate gives the operator post-quantum-signed audit records under the operator's own key. No vendor PQC migration plan, however well-intentioned, transfers cryptographic custody to the buyer. Trust-domain externalisation as a primitive does. The operator's PQC posture becomes independent of the AI vendor's PQC roadmap.