The Post-Quantum Horizon in Saudi Arabia: How Enterprises and Banks Must Prepare for SAMA’s PQC Mandate

For this article, we spoke with Dr. Shaista Hussain, Founder & CEO of SAIF CHECK, the GCC’s premier sovereign AI safety, cybersecurity, and post-quantum governance platform. Known in the industry as ‘The Algorithm Doctor’, Dr. Shai holds a unique background spanning machine learning engineering, clinical pathology, and cybersecurity across Google, Microsoft, Harvard, MIT, and Stanford. Building on Q Agency’s ongoing strategic collaboration with SAIF CHECK, Dr. Shai shares real-world insights into Post-Quantum Cryptography (PQC), central bank directives, and what Saudi enterprises must do before quantum computing disrupts traditional data encryption.

1. The Quantum Clock Is Ticking: Why PQC Is Saudi Arabia’s Next Critical Security Frontier

While the hype train is steering global conversation around model outputs and generative capabilities, a festering risk in cybersecurity shift is taking place beneath the surface: the post-quantum transition.

Under Saudi Vision 2030, the Kingdom is rapidly building a hyper-connected digital economy. From open banking and digital national identities to autonomous infrastructure and sovereign AI models, high-value data is flowing across enterprise and government networks at unprecedented speed.

However, the mathematical algorithms protecting this data have a finite lifespan. Cybersecurity experts refer to the threshold moment when quantum computers achieve the processing power to break legacy encryption as “Q-Day.” When Q-Day arrives, Cryptographically Relevant Quantum Computers (CRQCs) will be able to solve the complex mathematical problems underpinning global encryption in seconds. It is the stuff of science fiction. 

The primary cryptographic building blocks used today are:

• RSA (Rivest–Shamir–Adleman): An asymmetric public-key algorithm used to secure website connections, digital signatures, and encrypted communications.
• ECC (Elliptic Curve Cryptography): A modern, highly efficient asymmetric algorithm used for public-key encryption, digital identity verification, and mobile app security.
• AES (Advanced Encryption Standard): A symmetric cipher used to encrypt bulk data at rest (in databases and disks) and in transit using a shared secret key.
• Hash Functions (e.g., SHA-256): One-way mathematical algorithms that generate a unique digital “fingerprint” of data to verify integrity, detect tampering, and secure passwords.

Recognizing the systemic risk Q-Day poses to national infrastructure, Saudi regulatory authorities have shifted from advisory guidelines to binding statutory mandates, demanding that enterprise and financial infrastructure become quantum-resilient today.

2. “Harvest Now, Decrypt Later” (HNDL): The Invisible Countdown to Q-Day

Many corporate leaders ask a logical question: “If Q-Day is still a few years away, why must we re-architect our encryption in 2026?”

The answer lies in a pervasive cyber-adversarial strategy known as Harvest Now, Decrypt Later (HNDL).

Sophisticated cybercrime syndicates and actors are actively intercepting, copying, and storing vast volumes of encrypted data moving across global optical links, financial gateways, and cloud networks today. While adversaries cannot read this encrypted traffic now, they are hoarding it in secure data vaults, waiting for Q-Day. The moment quantum machines come online, these stockpiled datasets will be decrypted instantly.

For short-lived data, like temporary session tokens there is minimal HNDL risk. But for long-horizon, high-value assets, HNDL is a catastrophic and existential threat:

• Financial & Core Banking Records: Transaction histories, credit scoring algorithms, and long-term customer account data.
• Biometric Identity Assets: Voiceprints, facial biometrics, and sovereign digital identity registries (e.g., MyDigital ID, Yakeen integrations).
• Proprietary AI Models & Datasets: Proprietary model weights, fine-tuning datasets, and confidential intellectual property.
• Critical Infrastructure Telemetry: Defense communications, power grid controls, and smart city sensor data.

If your data must remain secure for 5, 10, or 20 years, its security is already compromised if protected only by legacy RSA or ECC encryption.

To learn more, current security protocols and frontier risk evaluations are available on SAIF CHECK’s Knowledge Page.

3. Demystifying the Regulatory Mandates: SAMA and NCA Deadlines

In 2026, the Saudi Central Bank (SAMA) issued explicit directives requiring all supervised banking institutions, fintechs, and digital banks to execute a structured Post-Quantum Cryptography transition. This is complemented by the National Cybersecurity Authority (NCA) National Cryptographic Standards (NCS-2:2025) and global NIST FIPS standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA).

SAMA’s regulatory clock is split into two firm phases:

Regulatory Deadline	Mandatory Phase & Deliverables	Core Operational Focus
End of Q4 2026	Phase 1: Discovery, Inventory & Classification	• Complete Cryptographic Bill of Materials (CBOM) • Algorithm classification (RSA, ECC, AES, Hash functions) • Data sensitivity & transition priority mapping • Third-party & supplier dependency audits
End of Q1 2027	Phase 2: Assessment, Remediation & Governance	• Full institutional quantum-readiness evaluation • Digital signature & PKI infrastructure audit • Board-approved treatment & remediation plans • Embedding quantum risk into C-suite GRC committees

Phase 1: End of Q4 2026: Discovery, Inventory & Classification

By the end of Q4 2026, institutions must deliver a comprehensive Cryptographic Bill of Materials (CBOM) to SAMA. This requires discovering and cataloging every asymmetric algorithm, public key, TLS endpoint, Hardware Security Module (HSM), code-signing certificate, and API gateway across the organization, alongside a risk-based transition sequence.

Phase 2: End of Q1 2027:  Assessment, Remediation & Senior Governance

By the end of Q1 2027, institutions must execute a complete institutional quantum-readiness assessment, deploy remediation playbooks, and embed quantum risk directly into C-suite and Board-level risk committee oversight.

4. Why PQC Readiness Is Harder Than It Looks: The “Shadow Cryptography” Problem

Transitioning an enterprise to post-quantum cryptography is not a simple software patch; it is an architectural overhaul. When enterprises begin auditing their estates, they immediately encounter four major bottlenecks:

1. You Cannot Protect What You Have Not Discovered: Most enterprises do not hold a centralized inventory of their cryptographic assets. Legacy codebases, forgotten subdomains, embedded firmware, and microservices contain hardcoded keys that manual security teams take months to locate. This is why SAIF CHECK helps clients to build a solid foundation including asset inventories and Cryptographic Bill of Materials.
2. “Shadow Cryptography” in the Supply Chain: A significant portion of an enterprise’s cryptographic footprint isn’t owned directly. Card processing networks, cloud providers, SaaS tools, and payment aggregators carry cryptographic flows that CISOs do not control, but are legally accountable for under SAMA and SDAIA PDPL rules.
3. Bandwidth & Compute Overhead: Post-quantum lattice-based algorithms (such as ML-KEM) utilize significantly larger public key sizes and ciphertexts. Without performance tuning, swapping algorithms can introduce latency spikes in real-time transaction channels.
4. Fatigued Security Teams: Internal DevSecOps and GRC teams are already stretched managing SDAIA PDPL enforcement, NCA ECC controls, and AI model deployments. Adding post-quantum discovery manually creates severe operational friction.

5. SAIF CHECK’s Zero-Custody PQC Architecture: What Sets Us Apart

This is precisely where SAIF CHECK changes the paradigm for Saudi and GCC enterprises.

While traditional international consulting firms approach PQC through months of manual interviews, heavy fees, and invasive external scanning that exposes sensitive architectural code, SAIF CHECK delivers automated, sovereign, and zero-custody post-quantum assurance.

Architectural Layer	Environment & Deployment	Core Function & Technical Mechanics	Data Sovereignty Guarantee
Automated CBOM Discovery Daemon	Local Client VPC / Sovereign Enclave	Scans local code repositories, APIs, TLS endpoints, and network nodes without copying raw data.	Zero data or source code leaves the domestic perimeter.
HNDL Risk Exposure Generator	Local Client VPC / Sovereign Enclave	Quantifies data confidentiality horizons and generates a 22 Sensitivity vs. Quantum Risk heatmap.	Raw customer datasets remain 100% in-tenancy.
Crypto-Agility Health Evaluator	Local Client VPC / Sovereign Enclave	Audits software architectures to ensure algorithms can be swapped dynamically via configuration.	Systems are stress-tested locally without downtime.
Regulator & Board Evidence Pack	Export Boundary (External)	Generates signed PDF certificates, structured JSON audit ledgers, and C-suite gap reports.	Only signed scores and findings cross the boundary.

What Sets SAIF CHECK Apart in Post-Quantum Cryptography?

• Architectural Zero-Custody Guarantee: “We see the findings. We never see, copy, or store your underlying data: by architecture, not by policy.” All SAIF CHECK discovery daemons and diagnostic engines execute natively inside the client’s local VPC, on-premises data center, or air-gapped sovereign enclave. Sensitive customer datasets, biometrics, and source code never cross the domestic boundary.
• Automated Cryptographic Bill of Materials (CBOM): SAIF CHECK automatically scans network topologies, code repositories, and API gateways to output a filterable, audit-ready CBOM detailing every RSA, ECC, AES, and hash implementation across the organization.
• Quantified HNDL & Q-Day Exposure Scoring: Our algorithms evaluate data longevity against cryptographic life expectancies, providing CISOs with a 22 Data Sensitivity vs. Quantum Risk matrix to prioritize migration spend logically ahead of Q-Day.
• Unified AI & Cryptographic Shielding: SAIF CHECK does not treat cryptography in isolation. Our PQC engine integrates seamlessly with SAIF SCAN (AI red-teaming), SAIF GUARD (runtime agentic firewall), and WAR ROOM (24/7 incident command), ensuring that generative AI pipelines, RAG stores, and multi-agent workflows are protected against both prompt manipulation and post-quantum decryption.
• Rapid Turnaround & Board-Ready Evidence: Instead of multi-month advisory engagements, SAIF CHECK’s 2-Week PQC Exposure Sprint delivers signed PDF certificates, structured JSON audit ledgers, and executive C-suite gap reports ready for immediate submission to SAMA and NCA.

6. Practical Steps: How Enterprises Should Prepare Today

For CISOs, CTOs, and risk officers preparing for the upcoming regulatory milestones, Dr. Shai recommends a structured four-step action plan:

1. Initiate an Automated CBOM Discovery (Immediate): Stop relying on manual spreadsheets. Deploy automated, non-invasive discovery tools inside your perimeter to map all asymmetric encryption assets, TLS certificates, and API channels.
2. Audit Third-Party & Supply Chain Cryptography: Issue formal PQC questionnaires to all card processors, SaaS vendors, and cloud hosting partners to evaluate their compliance roadmaps against SAMA Q4 2026 timelines.
3. Establish Crypto-Agile Code Standards: Require software engineering teams to decouple cryptographic algorithms from core application logic. Code should allow developers to swap underlying key encapsulation mechanisms (KEM) via configuration parameters rather than code rewrites.
4. Run a 2-Week PQC Exposure Assessment: Partner with specialized sovereign assurance providers to run a zero-custody assessment, generating the exact evidence packages, gap analyses, and treatment plans required by SAMA and senior risk committees.

Building a Safe, Quantum-Resilient Digital Kingdom

Q-Day and the post-quantum transition are active regulatory and operational realities. By combining Q Agency’s high-performance software engineering, cloud architecture, and digital product capabilities with SAIF CHECK’s sovereign AI safety, PQC discovery, and zero-custody assurance engines, regional enterprises can navigate regulatory requirements with absolute confidence.

Is your enterprise ready for SAMA’s Post-Quantum Cryptography deadlines? Contact Q Agency and SAIF CHECK today to schedule a 15-minute PQC scoping call and discover how our 2-Week Exposure Sprint can secure your organization.