up:: For Policymakers
How do you make it worth doing?
Deadlines tell an organization what will eventually be punished. They don’t tell a finance director why to fund it this year, ahead of things that have already hurt the company.
That gap is where most of these programs stall, and it’s the part policy tends to under-address. A mandate creates an obligation. An incentive creates a business case, and the business case is what actually moves a budget in the years before the deadline bites.
The measures below are ordered by how quickly a government can put them in place.
The short version:
- Procurement preference is the fastest and cheapest incentive available, and it needs no new law.
- Safe harbors reward organizations that did the work honestly, and they’re what turns a compliance exercise into a defensible one.
- Insurance is a natural ally, because insurers price risk and will discount demonstrated readiness once they can measure it.
- Tax treatment matters more than grants, since most of the cost is labor rather than equipment.
- Public certification creates a reason to move that customers can see.
- Reward the inventory, because it’s the step everybody skips and everything else depends on.
Why won’t the deadline alone do it?
Because of how security spending actually gets approved.
Security work competes for budget against problems that have already happened. A breach, an outage, a failed audit, a regulator’s letter: each one is a story a finance committee understands. This threat produces none of those. Nothing breaks, nobody complains, and no incident forces the conversation.
So the person inside the organization arguing for this is asking for money to prevent something invisible, on a timeline that outlasts their own tenure, against a machine that doesn’t exist. They’re usually right and they usually lose.
Every incentive below exists to give that person an argument that works this budget cycle.
What can be done fastest?
1. Procurement preference. Give weight to post-quantum readiness in public tenders, and require it for anything with a long service life. This costs almost nothing, sits inside existing authority, and reaches every supplier who wants public business. It’s the highest-leverage measure on this page, and it converts a distant obligation into revenue somebody can pursue this year.
2. Reward the inventory rather than only the migration. The step everybody skips is producing a list of where cryptography actually lives. Making an inventory the qualifying condition for anything else, a grant, a preference, a safe harbor, targets the exact bottleneck. It’s also cheap to verify.
3. Publish readiness expectations that firms can point to internally. A clear, dated public statement from a regulator or ministry is free, and inside a company it converts an argument into a requirement.
What creates real financial pull?
4. Safe harbors. Offer reduced liability or penalty mitigation to organizations that completed an inventory, published a plan, and hit their milestones in good faith. This is powerful because it rewards honesty rather than paperwork, and it gives general counsel a reason to champion the work rather than minimize disclosure about it.
The design detail matters: a safe harbor should attach to demonstrated process, not to an outcome nobody can guarantee.
5. Insurance. Insurers are natural allies here, because their business is pricing risk they can measure. A government can accelerate this by working with regulators and the industry to define what readiness evidence looks like, so insurers can offer premium differentiation for it. Once a discount exists, the business case writes itself and no mandate is needed.
6. Tax treatment. Most of the cost here is labor, assessment, and internal engineering rather than equipment purchase, which is exactly the category tax policy often handles poorly. Allowing this work to be expensed favorably, or offering a credit for assessment and remediation, matches the cost to the relief.
7. Grants for those with no capacity. Small water utilities, regional health providers, and municipal systems have neither budget nor staff, and they sit on shared infrastructure. For them, incentives that reduce cost don’t help, because the cost they can’t bear is a person. Direct funding or shared regional services are the only things that work. See Who pays for this?
What creates reputational pull?
8. Public certification or a readiness mark. A visible, verifiable designation that an organization has completed the work gives customers something to look for and gives the organization something to advertise. It also gives journalists and researchers a dataset, which creates its own pressure.
9. Publish sector-level progress. Aggregate, anonymized reporting on how far each sector has got creates competitive pressure without naming and shaming anyone. Nobody wants to be the sector at the bottom of the chart.
10. Recognize early movers explicitly. Signal and Apple deployed this years before any requirement existed. Governments almost never acknowledge that kind of anticipatory work, and doing so is free and shapes behavior.
How could this go wrong?
Worth designing against, because incentive schemes fail in predictable ways.
| Failure mode | How to avoid it |
|---|---|
| Rewarding paperwork rather than migration | Tie benefits to verifiable artifacts like an inventory, not to attestations |
| Safe harbor becomes blanket immunity | Attach it to demonstrated process and milestones, with an expiry |
| Certification becomes a marketing badge | Require independent verification and re-certification |
| Incentives reach only large firms | Design the small-operator path first, since it’s the harder case |
| Vendors capture the subsidy | Direct support at the organizations doing the migration rather than at product purchases |
| Early movers get nothing | Make benefits retroactive to work already completed |
That last row matters more than it looks. An incentive that only rewards work started after the announcement punishes the organizations that acted responsibly first, and everybody notices.
What does this look like combined?
The most effective package is layered rather than singular. A plausible shape:
- Procurement preference immediately, since it’s free and fast.
- An inventory requirement with a deadline, plus grant funding for those who can’t meet it alone.
- A safe harbor attached to completing the inventory and publishing a plan.
- Regulator and insurer coordination to define readiness evidence.
- Tax relief for assessment and remediation labor.
- A certification mark once enough organizations qualify for it to mean something.
Sticks set the outer boundary. Carrots determine whether anything happens in the years before that boundary arrives, which is the entire window that matters.
Questions people ask
Isn’t it enough to just mandate it? Mandates work at the deadline. The problem is the decade before it, when the work has to happen and nothing forces it.
Won’t companies do this anyway to protect themselves? Well-resourced firms in regulated sectors, largely yes. Everybody else is competing against problems that already happened.
Do any of these exist today? Procurement requirements are appearing in several countries. The insurance, tax, and safe-harbor angles are much less developed, and they’re where the room to design something genuinely new is.
Which one would you pick if only one were possible? Procurement preference. It’s free, immediate, needs no legislation, and reaches every supplier at once.
What about penalties? They have a place at the deadline, and they’re a poor tool for the years before it, because you can’t penalize an organization for failing to meet a date that hasn’t arrived.
Where to go next
- What should a government actually do? is the full policy list.
- Who pays for this? covers the organizations with no capacity.
- For business leaders is the other side of this, written for the people being incentivized.
Go deeper into the technical detail
The technical treatment of why programs stall is Why Post-Quantum Migrations Stall.
These open the Post-Quantum Field Guide, a separate site written for security professionals.
Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.