A decade from now, regulators may ask an artificial intelligence agent to justify a financial decision it made years earlier, using cryptography that no longer exists in usable form. That is the problem a small software company called Quantova Inc is attempting to solve ahead of time, with a set of developer tools called Qstamp that had been downloaded over ten thousand times on the npm package registry by mid-October 2026.
A 2035 deadline written into federal policy
The urgency behind this work traces back to a specific date. National Security Memorandum 10, a US policy directive on quantum computing, sets 2035 as the target year for retiring cryptographic systems vulnerable to quantum attack. A draft document from the National Institute of Standards and Technology, IR 8547, goes further, proposing that RSA and elliptic curve signatures - the backbone of nearly all current digital security, from web browsing to financial transactions - be disallowed entirely after that point. Separately, Article 12 of the European Union's AI Act already requires high-risk AI systems to log their actions automatically throughout their operational life. Put together, these rules create a narrow but consequential challenge: records created today using today's standard encryption may become legally unverifiable within ten years, precisely when AI systems are expected to be making more autonomous financial and administrative decisions, not fewer.
Removing classical cryptography rather than patching around it
Most organizations preparing for the quantum transition are adding post-quantum signatures alongside their existing RSA or elliptic curve systems, a hedge intended to ease migration. Quantova took the opposite approach, building its stack without classical public key cryptography at all. Its Q-Crypto library implements ML-DSA, ML-KEM, SLH-DSA and SHA-3 - all algorithms standardized or endorsed by NIST - using only the Rust programming language's standard library, with a deny list blocking any elliptic curve or RSA dependency from entering the codebase. Quanta, the company's purpose-built contract language, is designed to refuse compilation of code containing known vulnerability patterns such as reentrancy bugs, integer overflow, forged authorization and front-running. Code that passes runs on the Quantova Virtual Machine, which verifies post-quantum signatures natively rather than through add-on modules. The public ledger has used ML-DSA-65 since its first block, while a separate private network aimed at banks and governments uses ML-DSA-87 and ML-KEM-1024, the higher-strength algorithms selected by the National Security Agency under its CNSA 2.0 suite for national security systems.
How the verification actually works
Qstamp itself runs on an organization's own servers rather than Quantova's infrastructure, a distinction that matters for data protection. Only a salted SHA3-256 commitment - a cryptographic fingerprint, not the underlying record or personal data - ever leaves the organization's systems. That commitment is anchored in roughly 0.2 seconds and can later be verified by a regulator who holds both the original record and its receipt, without needing access to the sensitive data itself. Companion tools extend this logic across different functions: QMandate ties AI agents to signed operational limits, QLog is built to demonstrate that intent was recorded before an action was taken, and six QGov-branded SDKs target government use cases including tax administration, public spending, procurement and elections.
What remains open
All twelve SDKs are already available for use, and the company has published fixes for several existing blockchain networks, including Ethereum, the XRP Ledger, BNB Chain, Cardano, Sui and NEAR, through its public GitHub repository. Quantova says it is pursuing further government validation, which suggests formal certification has not yet been completed. That distinction matters: adopting NIST-approved algorithms is a necessary step toward compliance with future rules, but it is not the same as having passed the regulatory review those rules will eventually require. For organizations deploying AI agents to approve payments, sign contracts or make procurement decisions, the deeper lesson is less about any single product and more about the shrinking window before cryptographic assumptions that have held for decades begin to expire by policy rather than by accident.