Built to Last: Why Automotive-Grade PQC Can’t Wait

The urgency of automotive PQC is temporal, not algorithmic. NIST's 2024 standardization means "harvest-now-decrypt-later" poses a concrete threat to 15-20-year vehicle lifecycles: encrypted payloads captured in today's road tests become plaintext once quantum throughput matures. SoC architects can no longer treat PQC as a bolt-on. ML-KEM key expansion (10-50× ECC) pressures SRAM and flash budgets; side-channel resistance at -40°C to +125°C and the 2-3-year AEC-Q100 cycle must be embedded in the floorplan, not patched in post-design. Upstream, ARM, CEVA, and Synopsys are competing to become the default automotive PQC IP vendor. The qualification moat, once crossed, locks in a 15-year revenue stream. Downstream, Tier 1s are reserving PQC throughput in domain-controller security architectures—V2X latency constraints eliminate software-only options entirely. EU CRA stacked on UNECE R155 makes PQC a market-access requirement for new models by 2026-27. IP concentration in two or three houses creates a single-point-of-failure risk that propagates directly to vehicle delivery schedules. Within 18 months, hybrid crypto (classical + PQC in parallel) becomes the production baseline, doubling crypto workload and forcing security-engine rearchitecture. PQC IP shifts from optional add-on to a rigid BOM line item, accelerating industry consolidation.