WISeKey International Holding Ltd (SIX: WIHN; Nasdaq: WKEY) has expanded its Quantum Root Key initiative into a post-quantum Root of Trust architecture for artificial-intelligence systems, autonomous agents, connected devices and human operators. The company said the approach could give organizations cryptographic ways to verify who—or what—initiated a high-impact AI action, an increasingly important control as agencies consider AI systems that can access networks, records and operational technology.
The development is less a new finished application than an expansion of identity infrastructure beneath AI. WISeKey and the OISTE.ORG Foundation describe a chain of trust that could link an organization, AI model, agent, device and transaction to a cryptographically verifiable identity. For public-sector IT leaders, that addresses a practical governance problem: knowing whether an AI service is the approved model, whether its software environment has changed and whether a person or system was authorized to direct it.
Conventional security controls can authenticate a user or device at the edge of a network, but they do not necessarily establish provenance for every model, agent and automated action inside an AI workflow. WISeKey said its architecture can use digital identities, cryptographic signatures and hashes to associate an AI model with an authorized organization and to detect changes to approved binaries, weights, software components or configurations. It also said AI agents could authenticate before accessing systems, APIs, financial services, IoT infrastructure or other agents.
The proposed architecture incorporates NIST-standardized post-quantum cryptography algorithms, including ML-DSA and ML-KEM, according to the company. Those algorithms are intended to reduce exposure to future quantum-computing attacks on widely used public-key cryptography. WISeKey said the platform can be anchored in hardware security modules, trusted platform modules and secure semiconductor elements, connecting hardware, firmware, operating environment, model and authorized user. The company did not disclose pricing, availability dates or named government customers using the expanded architecture.
That lack of deployment detail matters. Cryptographic identity can create evidence that an action came from an approved agent under a specific authorization, but it does not by itself determine whether the agent’s decision was correct, lawful or safe. Agencies would still need model-risk controls, access policies, logging standards, human oversight and procurement requirements that fit the mission. They would also need to validate interoperability with existing identity, certificate and security-operations systems.
One potential government use case would be a transportation agency deploying AI agents to review sensor data and initiate maintenance work orders. Before an agent could issue an instruction to a field system, the agency could require the service to present a verifiable identity, confirm that its approved model version had not been altered and record the authorization behind the action. That is a hypothetical application, not a WISeKey customer deployment.
The near-term significance is in the control model. As agencies move from AI systems that generate information to systems that recommend or execute actions, identity and authorization become operating requirements rather than abstract security concepts. WISeKey’s architecture gives that problem a post-quantum framing, but its practical value will depend on implementation, standards alignment and whether agencies can integrate those cryptographic controls without adding unmanageable complexity to already constrained AI governance programs.