Published: October 14, 2026 | Category: Technology | By Mahesh

Nine days from now, on October 22, 2026, every US federal civilian agency owes the Office of Management and Budget a written plan for post-quantum cryptography migration.^[1] The requirement comes from Memorandum M-26-15, issued two days after Executive Order 14412 set the first dated federal cutoffs: December 31, 2030 for quantum-safe key establishment and December 31, 2031 for quantum-safe digital signatures on the highest-value systems.^[2] A topic that spent a decade in research papers now has calendar dates, procurement gates and named agencies attached to it.

Readers of our earlier work on quantum computing moving into business and on cybersecurity priorities for startups and established firms will recognize the pattern. A technology risk stays abstract until a regulator turns it into a contract clause. This analysis maps the dates that now bind in the US, the EU, France and India, prices exposure by data class with a simple inequality and sets out a sequence that operators can follow through 2030.

Why Is Post-Quantum Cryptography Migration Now a Dated Obligation?

Post-quantum cryptography migration became a dated obligation in 2026 because governments attached deadlines and procurement rules to it. The US set 2030 and 2031 cutoffs for federal systems, France will stop certifying non-quantum-safe products from 2027 and the EU expects high-risk systems to finish by 2030. RSA and elliptic-curve algorithms are the targets.

Public-key cryptography secures the handshake behind every HTTPS connection and the signature on every software update. RSA, Diffie-Hellman and elliptic-curve schemes all fall to Shor's algorithm once a fault-tolerant quantum computer of sufficient size exists. Symmetric ciphers and hash functions only weaken under Grover's algorithm, so properly implemented AES-256 encryption at rest sits low on the replacement list.^[3] The urgent targets are session establishment in TLS, SSH and IPsec, certificates that outlive the early 2030s and every function that depends on a digital signature.

Regulators moved in 2026 because the estimated cost of the attack fell. Google researchers published a preprint in May 2025 showing that a 2,048-bit RSA key could be factored in under a week with about one million noisy qubits, a 20-fold drop from the team's earlier figure of 20 million.^[13] A 2026 follow-up cut the logical-qubit requirement for the P-256 elliptic curve to roughly 1,100.^[13] On March 25, 2026, Google set 2029 as its own deadline to finish migrating its infrastructure; in April Cloudflare moved its target for full post-quantum security to the same year.^[6][7]

Neither company says a cryptographically relevant quantum computer will exist in 2029. Google describes the date as a response to migration needs; the commentary around the announcement stresses that the company is setting a planning target. Boards should read the date as a planning input. Migration takes years, so the useful comparison sets the time a system needs to change against the time its data must stay secret. The attack that makes that comparison urgent is harvest now, decrypt later: an adversary records encrypted traffic today and waits for the hardware to catch up.

Which Post-Quantum Deadlines Are Binding in 2026?

The National Institute of Standards and Technology finalized its first three post-quantum standards in August 2024. FIPS 203 (ML-KEM) covers key establishment, FIPS 204 (ML-DSA) covers signatures and FIPS 205 (SLH-DSA) is a hash-based signature scheme kept as a structurally different backup.^[3] NIST's draft transition guidance, IR 8547, says RSA and elliptic-curve cryptography at 112-bit security should be deprecated by 2030 and disallowed by 2035.^[3] Every national timeline since then borrows the 2035 end date and adds earlier gates for the systems that matter most.

Jurisdiction	Instrument	Hard dates	Who must comply	Legal force
US federal civilian	EO 14412 and OMB M-26-15	Plans Oct 22, 2026; key establishment Dec 31, 2030; signatures Dec 31, 2031; remaining systems 2035	Agencies for high-value and high-impact systems; contractors through FAR rulemaking	Binding on agencies
US national security	NSA CNSA 2.0	New acquisitions from Jan 1, 2027; full enforcement 2030 to 2033	Vendors of national security systems	Binding
European Union	Coordinated roadmap, June 2025	National plans end 2026; high-risk systems end 2030; the rest by 2035	Member states and their operators	Coordinated guidance
France	ANSSI certification policy	Certification halt from 2027; buy only quantum-safe products by 2030	Vendors selling to government and critical infrastructure	Binding through certification
India	DST Task Force roadmap, May 2026	Testing labs by Dec 2026; critical sectors 2027 foundation, 2028 priority migration, 2029 completion	Government, defence, power, telecom, transport and finance	No sector directive yet

The European Commission roadmap, developed by member states in the NIS Cooperation Group, asks for national transition plans and first pilots by the end of 2026, completion for high-risk use cases by the end of 2030 and medium-risk and low-risk systems by 2035 as far as practicable.^[4] Hybrid constructions that pair a classical algorithm with a post-quantum one are encouraged during the transition. The UK's National Cyber Security Centre publishes a parallel path with milestones in 2028, 2031 and 2035.^[11]

The United States moved from guidance to rule in June 2026. EO 14412 covers high-value assets and high-impact systems, while M-26-15 sets a five-phase schedule that keeps 2035 for the remaining civilian estate.^[1][2] National security systems sit on a separate NSA track under CNSA 2.0.^[12] The order also directs the FAR Council to propose rules requiring covered contractors to comply with post-quantum FIPS standards by the end of 2030, which is the mechanism that carries a federal deadline into private vendors.^[7]

France went further on timing. On June 16, 2026, the cybersecurity agency ANSSI told the France Quantum conference that it will stop certifying security products without quantum-resistant encryption from 2027, according to Reuters.^[5] ANSSI approval is required to sell into French government agencies and critical infrastructure, so the announcement works as a market gate. A multinational vendor now faces a French certification gate and an NSA procurement gate in 2027, a US contractor target in 2030, federal signature deadlines in 2031 and a shared 2035 floor. The sensible internal plan uses the earliest date that binds any customer.

How Do You Price Quantum Exposure by Data Class?

Quantum exposure is priced with the Mosca inequality. A data class is at risk when the years it must stay secret (X) plus the years needed to migrate its systems (Y) exceed the years until a cryptographically relevant quantum computer exists (Z). When X plus Y is larger than Z, traffic harvested today can be decrypted while it still matters.

The inequality is named for the Waterloo cryptographer Michele Mosca and gives security teams a way to rank work without agreeing on a single Q-Day forecast. Counting from late 2026, three scenarios bracket the debate. A 2029 arrival (Z of 3 years) matches the planning dates Google and Cloudflare chose. A 2031 arrival (Z of 5 years) matches the year the US executive order sets for signatures, which Cloudflare reads as a sign that the government sees a real chance of a working machine around then.^[7] A 2035 arrival (Z of 9 years) matches the NIST disallowance date.

The table applies the inequality to seven common data classes. The shelf-life and migration figures are Depth Grid working assumptions for a mid-size enterprise, offered as a starting template. They are not survey results; any organization should replace them with its own retention schedule and engineering estimates.

Data class	Secrecy life X (yrs)	Migration time Y (yrs)	X plus Y	Exposed if quantum arrives in
Public web sessions	0	2	2	No scenario
Internal service tokens and VPN tunnels	1	3	4	2029 only
Software update signing keys	3	4	7	2029 and 2031
M&A files and trade secrets	7	3	10	2029, 2031 and 2035
Payment and banking records	10	4	14	2029, 2031 and 2035
Field-device firmware signing	15	5	20	2029, 2031 and 2035
Patient and citizen records	30	5	35	2029, 2031 and 2035

Two patterns stand out. Public web sessions pass in every scenario because their data loses value within minutes and the major browsers and edge networks already negotiate post-quantum key exchange. Internal service tokens fail only under the aggressive 2029 case; they fail because migrating private networks takes three years in this template. The only variable an organization controls is Y, which is why a faster migration program changes the verdict on the middle rows of the table.

The bottom four rows fail under every scenario, including the relaxed 2035 case. Banks that must retain records for a decade, hospitals that keep charts for a patient's lifetime and device makers whose firmware is verified for fifteen years cannot wait for a consensus date. For these classes the practical move is to cut Y as hard as possible and to ship hybrid key exchange first. The segment of the market covered in our analysis of fintech and payments sits squarely in this group, since payment records carry long retention rules and heavy regulatory scrutiny.

Why Is Post-Quantum Authentication Harder Than Encryption?

Post-quantum authentication is harder because signatures and public keys grow far larger and the dependency chain is longer. An ML-DSA-65 signature is 3,309 bytes against about 64 bytes for ECDSA P-256. Replacing certificates also requires coordinated changes across clients, servers, certificate authorities, transparency logs, root stores and browsers.

Encryption is further along. Cloudflare reports that over two-thirds of browser traffic to its network already uses post-quantum key agreement; most of its products support it.^[7] The TLS community converged on a single hybrid scheme, X25519MLKEM768; deployment followed within a few years. Authentication has barely started. The same Cloudflare analysis notes that only limited ecosystem deployment exists so far and that the work spans clients, servers, certificate authorities, certificate transparency logs, root stores and browsers.

Component	Classical (bytes)	NIST post-quantum (bytes)	Growth
Client key share (X25519 vs ML-KEM-768 key)	32	1,184	37x
Server key share (X25519 vs ML-KEM-768 ciphertext)	32	1,088	34x
Signer public key (ECDSA P-256 vs ML-DSA-65)	64	1,952	30.5x
Signature (ECDSA P-256 vs ML-DSA-65)	64	3,309	51.7x

A TLS handshake carries a certificate chain with several signatures and several public keys, so these multiples compound. Cloudflare is working with Google Chrome on Merkle Tree Certificates to keep short-lived connections fast; the IETF's PLANTS working group is drafting post-quantum certificate profiles for TLS.^[7] Google's March announcement shifted its own threat model to put authentication services first; it recommends that other engineering teams do the same.^[6] The logic is simple: a forged signature on a root certificate or a code-signing key damages every party that trusts it; replacing a root takes years.

The US order gives the ecosystem exactly one year between the encryption deadline and the signature deadline. Cloudflare argues that the two programs cannot run in sequence and must start together if agencies are to meet 2031.^[7] It also warns that the order never defines what it means to transition. A system that supports ML-KEM but still accepts a classical-only handshake remains open to downgrade attacks, the same failure that kept SSLv3 alive for years after its flaws were public. A credible definition of done includes switching the quantum-vulnerable options off.

Which Product Categories Can Meet Post-Quantum Procurement Rules?

The Cybersecurity and Infrastructure Security Agency published a list of product categories that separates technologies where post-quantum support is widely available from those still transitioning.^[10] The available group includes cloud infrastructure and platform services, web browsers and servers, chat and messaging software and full-disk encryption in endpoint security products. For these, CISA's guidance tells buyers to procure only post-quantum-capable products. The transitioning group is where the work remains: networking hardware such as routers, firewalls and switches, identity and access systems including hardware security modules, certificate authorities and identity providers, email servers and clients and database systems.

The split tells a buyer where money will go. Software that ships through a cloud provider or a browser vendor upgrades on the vendor's schedule at little or no extra cost; Cloudflare says it ships every post-quantum upgrade to all plans at no additional charge.^[7] Hardware and identity infrastructure behave differently. A hardware security module holds keys inside certified silicon, a firewall runs firmware that vendors validate before release and a certificate authority is a long chain of audited processes. Each of these needs a vendor roadmap, a validation cycle and a maintenance window.

Two corollaries follow for infrastructure teams. Companies that pulled workloads onto owned servers, a trend covered in our report on the great cloud repatriation, take on the firmware and key-management refresh that a public cloud would otherwise absorb. The second corollary concerns chip supply: refresh cycles for cryptographic accelerators and secure elements depend on the silicon roadmaps discussed in our look at the global semiconductor race; devices whose cryptography is fixed in hardware cannot be patched at all.

What Does the $7.1 Billion Federal Estimate Imply for Private Budgets?

The only government-wide price tag comes from OMB's July 2024 report to Congress. It estimates that migrating prioritized federal civilian systems will cost about $7.1 billion in 2024 dollars between 2025 and 2035.^[9] Spread across eleven years that is roughly $645 million per year. OMB called the figure a rough order of magnitude; it excludes national security systems. It also states that replacing equipment unable to support new algorithms accounts for a significant share of the total.

Two inferences are reasonable; both are Depth Grid's reading and OMB does not make them. First, the estimate predates the 2030 and 2031 cutoffs in EO 14412, which compress the work for the highest-value systems into roughly half the original window. Compression usually raises cost because replacement cannot be scheduled into normal hardware refresh cycles. Second, the dominant line item is hardware that cannot be updated, so private organizations with long-lived embedded estates should expect the same pattern: money goes to equipment, with software changes a smaller share.

For operators the useful budgeting move is to separate three buckets. Components that vendors upgrade automatically cost mostly staff time to verify. Components that need replacement belong in the normal capital plan; bringing the replacement forward by a year or two can avoid an emergency purchase later. Internally built systems carry the highest engineering cost because nobody else will migrate them. Startups that sell into regulated buyers should price this into product roadmaps now, since a buyer's procurement questionnaire will ask for a post-quantum plan well before a regulation forces the issue. Our review of startup funding across India, the US and Europe shows how tight early-stage budgets are, which makes sequencing decisions matter more.

Where Does India's Quantum-Safe Roadmap Stand on Enforcement?

India's Department of Science and Technology published a task force draft in February 2026 and a final roadmap titled Quantum-Safe Ecosystem in India in May.^[8] The task force, chaired by the head of C-DOT with a co-chair from IIT Kanpur, recommends a tiered calendar for critical information infrastructure: foundations by 2027, high-priority migration by 2028 and full post-quantum cryptography by 2029. It proposes a national testing and certification programme with the first labs operating by December 2026. It also says a cryptographically relevant machine could arrive within three years, a more urgent view than the 2035 horizon in Western guidance.

The roadmap covers government, defence, power, telecom, transport and the finance sector. It asks sector regulators such as the Reserve Bank of India and SEBI to write binding rules. It leans on software migration to NIST algorithms and largely sets aside quantum key distribution on cost grounds, which matches the position Cloudflare takes about Internet-scale deployment. A final addition is a set of preferential market access provisions intended to favour indigenous quantum-safe products; the plan includes a national list of cryptography-dependent product categories modelled on CISA's list, with mobile phones and automated discovery tools added.

The gap is enforcement. An analysis published by PostQuantum.com in mid-May 2026 found no evidence that the RBI, SEBI, the telecom regulator or the power regulator had issued binding directives that reference the roadmap. Until they do, the Indian timeline works as guidance for domestic firms; its practical bite comes through two channels: export customers who demand US or EU compliance and large public procurement. Indian IT services firms and fintech startups serving European and American banks already meet the earlier of those deadlines through their clients, so waiting for a local mandate would put them behind their own customers.

What Could Make the Timeline Wrong?

Three assumptions deserve scrutiny. The first is the hardware forecast. Resource estimates have fallen sharply, yet no machine has factored a cryptographically relevant number; error-corrected systems at the required scale remain unbuilt. Commentary in The Hindu on the Indian roadmap notes that the mainstream view still puts both Q-Day and the migration at a decade or more; that migration should continue even if Q-Day slips. That argument supports the program, because a delay in the threat does not shorten a dependency chain that already runs through every vendor.

The second is tooling maturity. CISA's own categories show networking gear, identity systems and databases still transitioning, so an organization chasing a 2027 procurement gate may find a thin vendor market. Early products will ship hybrid modes that pair a classical and a post-quantum algorithm. That is safer against implementation bugs in young code, yet it doubles the surface area to test and keeps classical algorithms alive longer than the final end state requires.

The third is regulatory fragmentation. If jurisdictions mandate different algorithms the result is extra code, more downgrade paths and slower deployment, a failure Cloudflare says it watched happen in IPsec when vendors shipped incompatible proprietary key agreement schemes.^[7] The losers in any of these outcomes are predictable: vendors with no roadmap, owners of hardware with fixed cryptography and small firms that lack the staff to run a multi-year program. The winners are teams that built the ability to swap algorithms by configuration, which the industry calls cryptographic agility.

What Should Operators Do Between Now and 2030?

The sequence below combines the deadline map, the exposure table and the product-category split. It assumes a mid-size company with customers in more than one jurisdiction and applies the earliest binding date that touches any of them.

1. Next 90 days: switch on post-quantum key agreement at every public edge you control, whether through a content network, a load balancer or an operating-system update. Public traffic is the easiest for an adversary to harvest and the cheapest to protect.
2. Next 6 months: build a quantum impact inventory ranked by the Mosca inequality. List each system, the data it protects, how long that data must stay secret and how long a migration would take. Cloudflare argues this ranking beats an exhaustive cryptographic bill of materials as a first step; the US order separately tells CISA and NIST to publish minimum bill-of-materials elements within 270 days.^[7]
3. By mid-2027: add post-quantum clauses to vendor contracts and security questionnaires. Ask each supplier for a roadmap covering key establishment, signatures and the removal of classical-only fallbacks; ask whether post-quantum support carries an extra fee.
4. 2027 to 2028: map long-lived keys, root certificates and code-signing infrastructure, then automate certificate issuance so that a future algorithm swap is a configuration change. This is the work that decides whether the 2031 signature date is reachable.
5. 2028 to 2029: replace or isolate equipment whose cryptography is fixed in hardware, starting with the data classes that failed every scenario in the exposure table. Tunnel traffic from devices that cannot be patched through post-quantum protected links in the meantime.
6. By 2030: disable classical-only negotiation on systems that have completed migration, report progress to the board and keep a standing process for the next algorithm change. Cyber insurers and plaintiffs' lawyers are likely to treat the federal timeline as a reference for reasonable care.

Regional emphasis differs. US contractors should watch the FAR rulemaking that carries the 2030 target into contracts. European firms and anyone selling into French public bodies should treat 2027 as the working deadline. Indian operators have the most time on paper and the most to gain from moving early, because export customers will ask for evidence regardless of domestic rules. Across all three regions the first step costs little and the later steps depend on it.

Common Questions

Sources

1. Office of Management and Budget, "M-26-15: Execution of the Migration to Post-Quantum Cryptography," June 24, 2026. whitehouse.gov
2. The White House, "Securing the Nation Against Advanced Cryptographic Attacks," Executive Order 14412, June 22, 2026. whitehouse.gov
3. NIST, Post-Quantum Cryptography project: FIPS 203, FIPS 204, FIPS 205 and IR 8547 (initial public draft). csrc.nist.gov
4. European Commission and NIS Cooperation Group, "A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography," June 2025. digital-strategy.ec.europa.eu
5. Reuters, "France to stop certifying products without quantum-safe encryption," June 16, 2026. reuters.com
6. Google, "Quantum frontiers may be closer than they appear," March 25, 2026. blog.google
7. Cloudflare, "The White House's post-quantum executive order is an important milestone," June 23, 2026. blog.cloudflare.com
8. Department of Science and Technology, Government of India, "Quantum-Safe Ecosystem in India: Roadmap to Quantum Resiliency," May 2026. dst.gov.in
9. Office of Management and Budget, "Report on Post-Quantum Cryptography," July 2024, submitted under the Quantum Computing Cybersecurity Preparedness Act. whitehouse.gov/omb
10. CISA, "Product Categories for Technologies That Use Post-Quantum Cryptography Standards." cisa.gov
11. UK National Cyber Security Centre, "Next steps in preparing for post-quantum cryptography." ncsc.gov.uk
12. National Security Agency, "Commercial National Security Algorithm Suite 2.0 Algorithms." media.defense.gov
13. Google Quantum AI and Google Research, resource estimates for factoring RSA-2048 (preprint, May 2025) and for elliptic-curve discrete logarithms (2026). research.google

Related Analysis

• Quantum Computing Is Moving to Business in 2026
• Cybersecurity in 2026: What Every Startup and Business Must Know
• The Great Cloud Repatriation of 2026
• The Global Semiconductor Race in 2026
• Fintech in 2026: How Technology Is Permanently Rewiring Banking and Payments

Article by Mahesh | Depth Grid