THE REGULATORY CLOCK IS RUNNING
Deadlines are coming. Your release cycle is not faster.
The agencies have published their timelines, and the first penalties have already been issued. Every date below links to its primary source.
NIST publishes FIPS 203, 204 and 205
The post-quantum standards are final. The argument that the industry is waiting for a standard no longer exists.
Primary source ↗NIS2 and DORA liability
NIS2 had to be transposed by 17 October 2024 and enforcement has already begun in Germany, the Netherlands and France; DORA has applied since 17 January 2025. Essential entities face up to EUR 10M or 2% of global turnover, whichever is higher.
Primary source ↗NIST finalizes its PQC transition report
NIST IR 8547 is final. It names the quantum-vulnerable algorithms in NIST standards, deprecates them after 2030 and disallows them after 2035, and supports the accelerated federal deadlines of 2030 for key establishment and 2031 for signatures.
Primary source ↗EU — national roadmaps and pilots
Every Member State is expected to have a national post-quantum transition roadmap and pilots running for high and medium-risk use cases. This is the next real deadline, and it is European.
Primary source ↗CNSA 2.0 — acquisitions
Every new acquisition of National Security Systems equipment must be CNSA 2.0 compliant by default. Support and preference for CNSA 2.0 come first, by dates that vary from 2025 to 2030 with the category of equipment; exclusive use follows later.
Primary source ↗Where the timelines converge
NIST IR 8547, final since October 2026, deprecates all quantum-vulnerable public-key cryptography after 2030 and disallows it after 2035; the EU expects high-risk use cases migrated by the end of 2030, medium-risk ones by the end of 2035, and low-risk ones as far as feasible by 2035; CNSA 2.0 requires exclusive use in software signing and networking by 2030, and in browsers, servers, cloud and operating systems by 2033.
Primary source ↗The threat is already in motion
Your encrypted data is already stolen.
Adversaries collect TLS traffic today. They decrypt it the moment they have a quantum computer. Your deal flow, patient records, and infrastructure comms are already at risk.
NIST deprecates
all quantum-vulnerable public-key cryptography (RSA, ECDSA, EdDSA, DH and ECDH), and disallows it after 2035.
US federal deadline
for high-value and high-impact federal systems to adopt PQC for key establishment; 31 Dec 2031 for digital signatures.
data categories at risk
PHI, PII and NPI — all regulated, all collectible today, all decryptable at Q-Day.
Sources: NIST IR 8547 (final, October 2026) · Executive Order 14412 · OMB M-26-15
NIST deprecates quantum-vulnerable public-key cryptography after 2030 and disallows it after 2035.
Data captured today can be decrypted when a CRQC is available.
One Control Plane across regulator changes, algorithm waves, and the full lifespan of your data.
Data encrypted today with classical algorithms may be harvested now and decrypted when a cryptographically-relevant quantum computer becomes available.
WHY ANKATECH
Three things that change everything about your crypto stack.
Zero-code migration. Cryptographic governance with evidence. 14+ international standards in one platform. These are the capabilities that make ANKASecure© different
Drop-in Migration
Swap RSA / ECC for NIST-standardised post-quantum primitives without rewriting your applications.
Cryptographic governance
Change this policy. Watch every operation migrate. Zero code changes.
Global Standards Coverage
14+ international standards. One platform.
Quantum is not the only clock
Five changes in four years. Not one needed a quantum computer.
Rainbow and SIKE fell to classical attacks, HAWK was withdrawn after an AI-assisted analysis, Classic McEliece stopped being acceptable for new use, and a 2007 RSA forgery technique became practice against a real HSM. Post-quantum migration prepares you for the transition everyone can see coming; crypto-agility prepares you for the ones nobody can predict.
Where to start
Read more