02 Deadlines

The deadlines are already set

These are not just predictions. In the US and the EU, institutions have published guidance and requirements with set dates for replacing vulnerable cryptography.

1. 13 August 2024

   NIST publishes the new standards

   The US standards institute publishes three new standards: FIPS 203 (ML-KEM), to establish the keys used to encrypt data, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), for digital signatures. Alternatives to today's algorithms are therefore available.

2. November 2024

   NIST proposes deadlines for retiring today's algorithms

   In the initial public draft of NIST IR 8547, all quantum-vulnerable public-key algorithms, including P-256, are listed as disallowed after 2035.

3. 22 June 2026

   Executive Order 14412

   The order addresses the risk known as “harvest now, decrypt later”. For high-value assets and high-impact systems, it sets 31 December 2030 as the deadline for post-quantum key establishment and 31 December 2031 for digital signatures.

4. 24 June 2026

   OMB M-26-15: a phased federal migration

   Federal agencies must build an automated inventory whose data “should populate a central Cryptographic Bill of Materials” (CBOM). Agency plans are due by 22 October 2026. The migration runs in five phases, from 2026 to 2035.

5. About December 2026

   A proposed rule for federal contractors

   EO 14412 gives the FAR Council 180 days, until about 19 December 2026, to propose a rule under the Federal Acquisition Regulation (FAR). The rule would require covered contractors to comply by 31 December 2030 with NIST's FIPS standards, including those based on post-quantum algorithms.

6. About March 2027

   Guidance on what a CBOM should contain

   Within 270 days of EO 14412, around March 2027, CISA, in coordination with NIST, is due to publish guidance on the minimum elements a CBOM should include.

7. 2030 to 2035

   The migration deadlines

   Under EO 14412, post-quantum key establishment must be adopted by 31 December 2030, and digital signatures by 31 December 2031, on high-value assets and high-impact systems. If the FAR rule the order calls for is adopted, covered contractors must comply by 31 December 2030. NSA CNSA 2.0 sets exclusive-use dates between 2030 and 2033, depending on the category. In the EU, the NIS Cooperation Group roadmap of 23 June 2025, a recommendation, asks member states to set national strategies by the end of 2026, address high-risk use cases by the end of 2030 and migrate as many systems as feasible by 2035.

Sources: EO 14412; EO 14412 in the Federal Register; OMB M-26-15; NIST IR 8547; CISA Post-Quantum Cryptography Initiative; NSA CNSA 2.0; NIST FIPS 203; EU NIS Cooperation Group roadmap.