On June 22, 2026, President Trump signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," setting a December 31, 2030 deadline for federal agencies to transition their most sensitive systems to post-quantum encryption and a December 31, 2031 deadline for post-quantum digital signatures and authentication. The EO also directs federal contractors to comply with post-quantum Federal Information Processing Standards (FIPS) by the end of 2030. The order splits the PQC migration into two phases: post-quantum key establishment (encryption) via NIST standards FIPS 203 and FIPS 204 by 2030, and post-quantum digital signatures via FIPS 205 by 2031, reflecting the availability of post-quantum encryption protocols across the Internet today.
The EO updates earlier NIST guidance from 2024, which stated that classical public-key cryptography (RSA and Elliptic Curve Cryptography) should be deprecated by 2030 and disallowed by 2035. A key driver of urgency: the "harvest now, decrypt later" threat, where adversaries intercept and stockpile encrypted data today, waiting for quantum computers to break it. Over two-thirds of browser traffic to Cloudflare's network is already protected with post-quantum encryption. NIST's CMVP will move all remaining FIPS 140-2 validated certificates to Historical on September 21, 2026, meaning only FIPS 140-3 validated modules qualify for federal procurement going forward—but the FIPS 140-3 validation process averages over 500 days, creating bottleneck for quantum-safe vendors.
For practitioners, federal contractor requirements in the FAR Council represent the highest-impact component; they will cascade throughout supply chains. Organizations must now treat post-quantum cryptography not as a future-gazing research project but as present-day operational risk. Immediate actions: inventory all systems handling data with 10+ year confidentiality requirements, prioritize migration of critical infrastructure, and evaluate vendors for FIPS 140-3 validated PQC implementations. The 2030-2031 deadlines are real and inflexible for government systems; private sector follows closely behind as they lose federal contracts for non-compliance. Vendors shipping hybrid PQC (classical + post-quantum together) are the near-term market winners.