Who Actually Enforces PQC Deadlines?

I track more than 150 dated PQC instruments and milestones across 24 jurisdictions, plus the G7, NATO and the main industry bodies. When I present this data to CISOs and security directors, the first question is always some variation of: “OK, but which of these actually matter? Which ones have teeth?”

It’s the right question. The word “deadline” appears throughout PQC policy documents, but it means very different things depending on who set it and what happens if you miss it. A CNSA 2.0 procurement gate and a G7 Cyber Expert Group roadmap both appear on the timeline. The first can lock you out of the US national security market. The second states in its own text that it sets no regulatory expectations.

As of 10 October 2026, I have found no publicly reported fine, examination finding, procurement rejection or public censure tied to a post-quantum requirement. Supervisory reviews and procurement files are not public, so that absence covers the public record only. The tiers describe the enforcement mechanisms that exist. The next visible test is the CNSA 2.0 acquisition gate on 1 January 2027.

The distinction between binding and advisory is not binary. PQC enforcement exists on a spectrum, and where a deadline falls on that spectrum should decide how you prioritize it. I’ve organized the 2026–2030 deadlines by date. This article organizes them by enforceability.

Tier 1: You Lose Market Access

These deadlines have immediate, measurable financial consequences. Miss them and you cannot sell into a defined market.

CNSA 2.0 Acquisition Gate (January 1, 2027). Under CNSSP 15, all new acquisitions for US National Security Systems must support CNSA 2.0 algorithms unless an exception is explicitly noted. The enforcement mechanism is procurement exclusion rather than a fine: a product that does not support CNSA 2.0 cannot be bought for NSS unless an exception applies. NSPM-12, signed on 12 June 2026, re-established the Committee on National Security Systems with binding directive authority over all NSS and named the NSA Director as National Manager, which strengthens the governance behind the gate. For vendors supplying NSS acquisitions and the companies in their supply chains, this is the most consequential PQC deadline in my dataset. I covered its implications in The 2027 Procurement Gate.

The open question is how strictly the government applies it. Exceptions exist where PQC-capable alternatives are not yet available. How broad they are in practice will decide whether January 2027 is a hard wall or a firm guideline, and the industry will know by mid-2027.

ANSSI’s Qualification Requirement (2027). On 16 June 2026, ANSSI announced a 2027 PQC requirement that press reports described as the end of certification for products without PQC. ANSSI’s own post-quantum page states the aim more narrowly: PQC obligations for products entering qualification from 2027. For buyers that require qualified products, the mechanism resembles the CNSA 2.0 gate; a product without PQC can still be sold in France to everyone else. I have not seen the implementing text, so the start date within 2027, the schemes covered and the product scope are still to be confirmed.

The EO 14412 Contractor Rule (December 31, 2030, once the rule exists). EO 14412 directs the FAR Council to publish, by 19 December 2026, a proposed rule requiring covered federal contractors to comply with NIST FIPS, including the PQC standards, by 31 December 2030. The order does not define “covered contractor,” and a proposed rule is not a final one. When the rule is final, PQC compliance becomes a condition of federal contracts, the widest market-access lever in the US.

EU Cyber Resilience Act (December 11, 2027). The CRA’s main obligations apply from 11 December 2027 to products with digital elements within its scope; products placed on the market before then come under them only if they are substantially modified afterwards. The regulation does not mention post-quantum cryptography and sets no PQC migration deadline. It requires in-scope products to be secure by design and to receive security updates across their support period, and an in-scope product that does not conform cannot carry the CE marking it needs for the EU market. In my analysis, a product that cannot change its cryptography will have trouble meeting the update obligation once quantum-vulnerable algorithms are treated as a known vulnerability; I set out the argument in the CRA and crypto-agility. For product manufacturers, this is market-access law comparable in reach to REACH or GDPR.

FIPS 140-2 Sunset (September 21, 2026). Not a PQC deadline, but a cryptographic module deadline that affects PQC planning. On 21 September 2026 the remaining FIPS 140-2 certificates moved to Historical. In my May version I wrote that this meant no federal sale without FIPS 140-3. CMVP’s actual language is softer: agencies “should not include” Historical modules in new acquisitions, and they can keep using them in existing systems subject to their own risk decisions. The market effect therefore runs through contracting officers’ decisions, and the FIPS 140-3 validation queue is the bigger constraint. EO 14412 orders NIST to revise CMVP processes to speed validations by 19 December 2026.

Tier 2: Regulatory Directives with Named Enforcement

These deadlines come from regulators with supervisory authority over the organizations they target. Non-compliance is not an abstract risk; it is a specific conversation with a specific supervisor.

Bank of Israel Directive 202501 (January 2026). Every Israeli banking corporation and licensed payment service provider had to submit a quantum preparedness plan to the Banking Supervision Department within a year of the 7 January 2025 letter. The submission target is named: the Head of the Technology, Innovation, and Cyber Division. The board of directors and management had to discuss the plan before submission. A bank that did not submit has a supervisory compliance gap in its record. The Bank of Israel has not reported what it received.

SAMA Circular 482021280 (December 31, 2026 and March 31, 2027). The Saudi Central Bank’s circular of 27 August 2026 requires licensed institutions to have accurate and comprehensive procedures for identifying and classifying all cryptographic assets by the end of 2026, and an enterprise quantum risk assessment with action plans by the end of March 2027. The circular sets no separate deadline for submitting anything to SAMA. Quantum risk becomes a standing item for each institution’s Information Security Supervisory Committee and, where one exists, the board’s Risk Committee, with challenges and recommendations reported to the board. The outputs are kept in the institution’s records for examiners to review.

Singapore CSA’s CII Milestones (March 31, 2027 onward). CSA’s Quantum-Safe Migration Handbook asks owners of Critical Information Infrastructure to submit a migration plan to CSA by 31 March 2027, to buy quantum-safe or quantum-safe-ready systems from 1 January 2028 and to complete migration by 31 December 2031. CSA is the CII regulator and calls these dates requirements. The handbook itself says it is not mandatory and uses “should,” and I have found no published legal instrument that carries the dates. I put it in Tier 2 because the regulator expects the plans to arrive on its desk.

FINMA Guidance 05/2026 (mid-2027). FINMA expects Swiss supervised institutions to draw up a PQC migration roadmap by mid-2027 at the latest, based on a quantum strategy approved by the board. The guidance is formally non-binding. In Swiss practice, a FINMA expectation that a supervisor has written down and dated is what examiners ask about.

Belgium’s Telecom Regulator (2027 onward). BIPT’s communication of 13 January 2026 tells Belgian telecom operators to inventory and assess quantum risk in 2027, validate migration plans in 2028 and complete migration of their most critical systems by 2030, with BIPT inspections of high-risk systems scheduled for 2031 to 2035. It uses mandatory language and presents itself as the baseline for future audits under telecom law and NIS2, without specifying sanctions.

EU DORA (effective January 2025). The Digital Operational Resilience Act does not mention PQC by name, but its ICT risk-management standard asks financial entities to monitor cryptographic threats, including threats from quantum advances. The ECB, the European Supervisory Authorities and national competent authorities supervise compliance. In September 2026 the ESAs’ joint risk update warned that quantum threats could materialize earlier than any viable commercial application, and the ECB has promised a separate quantum letter to the banks it supervises. The mechanism is supervisory examination, not a PQC-specific audit.

Two supervisors have announced 2030 aims without a binding instrument behind them. MAS said in July 2026 that supervisory expectations aimed at quantum resilience before the end of the decade would follow later in the year. The HKMA published a whitepaper and its new Quantum Preparedness Index in July 2026, scored Hong Kong banks at 2.3 out of 10 and aims for full sectoral readiness, a score of 10, by 2030. MAS will move into this tier when it publishes its expectations, and the HKMA when it turns the 2030 aim into a requirement for individual banks.

Tier 3: Binding Government Mandates with Audit Trails

These deadlines apply to government agencies and are tracked through internal government accountability mechanisms. They bind the government and reach the private sector through procurement.

EO 14412 (2030 and 2031). Every federal high-value asset and high-impact system outside National Security Systems must use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. The order is subject to appropriations and creates no enforceable right, so accountability runs through OMB, inspectors general and Congress.

OMB M-26-15 (October 22, 2026 onward). Agencies owe OMB and the National Cyber Director a PQC migration plan about 120 days after the 24 June 2026 memo, then work through five phases to 2035. M-26-15 functionally supersedes M-23-02 without formally rescinding it, and it requires cryptographic agility for all systems.

DoW PQC Strategy (2030 and 2031). All Department of War systems must support PQC or be phased out by the end of 2030 and use PQC by the end of 2031, “unless otherwise noted.” The phase-out is the consequence for a system that cannot support PQC by the end of 2030. The strategy as I read it sets no interim gates before then. The November 2025 DoW CIO memo supplies the inventory and approval machinery.

TLS 1.3 (January 2, 2030). EO 14144, as amended by EO 14306, requires agencies to support TLS 1.3 or a successor by 2 January 2030. M-26-15 restates it.

Canada’s Treasury Board SPIN (April 2026 onward). The SPIN is the mandatory instrument behind Canada’s federal migration for the organizations covered by the Policy on Government Security, for systems up to and including Protected B: departmental plans and annual reporting from 1 April 2026, Phase 2 and Phase 3 plan updates in 2027 and 2028, high-priority systems by the end of 2031 and the rest by the end of 2035. The Cyber Centre’s ITSM.40.001 is advisory on its own. Since 1 April 2026, every new federal contract with a digital component must carry PQC clauses drawn from ITSM.00.501, which is how the SPIN reaches vendors. For the consequences of non-compliance, the notice refers departments to the Treasury Board’s Framework for the Management of Compliance.

UAE National Encryption Policy. The executive regulation approved on 27 November 2025 binds government entities to officially approved PQC transition plans, automated cryptographic inventory and crypto-agility by design. The UAE Cybersecurity Council oversees compliance. No public deadline for the plans has been announced.

Netherlands and Brunei. The Dutch national quantum strategy of October 2026 sets central-government targets from the end of 2026 to 2035, phrased as aims and without new money. Brunei’s PQC Migration Framework, published in July 2026, applies as a requirement to government ministries, statutory bodies and designated CII owners, with indicative phasing: deployment by 2030 and classical algorithms disallowed in 2035.

The US audit trail in this tier has so far produced findings, and I have found no public record of consequences. M-23-02 asked US agencies for prioritized cryptographic inventories by May 2023, backed by the Quantum Computing Cybersecurity Preparedness Act. GAO’s October 2026 public report, based on an audit completed in September 2025, found that one of the 24 agencies it audited had a complete inventory, 22 had partial ones and one had none, and that no agency had tested PQC. I have seen no public report of an agency losing budget over it. EO 14412’s dates may fare better because they come with a named owner in every agency and a contractor rule.

Tier 4: Authoritative Guidance That Shapes Compliance

These deadlines are not statutory requirements, but they come from national cybersecurity authorities whose guidance defines what “reasonable” security practice looks like. Regulators, auditors and, in litigation, courts can refer to them when they assess whether an organization met its duty of care.

UK NCSC Three-Phase Timeline (2028 / 2031 / 2035). The NCSC has no statutory power over private-sector PQC migration, and its timeline says it is guidance. UK regulators, including the FCA, PRA, Ofcom and ICO, treat the NCSC as the authoritative source. An organization that suffers a breach and is found to have ignored the NCSC’s PQC timeline can expect hard questions from regulators and insurers.

Germany BSI TR-02102-1 (2030 / 2031 / 2035). Version 2026-01 of the technical guideline sets the first fixed end dates for classical public-key cryptography used on its own: the end of 2030 for the most sensitive applications, the end of 2031 for key agreement in general, and a planned end for classical signatures by 2035. TR-02102 is formally a recommendation. Many German organizations treat it as binding, it shapes KRITIS audits and certification outcomes, and it is binding for products that handle classified information. This replaces the “2030 for KRITIS, 2032 for everyone else” dates in my May version. BSI’s October 2026 advice against new Classic McEliece deployments shows how quickly the guideline’s algorithm list can change.

France ANSSI PQC Position (hybrid). ANSSI’s position papers strongly recommend hybrid PQC for products that protect data beyond 2030. Separately from the 2027 qualification requirement in Tier 1, they define what ANSSI’s evaluators expect to see.

Australia ASD (2026 / 2028 / 2030). ASD’s guidance asks for a refined plan by the end of 2026, a started transition by the end of 2028 and a completed one by the end of 2030, and recommends ceasing traditional asymmetric cryptography by then. ASD acknowledges that its 2030 target includes contingencies and that organizations should allow for internal delays. For Australian finance the ASD dates already work as a supervisory expectation: APRA told regulated financial entities in June 2026 that boards should show progress against the ASD timeline and that it will step up supervisory engagement over the coming year.

EU NIS Cooperation Group Roadmap (2026 / 2030 / 2035). Coordinated policy milestones, not directly binding regulation. The Commission’s January 2026 proposal to amend NIS2 would require every national cybersecurity strategy to include policies for the PQC transition. If it is adopted, the amendment would strengthen the link between national PQC strategies and the EU transition milestones; enforceable duties would depend on the final text and on national implementation. Separately, the ECCG’s Agreed Cryptographic Mechanisms v2, the cryptographic reference for EUCC evaluations, say lattice-based PQC should not be used in a standalone way, while hash-based signatures may be. The protection profile and security target of a given product decide what that product must implement.

Other national guidance. The Netherlands’ central-government targets, the Swedish NCSC’s 2030 and 2035 recommendations, the Czech NÚKIB’s cryptographic requirements annex (which obliged entities must take into account), Japan’s 2035 target, South Korea’s 2035 plan and India’s quantum-safe roadmap all sit here. India’s roadmap says outright that it does not constitute a legal or regulatory mandate; its enforcement depends on sectoral regulators such as the RBI, which set up an expert committee on quantum security in May 2026.

Tier 5: Advisory and Industry Frameworks

These carry influence but have no enforcement mechanism of their own. They shape expectations and create soft pressure through industry norms and peer benchmarking.

G7 Cyber Expert Group Roadmap (January 2026). The financial-sector roadmap is advisory and says so. G7 members implement it through their own financial regulators, at their own pace. Its 2030–32 horizon for the most critical systems is illustrative.

G7 Call to Action (September 2026). The G7 Cybersecurity Working Group’s call to action asks every sector to start migrating as soon as possible. It sets no deadline, but it contains the sharpest sentence any G7 body has written on the subject: organizations that delay “may lose competitive advantage or may be excluded from contracting opportunities, including public procurement.”

BIS / FS-ISAC / Europol / HKMA Index / Malaysia / NATO. The BIS quantum-readiness roadmap, FS-ISAC’s timeline paper, Europol’s prioritization framework, the HKMA Quantum Preparedness Index as a diagnostic, Malaysia’s NACSA roadmap and NATO’s quantum roadmap influence practice without mandating it. Taiwan’s Financial Supervisory Commission added reference guidelines in June 2026 with a recommended 2035 completion date and stated that no immediate change is required.

How Guidance Becomes Binding

The five-tier model oversimplifies one dynamic: soft guidance hardens into binding expectation through four channels that operate independently of legislation.

The procurement channel. Buyers turn guidance into contract terms. Canada has required PQC clauses in new federal contracts since April 2026. The EO 14412 FAR rule will do the same for US federal contractors. Singapore’s CII owners are expected to buy quantum-safe systems from 2028, Dutch central government wants quantum-safe requirements in its tenders by the end of 2028, and ANSSI says it will not be reasonable to buy products without PQC after 2030. The G7’s procurement warning describes where this channel leads.

The insurance channel. I expect cyber insurers to add quantum risk to underwriting questionnaires. Once an insurer asks “Have you assessed your exposure to quantum computing threats?” and the CISO says no, the answer becomes a risk factor in coverage terms. NCSC and BSI guidance are the obvious benchmarks for what counts as reasonable preparation.

The supply chain channel. Large banks, defense primes and government agencies are inserting PQC readiness requirements into vendor assessment questionnaires and contract clauses. SAMA’s circular asks Saudi institutions to identify third-party dependencies, and India’s non-binding roadmap makes vendor CBOMs mandatory from fiscal year 2027–28. A mid-sized software company with no regulatory obligation of its own can find that its largest banking client now requires a PQC migration plan as a condition of renewal. The enforcement mechanism is commercial, and the financial consequence is the same as a regulatory one.

The liability channel. After a breach, regulators and, in litigation, courts ask whether the organization followed recognized security practice. Published guidance from NCSC, BSI, ANSSI, ASD and NIST is the obvious reference for what that means in cryptography. How much weight it carries, and who has to explain a departure from it, depends on the jurisdiction.

How to Use This

For migration program prioritization, match your deadlines to their enforcement tier:

If you face Tier 1 deadlines (market access): These govern your program’s first milestone. CNSA 2.0 compliance for January 2027 and ANSSI qualification in 2027 are things you either have or do not have. CRA compliance is a product-architecture decision that has to be made in the current design cycle, and US federal contractors should read the FAR proposed rule as soon as it appears in December 2026.

If you face Tier 2 deadlines (regulatory directives): Build the deliverables into your governance calendar. SAMA’s procedures are due in under three months; Singapore’s CII plans and FINMA’s roadmaps follow in the first half of 2027. Board-approved plans, supervisory submissions and audit-ready documentation take months to prepare, so count back from the due date.

If you face Tier 3 deadlines (government mandates): These affect your government business directly and your commercial business through procurement. Track the reporting cycle, and expect the October 2026 M-26-15 plans and the 2027 CBOM guidance to shape what federal buyers ask vendors for.

If you face only Tier 4 or 5 deadlines: You have more flexibility on timing, but less than you think. The procurement, insurance, supply chain and liability channels are already turning guidance into expectation. Starting your PQC program before your first client asks about it is cheaper and less disruptive than starting after.

Every organization faces at least Tier 4 or 5 pressure. The question is whether you also face Tier 1, 2 or 3 deadlines. The Global PQC Migration Timeline maps every deadline to its jurisdiction, and the PQC Readiness Self-Assessment Scorecard helps you evaluate where you stand. Start with enforcement, then work outward.

From the author