The answer, up front
Post-quantum cryptography (PQC) is the set of new encryption and digital signature methods built to resist both classical and quantum computers 1. NIST published the first three standards in August 2024 3, 4, 5. You do not need the mathematics. You need an owner, a funded inventory, and clear answers to five questions.
This is the leadership primer. For the technical detail, read Post-Quantum Cryptography Explained.
Last verified: Sep. 30, 2026.
What PQC means for a non-technical reader
Encryption keeps data unreadable to anyone without the right key. Much of today's public-key encryption relies on math problems that classical computers cannot solve at practical speed.
A large quantum computer running Shor's algorithm could factor integers and compute discrete logarithms in polynomial time 8. That would break RSA, Diffie-Hellman and elliptic-curve cryptography, which OMB lists as quantum-vulnerable 2.
OMB also states that such a machine is not yet known to exist, though steady advances may yield one in the coming decade 2. PQC replaces the vulnerable methods before that point. It runs as ordinary software and firmware, so you do not need quantum hardware.
Why the timeline creates urgency
If the machine does not exist yet, why move now? Two reasons.
Attackers can collect data today. The June 2026 executive order names the risk: adversaries may collect information now and decrypt it once large-scale quantum computers exist 1. Security teams call this harvest now, decrypt later. Harvest Now, Decrypt Later shows how to test your own data against it.
Migration takes years. Cryptography sits in network protocols, identity systems, certificates, hardware and vendor products. The UK NCSC expects large organizations to need two to three years for discovery and planning, then two to three more for early migration 6.
Here is an illustrative example, not a forecast. Suppose a trade secret must stay confidential for 25 years. An adversary who copies it today and decrypts it in seven years has still won. The value of the data outlasts the protection. Your own numbers will differ, but the logic holds.
What regulators have set
Most dates target government systems, and they show the pace regulators consider reasonable.
| Source | What it says |
|---|---|
| NIST | Published FIPS 203, 204 and 205 in August 2024 3, 4, 5 |
| Executive Order 14412 | U.S. federal high-value assets and high-impact systems use PQC for key establishment by Dec. 31, 2030. It also directs a proposed rule for federal contractors, with compliance by Dec. 31, 2030 1 |
| OMB M-26-15 | Sets phases that begin with discovery and inventory in 2026 to 2027 2 |
| EU coordinated roadmap | Recommends high-risk use cases finish by the end of 2030, with the rest by the end of 2035. It is not a regulation 7 |
Private-sector rules may follow, but no source in this article says so. Your exposure may arrive through customers or contracts first. Global Mandates and Deadlines compares every jurisdiction.
What this means for executives and the board
PQC is a risk and planning topic before it is a technology topic. ArcQubit guidance: treat it like any long-lead infrastructure program.
- Risk exposure. It depends on how long your data must stay confidential and where it lives. Long-lived records such as health files, contracts and source code carry the most.
- Governance. One accountable executive should report to the board on progress.
- Vendors. Much of your cryptography sits in products you do not control. Your migration finishes when your suppliers finish.
- Budget. Multi-year work needs funding and staffing agreed early, not in the final year.
Decisions for the next 90 days
These are ArcQubit recommendations, not regulatory requirements.
- Name the owner. One executive sponsor and one program lead.
- Fund discovery. OMB calls a dynamic inventory of cryptographic assets the foundation of the migration plan 2.
- Set a data-lifespan rule. Decide how long each class of data must stay secret.
- Change procurement language. Ask vendors for PQC roadmaps.
- Agree a reporting rhythm. A short quarterly update to the board or risk committee.
Questions to ask your team
You do not need technical expertise to drive readiness. Ask these five questions and expect clear answers.
- Visibility. Do we have a complete inventory of where cryptography protects sensitive data?
- Exposure. Which systems hold data with long-term confidentiality needs?
- Governance. Who owns PQC planning, and how does it reach board reporting?
- Dependencies. What are our critical vendors' PQC roadmaps?
- Timeline. What is our target date, and which milestones show we are on track?
Weak answers to questions 1 and 3 tell you where to start. Quantum Readiness Self-Assessment gives your team a structured way to score itself.
Common mistakes
- Waiting for a quantum computer to appear. The start date matters more than the arrival date.
- Treating PQC as a software update. It changes protocols, certificates, hardware and contracts.
- Leaving it to the security team alone. Procurement, legal and engineering hold pieces of the answer.
- Skipping the inventory. You cannot replace what you cannot find.
How ArcQubit approaches it
ArcQubit's QuCode is enterprise discovery, sold directly as fixed-scope work. It finds quantum-vulnerable cryptography and delivers a ranked Quantum Exposure Report that shows whether your team or a supplier has to fix each finding. QuTrust then keeps the migration roadmap current as the system of record, with the evidence your board and auditors ask for. Contact ArcQubit to scope discovery.