The answer, up front
In January 2026 we argued that the year would reward organizations that defined quantum readiness, moved on post-quantum cryptography (PQC), kept a realistic view of quantum technology, and gave the work one owner. Government action since then made that argument concrete. Dated deadlines now exist, and 2027 is when several take effect 3, 4, 7.
Originally published Jan. 7, 2026; updated Sep. 30, 2026.
What 2026 demanded
Four themes from our original outlook held up. Here is how each played out, using only dated sources.
Clarity on what readiness means
Readiness still spans two dimensions: protecting against quantum-era threats and positioning to use quantum technologies. Organizations that define it narrowly solve half the problem. Quantum Readiness vs. Quantum Maturity explains why the two terms differ.
Government policy in 2026 addressed only the first dimension. That makes a shared internal definition more important, not less.
PQC migration moved from advice to dates
NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on Aug. 13, 2024 1. In June 2026 the U.S. added deadlines on top of them:
- EO 14412 was signed Jun. 22, 2026 and published Jun. 25 4.
- OMB M-26-15 followed on Jun. 24, 2026 and set Oct. 22, 2026 for agency migration plans 3.
- EO 14412 directs OMB guidance that sets Dec. 31, 2030 for key establishment and Dec. 31, 2031 for signatures 4.
Other governments published timelines too. The UK NCSC set 2028, 2031 and 2035 milestones in March 2025 5. The EU roadmap asks for first steps and initial national roadmaps by Dec. 31, 2026 6.
A realistic view of quantum adoption
Our original advice was to treat adoption as a portfolio decision, not an all-or-nothing bet. We have no new dated source that changes it. ArcQubit guidance: keep pilots small, fund talent and partnerships, and avoid commitments that depend on a specific breakthrough date.
Cross-functional ownership
EO 14412 required each agency head to name a migration lead within 30 days 4. OMB's plan requirements also call for named roles. Regulators now expect a named owner. The Case for a Unified Quantum Readiness Strategy covers how to share evidence across security and innovation teams.
What 2027 will require
Some 2027 requirements already exist. We list those first, and label our own advice separately.
| Date | What the existing source says |
|---|---|
| 2026 to 2027 | OMB phase one: strategy, planning and discovery, focused on inventory 3 |
| Dec. 19, 2026 | EO 14412 asks for a proposed FAR rule within 180 days of Jun. 22, 2026 4 |
| Dec. 31, 2026 | EU roadmap: first steps and initial national roadmaps 6 |
| Jan. 1, 2027 | NSA: new National Security System acquisitions CNSA 2.0 compliant 7 |
| Dec. 31, 2027 | EO 14412: NIST pilot complete 4 |
The NSA date binds National Security System owners, operators and vendors through acquisition 7. The FAR rule, once final, would extend obligations to contractors, with compliance by Dec. 31, 2030 4. The full picture is in Global Mandates and Deadlines.
What is still pending
Two NIST items remain open. FIPS 206 (FN-DSA) was in development as of NIST's Aug. 5, 2026 update 2. HQC was selected Mar. 11, 2025, and NIST gave no final date 2, 8. ArcQubit guidance: do not wait for either. The three final standards cover your first steps.
What this means for executives and the board
ArcQubit guidance for the next quarter:
- Confirm the owner. One named executive accountable for readiness across security and technology.
- Confirm the scope. Inventory starts with high-value and high-impact systems, the same focus OMB uses 3.
- Check your customers. Federal contractors should watch for the FAR rule. Everyone else should expect supplier questionnaires.
- Map supplier dependencies. Your migration finishes when your vendors finish.
A generic example
Consider a mid-size supplier with a software product and one government customer. In January it had no owner and no inventory. ArcQubit guidance for its year-end plan: name an executive owner in December, list the customer-facing systems that use public-key cryptography, and ask each software vendor for its post-quantum roadmap. That takes weeks, not quarters. It also gives the supplier a credible answer when the customer asks where it stands.
Questions to ask your team this week
- Do we have a written definition of quantum readiness that security and innovation both signed?
- Which systems hold data that must stay confidential past 2035?
- Who tracks NIST's status on FN-DSA and HQC?
- Which of our customers or contracts touch National Security Systems?
Common mistakes
- Waiting for the pending standards. FN-DSA and HQC are not final, but the final three are enough to start 2.
- Treating deadlines as someone else's. Government dates flow to suppliers through contracts and acquisition rules 4, 7.
- Splitting ownership. Two workstreams with two owners scatter investment.
- Skipping the roadmap. A dated plan beats a general commitment. Start with the Migration Roadmap.
How ArcQubit approaches it
This box describes ArcQubit's own method. Keep it separate from the guidance above.
ArcQubit's QuCode provides enterprise discovery and inventory, sold directly by ArcQubit as fixed-scope work. QuTrust is the system of record for the migration, keeping the roadmap current as work completes. The AI & Quantum Consulting team supports the adoption side of readiness.