[{"data":1,"prerenderedAt":447},["ShallowReactive",2],{"blog-\u002Fblog\u002Fwhat-2026-will-demand-quantum-ready-organizations":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":373,"date":374,"description":375,"draft":376,"extension":377,"faqs":378,"findingsSource":7,"geo":391,"howto":7,"howtoTitle":7,"image":393,"industries":394,"keyFindings":7,"meta":397,"modified":398,"navigation":399,"path":400,"pullquote":7,"recommendations":7,"references":401,"related":426,"seo":431,"seoTitle":432,"signposts":7,"slug":433,"stats":434,"stem":437,"tags":438,"tldr":445,"__hash__":446},"blog\u002Fblog\u002Fwhat-2026-will-demand-quantum-ready-organizations.md","What 2026 Demanded from Quantum-Ready Organizations, and What 2027 Will Require","ArcQubit Team",null,{"type":9,"value":10,"toc":353},"minimark",[11,16,32,38,42,45,50,59,62,66,73,101,111,115,118,122,133,137,140,210,223,227,240,244,247,276,280,283,287,301,305,341,345,350],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,24,28,31],"p",{},"In January 2026 we argued that the year would reward organizations that defined quantum readiness, moved on post-quantum cryptography (PQC), kept a realistic view of quantum technology, and gave the work one owner. Government action since then made that argument concrete. Dated deadlines now exist, and 2027 is when several take effect ",[21,22,23],"span",{},"3",", ",[21,26,27],{},"4",[21,29,30],{},"7",".",[17,33,34],{},[35,36,37],"em",{},"Originally published Jan. 7, 2026; updated Sep. 30, 2026.",[12,39,41],{"id":40},"what-2026-demanded","What 2026 demanded",[17,43,44],{},"Four themes from our original outlook held up. Here is how each played out, using only dated sources.",[46,47,49],"h3",{"id":48},"clarity-on-what-readiness-means","Clarity on what readiness means",[17,51,52,53,58],{},"Readiness still spans two dimensions: protecting against quantum-era threats and positioning to use quantum technologies. Organizations that define it narrowly solve half the problem. ",[54,55,57],"a",{"href":56},"\u002Fblog\u002Fquantum-readiness-vs-quantum-maturity","Quantum Readiness vs. Quantum Maturity"," explains why the two terms differ.",[17,60,61],{},"Government policy in 2026 addressed only the first dimension. That makes a shared internal definition more important, not less.",[46,63,65],{"id":64},"pqc-migration-moved-from-advice-to-dates","PQC migration moved from advice to dates",[17,67,68,69,72],{},"NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on Aug. 13, 2024 ",[21,70,71],{},"1",". In June 2026 the U.S. added deadlines on top of them:",[74,75,76,86,94],"ul",{},[77,78,79,83,84,31],"li",{},[80,81,82],"strong",{},"EO 14412"," was signed Jun. 22, 2026 and published Jun. 25 ",[21,85,27],{},[77,87,88,91,92,31],{},[80,89,90],{},"OMB M-26-15"," followed on Jun. 24, 2026 and set Oct. 22, 2026 for agency migration plans ",[21,93,23],{},[77,95,96,98,99,31],{},[80,97,82],{}," directs OMB guidance that sets Dec. 31, 2030 for key establishment and Dec. 31, 2031 for signatures ",[21,100,27],{},[17,102,103,104,107,108,31],{},"Other governments published timelines too. The UK NCSC set 2028, 2031 and 2035 milestones in March 2025 ",[21,105,106],{},"5",". The EU roadmap asks for first steps and initial national roadmaps by Dec. 31, 2026 ",[21,109,110],{},"6",[46,112,114],{"id":113},"a-realistic-view-of-quantum-adoption","A realistic view of quantum adoption",[17,116,117],{},"Our original advice was to treat adoption as a portfolio decision, not an all-or-nothing bet. We have no new dated source that changes it. ArcQubit guidance: keep pilots small, fund talent and partnerships, and avoid commitments that depend on a specific breakthrough date.",[46,119,121],{"id":120},"cross-functional-ownership","Cross-functional ownership",[17,123,124,125,127,128,132],{},"EO 14412 required each agency head to name a migration lead within 30 days ",[21,126,27],{},". OMB's plan requirements also call for named roles. Regulators now expect a named owner. ",[54,129,131],{"href":130},"\u002Fblog\u002Funified-quantum-readiness-strategy","The Case for a Unified Quantum Readiness Strategy"," covers how to share evidence across security and innovation teams.",[12,134,136],{"id":135},"what-2027-will-require","What 2027 will require",[17,138,139],{},"Some 2027 requirements already exist. We list those first, and label our own advice separately.",[141,142,143,156],"table",{},[144,145,146],"thead",{},[147,148,149,153],"tr",{},[150,151,152],"th",{},"Date",[150,154,155],{},"What the existing source says",[157,158,159,170,180,190,200],"tbody",{},[147,160,161,165],{},[162,163,164],"td",{},"2026 to 2027",[162,166,167,168],{},"OMB phase one: strategy, planning and discovery, focused on inventory ",[21,169,23],{},[147,171,172,175],{},[162,173,174],{},"Dec. 19, 2026",[162,176,177,178],{},"EO 14412 asks for a proposed FAR rule within 180 days of Jun. 22, 2026 ",[21,179,27],{},[147,181,182,185],{},[162,183,184],{},"Dec. 31, 2026",[162,186,187,188],{},"EU roadmap: first steps and initial national roadmaps ",[21,189,110],{},[147,191,192,195],{},[162,193,194],{},"Jan. 1, 2027",[162,196,197,198],{},"NSA: new National Security System acquisitions CNSA 2.0 compliant ",[21,199,30],{},[147,201,202,205],{},[162,203,204],{},"Dec. 31, 2027",[162,206,207,208],{},"EO 14412: NIST pilot complete ",[21,209,27],{},[17,211,212,213,215,216,218,219,31],{},"The NSA date binds National Security System owners, operators and vendors through acquisition ",[21,214,30],{},". The FAR rule, once final, would extend obligations to contractors, with compliance by Dec. 31, 2030 ",[21,217,27],{},". The full picture is in ",[54,220,222],{"href":221},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines",[46,224,226],{"id":225},"what-is-still-pending","What is still pending",[17,228,229,230,233,234,24,236,239],{},"Two NIST items remain open. FIPS 206 (FN-DSA) was in development as of NIST's Aug. 5, 2026 update ",[21,231,232],{},"2",". HQC was selected Mar. 11, 2025, and NIST gave no final date ",[21,235,232],{},[21,237,238],{},"8",". ArcQubit guidance: do not wait for either. The three final standards cover your first steps.",[12,241,243],{"id":242},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,245,246],{},"ArcQubit guidance for the next quarter:",[248,249,250,256,264,270],"ol",{},[77,251,252,255],{},[80,253,254],{},"Confirm the owner."," One named executive accountable for readiness across security and technology.",[77,257,258,261,262,31],{},[80,259,260],{},"Confirm the scope."," Inventory starts with high-value and high-impact systems, the same focus OMB uses ",[21,263,23],{},[77,265,266,269],{},[80,267,268],{},"Check your customers."," Federal contractors should watch for the FAR rule. Everyone else should expect supplier questionnaires.",[77,271,272,275],{},[80,273,274],{},"Map supplier dependencies."," Your migration finishes when your vendors finish.",[12,277,279],{"id":278},"a-generic-example","A generic example",[17,281,282],{},"Consider a mid-size supplier with a software product and one government customer. In January it had no owner and no inventory. ArcQubit guidance for its year-end plan: name an executive owner in December, list the customer-facing systems that use public-key cryptography, and ask each software vendor for its post-quantum roadmap. That takes weeks, not quarters. It also gives the supplier a credible answer when the customer asks where it stands.",[12,284,286],{"id":285},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[74,288,289,292,295,298],{},[77,290,291],{},"Do we have a written definition of quantum readiness that security and innovation both signed?",[77,293,294],{},"Which systems hold data that must stay confidential past 2035?",[77,296,297],{},"Who tracks NIST's status on FN-DSA and HQC?",[77,299,300],{},"Which of our customers or contracts touch National Security Systems?",[12,302,304],{"id":303},"common-mistakes","Common mistakes",[74,306,307,315,325,331],{},[77,308,309,312,313,31],{},[80,310,311],{},"Waiting for the pending standards."," FN-DSA and HQC are not final, but the final three are enough to start ",[21,314,232],{},[77,316,317,320,321,24,323,31],{},[80,318,319],{},"Treating deadlines as someone else's."," Government dates flow to suppliers through contracts and acquisition rules ",[21,322,27],{},[21,324,30],{},[77,326,327,330],{},[80,328,329],{},"Splitting ownership."," Two workstreams with two owners scatter investment.",[77,332,333,336,337,31],{},[80,334,335],{},"Skipping the roadmap."," A dated plan beats a general commitment. Start with the ",[54,338,340],{"href":339},"\u002Fblog\u002Fpqc-migration-roadmap","Migration Roadmap",[12,342,344],{"id":343},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,346,347],{},[35,348,349],{},"This box describes ArcQubit's own method. Keep it separate from the guidance above.",[17,351,352],{},"ArcQubit's QuCode provides enterprise discovery and inventory, sold directly by ArcQubit as fixed-scope work. QuTrust is the system of record for the migration, keeping the roadmap current as work completes. The AI & Quantum Consulting team supports the adoption side of readiness.",{"title":354,"searchDepth":355,"depth":355,"links":356},"",2,[357,358,365,368,369,370,371,372],{"id":14,"depth":355,"text":15},{"id":40,"depth":355,"text":41,"children":359},[360,362,363,364],{"id":48,"depth":361,"text":49},3,{"id":64,"depth":361,"text":65},{"id":113,"depth":361,"text":114},{"id":120,"depth":361,"text":121},{"id":135,"depth":355,"text":136,"children":366},[367],{"id":225,"depth":361,"text":226},{"id":242,"depth":355,"text":243},{"id":278,"depth":355,"text":279},{"id":285,"depth":355,"text":286},{"id":303,"depth":355,"text":304},{"id":343,"depth":355,"text":344},"Research","2026-01-07","2026 turned quantum readiness into dated deadlines. See what the U.S., UK and EU timelines already require in 2027, and what to decide before year end.",false,"md",[379,382,385,388],{"q":380,"a":381},"What does quantum readiness mean?","Quantum readiness has two dimensions. The first is protecting against quantum-era threats, mainly by migrating to post-quantum cryptography. The second is deciding where quantum technologies could create value for your business. ArcQubit guidance: define both in one shared statement, then assign one executive owner.",{"q":383,"a":384},"What are the U.S. post-quantum deadlines for 2027?","OMB's first migration phase, strategy, planning and discovery, runs 2026 to 2027 [3]. NSA's CNSA 2.0 guidance says new National Security System acquisitions should be CNSA 2.0 compliant from Jan. 1, 2027 [7]. EO 14412 directs NIST to complete a federal pilot by Dec. 31, 2027 [4].",{"q":386,"a":387},"Are FN-DSA and HQC final yet?","No. As of NIST's Aug. 5, 2026 project page update, FIPS 206 (FN-DSA) is in development and HQC, selected Mar. 11, 2025, has no final publication date [2], [8]. Start with FIPS 203, 204 and 205, which are final, because they already cover your first migration steps.",{"q":389,"a":390},"Do these deadlines apply to private companies?","Not directly in most cases. M-26-15 covers federal civilian agencies and excludes National Security Systems [3]. EO 14412 directs a FAR rule requiring contractor compliance by Dec. 31, 2030 [4]. UK, EU and Canadian timelines are government guidance that shapes supplier and customer expectations [5], [6], [9].",[392],"us","\u002Fblog\u002F2026-demands.png",[395,396],"Cross-Sector","Government Facilities",{},"2026-09-30",true,"\u002Fblog\u002Fwhat-2026-will-demand-quantum-ready-organizations",[402,405,408,411,414,417,420,423],{"label":403,"url":404},"National Institute of Standards and Technology, \"NIST Releases First 3 Finalized Post-Quantum Encryption Standards,\" NIST News, Aug. 13, 2024","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2024\u002F08\u002Fnist-releases-first-3-finalized-post-quantum-encryption-standards",{"label":406,"url":407},"National Institute of Standards and Technology, \"PQC Standardization Process,\" NIST Computer Security Resource Center, updated Aug. 5, 2026","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fpost-quantum-cryptography\u002Fpost-quantum-cryptography-standardization",{"label":409,"url":410},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":412,"url":413},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":415,"url":416},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":418,"url":419},"NIS Cooperation Group, \"A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,\" European Commission, Jun. 2025","https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcoordinated-implementation-roadmap-transition-post-quantum-cryptography",{"label":421,"url":422},"National Security Agency, \"The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ,\" Ver. 2.1, Dec. 2024","https:\u002F\u002Fmedia.defense.gov\u002F2022\u002FSep\u002F07\u002F2003071836\u002F-1\u002F-1\u002F0\u002FCSI_CNSA_2.0_FAQ_.PDF",{"label":424,"url":425},"National Institute of Standards and Technology, \"NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption,\" NIST News, Mar. 11, 2025","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2025\u002F03\u002Fnist-selects-hqc-fifth-algorithm-post-quantum-encryption",[427,428,429,430],{"label":222,"url":221},{"label":340,"url":339},{"label":57,"url":56},{"label":131,"url":130},{"title":5,"description":375},"What 2026 Demanded and What 2027 Will Require","what-2026-will-demand-quantum-ready-organizations",[435,436],"NIST released its first three finalized post-quantum standards, FIPS 203, 204 and 205, on Aug. 13, 2024 (NIST, 2024).","OMB Memorandum M-26-15 (Jun. 24, 2026) set Oct. 22, 2026 for agency migration plans and runs its first phase, discovery and planning, from 2026 to 2027 (OMB, 2026).","blog\u002Fwhat-2026-will-demand-quantum-ready-organizations",[439,440,441,442,443,444],"quantum readiness","PQC migration","post-quantum cryptography","NIST PQC standards","for CISOs","industry analysis","In 2026 the U.S. government set dated post-quantum deadlines, and the dates already published for 2027 require organizations to define readiness, inventory cryptography, and assign one executive owner.","wwt7N5cPb0AgCN8NfWJqwgMC05XCF-BltmWZXQ5bCmY",1792182884648]