Executive Order 14412 sets 2030 and 2031 federal post-quantum deadlines
22 JUNE 2026, WASHINGTON
Executive Order 14412, published at 91 FR 38483, directs federal systems to adopt post-quantum cryptography on a fixed schedule. Agencies must deploy post-quantum key establishment by 31 December 2030 and post-quantum digital signatures by 31 December 2031. The order separates the two dates because key establishment carries the more urgent harvest-now-decrypt-later risk, where an adversary records encrypted traffic today and decrypts it once a cryptographically relevant quantum computer exists.
The order also lays out a sequence of near-term milestones. It gives agencies 30 days to designate a migration lead, 90 days for the Office of Management and Budget to issue guidance, and 180 days for NIST to complete validation work and for a Federal Acquisition Regulation proposal to appear. Within 270 days, CISA and NIST must publish the minimum elements of a cryptography bill of materials.
These deadlines reach beyond federal agencies. The FAR proposal flows the requirements to covered contractors, who must meet the same end-2030 obligation and pass the duties down to their subcontractors. Vendors that sell to the federal government therefore inherit the timeline, even where they operate under private contracts.
Why it matters. The order converts years of voluntary guidance into dated obligations with a procurement lever behind them. Agencies and their vendors now have a hard end-2030 target for key establishment and end-2031 for signatures, and the cryptography bill of materials requirement means buyers will ask suppliers to prove what algorithms their products use. Organizations that start cryptographic discovery and inventory now have the most room to plan an orderly migration.