Six Official Calendars Just Put 2030 on the Same Post-Quantum Calendar

Six of the seven major post-quantum cryptography schedules now converge in 2030, and the seventh hits the same decade. The shift turns a forecast into a procurement clock that engineering, security, and procurement teams have to plan against, regardless of when the first cryptographically relevant quantum computer actually appears.

The anchor is Executive Order 14412, signed 22 June 2026, which sets a 31 December 2030 deadline for post-quantum cryptography for key establishment on federal high-value and high-impact systems, and 31 December 2031 for digital signatures (livetradingnews.com). Post-quantum cryptography is the new generation of public-key encryption designed to resist attacks by a future large-scale quantum computer; key establishment is the handshake that sets up an encrypted session, and a digital signature is the cryptographic proof of who sent a message or signed code. Together those two dates put the U.S. federal calendar in line with the rest of the G7.

That order is not a stand-alone policy. NSA's CNSA 2.0 commercial national security algorithm suite already requires software and firmware signing to exclusively use CNSA 2.0 by 2030, with national-security-system transition expected complete by 2035 (livetradingnews.com). The UK's National Cyber Security Centre, the EU's post-quantum roadmap v1.1, the G7 Cyber Expert Group, and OMB memo M-26-15 all carry milestones in 2028, 2030, 2031, and 2035. Six of those seven calendars land a milestone in 2030, which is the part that turns a beat story into a planning constraint.

The reason the key-establishment date is firm even before a quantum computer exists is the harvest-now-decrypt-later problem. Adversaries recording encrypted sessions today can decrypt them years later when large-scale quantum computers become operational. Digital signatures face a different exposure: a forged signature requires a quantum computer on the day of forgery, not a future quantum computer decrypting a recorded session. That asymmetry between recording-threat and forgery-threat is the policy rationale for sequencing key establishment first in 2030 and signatures one year later in 2031.

What the calendar actually asks of operators and vendors is concrete. OMB M-26-15 lays out five phases: discovery in 2026 to 2027, pilots in 2027 to 2028, key establishment in 2028 to 2030, signatures in 2031, and full migration by 2035. A contract-rule due date sits inside that schedule, meaning procurement officers will soon be writing post-quantum requirements into the federal buy. NIST's FIPS 203, 204, and 205 standards, published 13 August 2024, define the algorithms teams will have to choose from. NIST's IR 8547 already marks quantum-vulnerable signatures at 112 bits of security Deprecated after 2030 and Disallowed after 2035, which puts a hard cap on how long legacy signature code can stay in production.

For the U.K., the National Cyber Security Centre targets goals and discovery by 2028, highest-priority migration by 2031, and all systems, services, and products by 2035. The EU roadmap v1.1 sets national strategies by the end of 2026, high-risk use cases completed by 31 December 2030, and no stand-alone quantum-vulnerable public-key mechanism in medium-risk use cases after the end of 2035. The G7 Cyber Expert Group covers critical financial systems across its 2030-to-2032 timeline (livetradingnews.com). The convergence is no longer a tech-vendor story; it is a cross-border regulatory schedule that touches every operator handling personal data, payments, or signed code.

The strongest counterargument is that a cryptographically relevant quantum computer may still be years or even decades away, and that the deadlines are precautionary and could slip. That is a real risk, and it cuts in two directions: any operator that budgets for slippage may underinvest, while any operator that treats the calendar as fixed is exposed to a regulatory reshuffle if the underlying threat does not arrive on schedule. The federal schedule is built so that key establishment happens by 2030 even under that uncertainty, because the harvest-now-decrypt-later risk alone justifies moving before the threat does.

That cross-jurisdiction agreement is also what makes this round of deadlines different from the previous decade of post-quantum hand-wringing. Engineering, security, and procurement teams now have a stable calendar to plan against, the algorithms are already published, and the federal procurement rule is due inside a quarter. The remaining uncertainty is not whether the schedule moves; it is whether each operator can move key establishment earlier than 2030, sign and deploy FIPS 203, 204, and 205 by 2031, and finish the broader migration by 2035 without slipping into the deprecated window. For the teams in the middle of that work, the agency is in the schedule itself: a real, written, multi-government clock that turns the migration from a forecast into a shipped plan.