NIST Post-Quantum Roadmap Lands as Google Cuts Qubit Errors 40x

Two timelines close in on each other

In late October 2026, the people building quantum computers and the people preparing to defend against them both announced progress within about two weeks. On October 27, the National Institute of Standards and Technology published its final roadmap for moving off encryption that a quantum computer could break. Less than two weeks before that, Google Quantum AI reported in Science that it had cut errors in a key fault-tolerance step roughly 40-fold on its Willow processor.1626 The two announcements came out separately, but they belong to the same story. The schedule for quantum hardware and the schedule for cryptographic migration are starting to move together.

My reading is that the encryption policy deadlines are now firmer than the hardware dates. The hardware is still advancing fast enough that waiting would be a mistake.

What NIST actually finalized

The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), builds on the three post-quantum standards NIST finalized in August 2024. It sets out which algorithms have to go and what replaces them.1117 The deprecation schedule is the most important part. Quantum-vulnerable public-key methods will be deprecated after 2030 and disallowed under NIST standards after 2035. The list includes RSA, ECDSA, EdDSA and classic Diffie-Hellman key exchange.18 In NIST's terms, "deprecated" means the algorithms can still be used if the data owner accepts the risk. "Disallowed" means they cannot be used for the purpose in question.11

The report puts NIST's technical guidance behind a tighter political timeline. National Security Memorandum 10 originally set 2035 as the target date. Executive Order 14412, signed in June 2026, brought the deadlines forward for federal high-value assets and high-impact systems. Those systems need quantum-resistant key establishment by December 31, 2030, and quantum-resistant digital signatures by December 31, 2031.1316 Reports differ on the details. Help Net Security led with the 2030 key-establishment date. The Quantum Insider, Nextgov and CyberInsider all highlighted the separate 2031 deadline for signatures.11131618 Signatures are usually the harder part to migrate, so the 2031 date deserves at least as much attention as 2030.

The guidance is practical in tone. NIST approves hybrid schemes that combine classical and post-quantum algorithms, which it compares to putting two padlocks on one door.16 Quantum Computing Report adds a detail that matters to vendors. Combining an ML-KEM secret with a classical ECDH secret will not invalidate a module's FIPS 140 validation.17 NIST names TLS as an early priority and recommends ML-KEM-768 as the default parameter set. Symmetric algorithms such as AES are not expected to need replacing.18 NIST also notes that earlier cryptographic transitions took 10 to 20 years, which explains why it is pushing to start now.11

Washington's paperwork is the easy part

There is a gap between the policy timeline and how ready agencies actually are. Federal civilian agencies had about 120 days from OMB Memorandum M-26-15, issued June 24, to submit migration plans, which put the deadline around October 22.14 In October, the Government Accountability Office reported that agencies had not done enough groundwork. Many had not fully identified their vulnerable systems or tested quantum-resistant algorithms.16 GovConWire said the GAO findings make the case for measurable benchmarks rather than plans on paper.12

More deadlines are coming. Under the NSA's CNSA 2.0 direction, new commercial products bought for National Security Systems must support quantum-resistant algorithms starting in 2027. Legacy equipment that cannot will be phased out by 2030.12 Around December 19, the Federal Acquisition Regulatory Council is due to propose a rule requiring covered contractors to meet NIST encryption standards, including the post-quantum ones, by the end of 2030.14 That rule would carry the mandate well beyond government. Europe is on a parallel track. Its coordinated roadmap asks every member state to begin the transition by the end of 2026, though the roadmap is not legally binding.14

Vendors are already selling into this. IBM launched its Quantum Safe suite on October 27, the same day NIST released the roadmap. It is built on IBM's Guardium Cryptography Manager.19 Futurum's analysis supports treating migration as ongoing governance rather than a one-off project. It also noted that buyers still act as if it were a project: 35% of data-security respondents ranked PQC upgrades among their top three initiatives, but only 20% ranked crypto agility among their top challenges.19 Consumer-facing infrastructure is further along. Cloudflare's data shows client support for post-quantum encryption went from under 3% in early 2024 to more than 60% by February 2026.14

The hardware side: error correction gets cheaper

Google's October result centers on "magic state cultivation." Magic states are special states prepared in advance so a quantum computer can run hard operations without breaking its error correction.25 On Willow, Google reported about a 40-fold error reduction and T-state logical fidelity of 99.99%. The company also said larger demonstrations are still needed.23 ScienceAlert pointed out that the aim is not a better magic state but one of similar quality made with fewer resources.25 A week later, Nvidia researchers simulated a 104-qubit system on Germany's JUPITER exascale supercomputer using 8,192 GPUs. They reported that the same technique could cut physical-qubit requirements by about 90% under realistic noise.29

Outside observers disagreed about what this means for "Q-day," the point when quantum computers can break current encryption. Nic Carter of Castle Island Ventures said timelines are getting shorter and AI is speeding up error-correction work, though he did not see an imminent threat. Project Eleven CEO Alex Pruden said the result does not move Q-day estimates, because existing resource estimates already assumed the technique.23 Pruden's view is the more careful one. Still, the main concern is not any single paper but how fast resource estimates are falling. In March, Google estimated that 256-bit elliptic-curve keys could be broken with fewer than 500,000 physical qubits. A February preprint from Iceberg Quantum claimed RSA-2048 could fall to fewer than 100,000, a figure no one has independently reproduced.14 Surveyed experts still put the chance of such a machine within ten years at only 28% to 49%.14

There was more progress at the component level. RIKEN researchers reported in Nature Physics that five silicon spin qubits sharing one microwave line kept about 99.9% fidelity when operated all at once, and above 99.99% with up to three running together.24 IonQ reported entanglement rates above 1,000 per second between a trapped-ion qubit and a solid-state memory, more than four times the previous trapped-ion record.28 It also described a qLDPC error-correction method with up to 74× faster logical operations. That work is still a preprint and has not been peer reviewed.21

Roadmaps converge on 2029, with caveats

The leading companies' public roadmaps cluster around the end of the decade. IBM's Starling is set for 2029, with 200 logical qubits running 100 million gates. Quantinuum's Apollo is also targeted for 2029, after a Sol system in 2027. Google has described a useful error-corrected machine around 2029, at roughly a million physical qubits.26 At IEEE Quantum Week, company speakers gave dates from 2028 to 2033. QuEra pointed to 256 logical qubits in 2028 and Xanadu to 2029 for its first fault-tolerant qubits.8 On October 7, DARPA moved Atom Computing, Diraq, IBM and IonQ into Stage C of its Quantum Benchmarking Initiative.9

The coverage diverges most on two questions: what counts as a logical qubit, and whose numbers to believe. Quantinuum is often credited with 48 logical qubits on Helios. One trapped-ion guide notes that this run kept only a fraction of attempts. It says the company's counted error-corrected result is smaller and came from a very shallow benchmark circuit.10 One explainer described Helios two-qubit fidelity as "99.9999%-class." Other trackers report 99.921% for two-qubit gates and a separate 99.9995% figure for logical memory, which is still a preprint.679 Reported IonQ revenue guidance is either $280–290 million or $450–460 million. The higher figure includes the SkyWater foundry business it acquired.59 One tracker counts IBM's mid-2026 advantage claims as not yet peer-reviewed. Another notes that the Kookaburra module, due in 2026, had not been publicly confirmed as delivered by October.19

The takeaway

NIST and the White House have set dates that will not move. The hardware roadmaps are spread over several years and keep changing. For security teams, uncertainty about the hardware is not a reason to wait. The threat of data being harvested now and decrypted later, the 10-to-20-year history of past migrations, and steadily falling qubit estimates all point the same way. A company that starts migrating in 2029, when a fault-tolerant machine might arrive, will already be late.