Post-Quantum Cryptography Deadlines Hit Federal Agencies Oct. 22

The first hard date arrives

For years, post-quantum cryptography (PQC) was a planning exercise. Now there is a calendar. Under Office of Management and Budget memorandum M-26-15, every federal agency must submit a post-quantum migration plan to OMB and the Office of the National Cyber Director by October 22, 2026. 3 That memo was the last of three documents released in quick succession in late June. 4

On June 22, Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," ordered agencies to move High Value Assets and high-impact systems to NIST-approved post-quantum key establishment by December 31, 2030. Digital signatures must follow by December 31, 2031. 4 The next day, the Department of War published a PQC strategy. It says every system must support post-quantum algorithms or be phased out by the end of 2030, and must actually use them by the end of 2031. It also pledges to extend those requirements across the defense industrial base. 4 OMB's memo then set the schedule. Agencies had to name migration leads by late July and file full plans in late October, with phased milestones running through 2035. 4

Agencies were not ready

The deadline lands on a federal workforce that, by the government's own audit, was behind. The Government Accountability Office reviewed 24 agencies and found that none had fully addressed all three post-quantum practices it examined. Fifteen said it was too early for automated discovery tools, or that they were waiting on CISA to provide them. 3

That matters because migration starts with inventory. An agency cannot replace vulnerable public-key cryptography it cannot find. When agencies say they are waiting on tooling, it suggests many October plans will describe intentions more than verified cryptographic inventories. That reading is an inference, but it follows from GAO's findings.

Contractors face their own deadline. The executive order directs a proposed Federal Acquisition Regulation rule within 180 days, or roughly December 19, 2026. The rule would require covered contractors to comply with NIST's FIPS standards, including the post-quantum algorithms, by December 31, 2030. 3 For suppliers, the 2030 date is effectively a procurement requirement, not just a policy goal.

Where the vendors come in

The industry response has been fast. At its Cyber Summit in Paris on October 1, Thales announced five offerings. They include a hardware security module (HSM) built for post-quantum protection, an AI-enabled data security posture management product, software protection aimed at AI-powered attacks, and a broader Google Cloud partnership for securing agentic AI workflows. 5

HSMs sit at the base of many key-management systems, so a PQC-capable module answers a real need for agencies and contractors. These organizations will eventually have to generate, store and use new key types. But the timing deserves some skepticism. One analysis of the GAO report flagged the obvious tension: a vendor pointing to a federal audit that recommends buying what the vendor sells. 3 Hardware alone does not fix the gap GAO described. The bottleneck is discovery and planning, and an HSM purchase does not tell an agency where its legacy RSA and elliptic-curve dependencies are hiding.

The agentic AI subplot

Thales packaged its PQC hardware alongside AI security tools, and that pairing reflects a second pressure on security teams. Back in October 2025, Forrester predicted that agentic AI would cause a public breach in 2026 serious enough to cost people their jobs. Analyst Paddy Harrington warned that a single fault could cascade and expose systems. 1 By September 2026, Mandiant's AI Risk and Resilience report described attackers moving from direct prompts to indirect prompt injection and AI supply chain compromises. It warned that a poisoned data source, model dependency or extension hook can turn a trusted agent into a tool for reconnaissance, lateral movement or sandbox escape. 2 Mandiant also tied supply chain incidents to a group tracked as UNC6780, or TeamPCP, which stole AI service credentials and proprietary data. 2 In another case, a single runaway agent ran up a $50,000 cloud bill. 2

The bottom line

The real test for agencies is not October 22 itself. It is whether the plans filed that day rest on actual cryptographic inventories. GAO's findings suggest many will not, at least not yet. Vendors like Thales are offering useful building blocks, but the hard part of PQC migration is finding and tracking cryptography across sprawling systems. Security teams are trying to do that while also governing increasingly autonomous AI. Agencies and contractors that treat October 22 as the start of inventory work, rather than a paperwork milestone, will be better placed for 2030.