On October 27, 2026, NIST published the final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards. Nearly two years after the draft released for public comment in November 2024, the report no longer just maps out a path. It is now tied to binding federal deadlines, and it tightens the deprecation schedule for classical public-key cryptography. This article covers the key changes, the obligations for US federal agencies, and the implications for European organizations.
From Guidance to an Execution Plan
The NIST IR 8547 draft that NIST released in November 2024 laid out the basics of the transition. It identified quantum-vulnerable algorithms, listed the post-quantum standards that replace them (ML-KEM, ML-DSA, SLH-DSA), and pointed to 2035, the target set by National Security Memorandum 10. The final version keeps that structure but takes on a broader role: it now supports the implementation of Executive Order 14412 and OMB Memorandum M-26-15, both issued in June 2026, which drives the post-quantum migration of the most sensitive federal systems.
The tone has shifted accordingly. NIST urges organizations to treat post-quantum migration as a current operational priority, starting with a cryptographic inventory, migration planning, and early deployments of PQC-enabled products and services. The report notes that past cryptographic transitions have taken 10 to 20 years, and measured against that, the new deadlines leave very little margin.
Three Major Changes
Firm Deadlines for the Most Sensitive Federal Systems
The overall 2035 goal still stands. However, for high value assets and systems rated “high impact” under FIPS 199, the schedule moves forward: post-quantum key establishment by December 31, 2030, and post-quantum digital signatures by December 31, 2031. Systems protecting data expected to remain sensitive in 2030 get the same priority, which makes the “harvest now, decrypt later” threat must be taken into account when setting priorities.
The gap between the two deadlines reflects the nature of the risk. Encrypted data can be collected today and decrypted later, whereas a signature is only exposed at the moment it is verified. NIST stresses that migrating signatures is still urgent, given how long and complex that work is and how many parties must coordinate, particularly across public key infrastructures.
All RSA and ECC Key Sizes Deprecated After 2030
This is the most significant technical change. The 2024 draft distinguished between two cases: parameters offering 112 bits of security would be deprecated after 2030 and disallowed after 2035, while parameters at 128 bits and above would remain acceptable, with no deprecation phase, until being disallowed in 2035. The final version removes that distinction. RSA, ECDSA, EdDSA, Diffie-Hellman, MQV and their elliptic-curve variants are all deprecated after 2030 and disallowed after 2035 under NIST standards, regardless of key size.
In practice, infrastructure built on RSA-3072 or the P-256 curve also becomes “deprecated” from 2031 onward. It can still be used, but the data owner must assess and accept the risk. Moving to larger keys is no longer a way to buy time.
TLS and Hybrid Key Exchange Take Priority
NIST makes TLS a clearly defined priority. The protocol protects data in transit for nearly every federal system, which makes it a prime target for harvest-now-decrypt-later collection. Agencies must support TLS 1.3 by January 2, 2030, and the report presents TLS 1.3 as the most direct path to quantum-resistant key establishment, including through hybrid mechanisms that pair ML-KEM with a classical algorithm. The next revision of SP 800-52 will spell out the details.
Other Notable Changes
- ML-KEM-768 is now the recommended default parameter set, offering a large security margin at a reasonable performance cost.
- HQC is confirmed as the alternative to ML-KEM, with a dedicated FIPS in development. NIST has no current plans to select additional KEMs. The signature standard derived from FALCON is also in development.
- Hybrid approaches are broader. A hybrid can combine a classical and a post-quantum algorithm, or several post-quantum algorithms based on different mathematical assumptions. A composite construction can still be FIPS 140 validated as long as at least one component is approved, and SP 800-227 now provides guidance on key combiners.
- Hardware vendors are urged to integrate post-quantum cryptography now. Given the long design and manufacturing lead times for HSMs and TPMs, NIST calls this a high priority. The CMVP process will also be revised to speed up the validation of post-quantum modules.
- Trust infrastructure gets particular attention, starting with the federal PIV credential and the PKIs behind it, which can take several years to issue and replace.
Obligations for US Federal Agencies
It is important to separate the legal weight of each text. NIST IR 8547 is a report that describes how NIST standards will transition and does not, on its own, create obligations. The obligations come from the policy documents it supports, and they apply to federal agencies.
Executive Order 14412 sets the policy framework and OMB Memorandum M-26-15 puts it into practice. Together, they require federal agencies to:
- run a risk-prioritized migration aimed at mitigating as much quantum risk as possible by December 31, 2030;
- adopt post-quantum key establishment by December 31, 2030, and post-quantum signatures by December 31, 2031, for high value assets, high impact systems, and systems protecting data that will remain sensitive beyond 2030;
- support TLS 1.3 no later than January 2, 2030, a requirement also set by Executive Order 14306;
- identify systems that cannot support post-quantum cryptography and prioritize them for replacement or decommissioning;
- modernize Federal Identity, Credential, and Access Management (FICAM) capabilities in support of the post-quantum migration.
The deprecation (after 2030) and disallowance (after 2035) schedule applies within NIST standards and guidelines, which notably govern FIPS 140 validation of cryptographic modules. Vendors that serve the US federal market or rely on these validations will need to factor this in, since their federal customers will need post-quantum products ahead of the 2030 and 2031 deadlines.
Implications for European Organizations
For a European company or public body, NIST IR 8547 is not binding. Treating it as a purely American document would still miss the point for three reasons.
- The US timeline matches Europe’s. The coordinated implementation roadmap published by the NIS Cooperation Group in June 2025 recommends that Member States take first steps and set national roadmaps by the end of 2026, complete the transition for high-risk use cases by the end of 2030, and do the same for medium-risk use cases by the end of 2035. In France, the government’s 2026–2027 digital security roadmap directs state administrations to inventory long-term sensitive data by the end of 2026, deploy post-quantum cryptography across all “Diffusion Restreinte” (restricted) systems by the end of 2030, and, starting in 2030, purchase only encryption products that integrate post-quantum cryptography. On both sides of the Atlantic, 2030 has become the horizon for the most sensitive systems.
- The supply chain is global. Much of the technology used in Europe, such as cryptographic libraries, HSMs, network equipment, and cloud services, follows NIST standards and FIPS 140 validation. Vendor roadmaps will align with these deadlines, and European organizations will inherit them through their technology choices and refresh cycles.
- The European framework already provides the lever. DORA and NIS2 require in-scope entities to manage cyber risk in light of identified threats. In the fall of 2026, the European Supervisory Authorities (ESMA, EBA, EIOPA) described quantum computing as a material risk for the financial sector and recommended that firms plan and prepare. According to the NIS Cooperation Group roadmap, the Cyber Resilience Act, which takes effect in December 2027, should also lead to crypto-agility being systematically built into products with digital elements.
The technical approaches are converging as well. NIST accommodates hybrid constructions without mandating them, while ANSSI recommends hybridization during the transition phase. Organizations subject to both frameworks are well served by hybrid architectures that satisfy each of them.
Where to Start
NIST’s recommendations line up with those of European agencies with regards to the order of operations.
- Build a cryptographic inventory. No post-quantum migration can be planned without knowing where and how RSA and elliptic curves are used, such as in protocols, libraries, certificates, hardware modules, applications. NIST explicitly makes this the starting point.
- Prioritize by data lifetime. Mosca’s theorem, cited by NIST, frames the decision: if the time data must stay confidential plus the time needed to migrate exceeds the time until a cryptanalytically relevant quantum computer exists, that data is already exposed.
- Identify systems that cannot migrate. Devices whose signature-verification code can no longer be updated, called embedded equipment, and legacy applications need to be flagged early so their replacements can be planned.
- Engage your vendors. Given the lead times for cryptographic hardware and product validation, visibility into vendors’ post-quantum roadmaps is needed now, especially for HSMs, PKI, and network equipment.
- Start with key establishment and TLS. This is where exposure to harvest-now-decrypt-later attacks is most direct and where hybrid solutions are most mature.
- Build crypto-agility. As NIST points out, post-quantum standards will keep evolving. Infrastructure that can swap algorithms without a redesign lowers the cost of this transition and of the ones that follow.
A Shared Deadline
With the final version of NIST IR 8547, the post-quantum transition moves from anticipation to execution. The United States has set binding deadlines for its agencies, Europe has laid out a converging timeline, and vendors will have to align their products accordingly. For European organizations, the current priority is to have, before 2030, a complete view of their cryptographic usage and a post-quantum migration roadmap that puts their most sensitive systems first.
More categories:
