United States: Federal PQC Deadlines, NYDFS, SEC And The State AI Patchwork

The United States has one of the most detailed national post-quantum programmes, with dated milestones in a presidential executive order. It is easy to read too much into that. As of October 2026, those deadlines bind federal agencies, and a rule that would require federal contractors to meet NIST’s post-quantum standards by 2030 has been ordered but not yet proposed. Private companies are not under a general post-quantum mandate.

What private firms do face are sector rules on encryption, asset inventories and incident disclosure, set by regulators such as the New York State Department of Financial Services (NYDFS), the Securities and Exchange Commission (SEC) and the Federal Trade Commission (FTC). This article maps both layers and labels each item by its legal force. It is general information, not legal advice. For the full federal chronology and NSA’s CNSA 2.0 dates, see Cryptography Compliance.

Who Is Bound By What

The US picture is easiest to read as rings, from the most tightly regulated systems outwards.

Federal Agencies: The Binding Core

Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, was signed on 22 June 2026. Section 4(b) directs the Office of Management and Budget (OMB) to issue guidance that requires agencies to move all high value assets and high impact systems to post-quantum key establishment by 31 December 2030 and to post-quantum digital signatures by 31 December 2031.¹ Strictly, the dates bind agencies through that OMB guidance rather than directly. OMB’s Memorandum M-26-15, issued two days later, builds them into its phases (key establishment for these systems in 2028 to 2030, signatures in 2031) and sets the objective of reducing as much quantum risk as feasible by 31 December 2030.² Status: Binding on federal agencies, excluding national security systems: M-26-15 says it does not apply to them, and the order leaves them out of its inventory review.²¹

Under M-26-15, agencies must submit a post-quantum migration plan within 120 days, which falls on 22 October 2026, and must support TLS 1.3 or a successor no later than 2 January 2030, a date first set by Executive Order 14306. The memo describes five phases that agencies should follow: strategy and discovery in 2026 to 2027, pilots in 2027 to 2028, prioritised key establishment migration in 2028 to 2030, signature migration in 2031, and full migration by 2035. Plans must align with NIST IR 8547, which is still an initial public draft.² Status: Binding on agencies. The memo’s recommendation that inventory data feed a central cryptographic bill of materials (CBOM) is Guidance within it.

The inventory duty itself is older. The Quantum Computing Cybersecurity Preparedness Act (Public Law 117-260) requires OMB guidance directing agencies to keep a current inventory of information technology vulnerable to quantum decryption, and agencies to report it, and excludes national security systems.³ Status: Binding on agencies.

Contractors And Vendors: What Is Coming

Several parts of the executive order reach beyond government. Section 5(d) gives CISA, working with NIST, 270 days to publish the minimum elements of a CBOM, due around 19 March 2027. Section 6(c) gives the FAR Council 180 days, to about 19 December 2026, to propose a rule requiring covered contractors to comply with NIST’s FIPS standards, including the post-quantum ones, by 31 December 2030. Section 6(d) adds a second proposed rule within 270 days so that contractor vulnerability disclosure programmes take in reports of cryptographic weaknesses.¹ As of October 2026, neither FAR rule has been published. Status: Binding on the agencies that must act; for contractors it will be a Draft until the rule is proposed and finalised.

Procurement is already shifting. In January 2026 CISA published a list of product categories where post-quantum support is widely available, such as cloud platforms, browsers and web servers, messaging and data-at-rest encryption, and M-26-15 says agencies should require post-quantum capability when buying in those categories.⁴ Status: Guidance that steers federal purchasing.

Private Sector: Encryption And Disclosure Rules

For companies outside government, the binding hooks are sector rules that require strong encryption, not post-quantum migration.

NYDFS’s cybersecurity regulation, 23 NYCRR Part 500, as amended in November 2023, requires a written encryption policy that meets industry standards for nonpublic information in transit over external networks and at rest. Since 1 November 2025 it has also required a complete, documented asset inventory and multi-factor authentication for anyone accessing information systems, subject to limited exemptions.⁵ Status: Binding on NYDFS-regulated entities. This review found no NYDFS quantum guidance as of October 2026, but the asset inventory and the encryption policy are natural starting points for a cryptographic inventory.

The FTC Safeguards Rule requires covered financial institutions to encrypt customer information in transit over external networks and at rest, with compensating controls approved by a qualified individual where that is not feasible.⁶ Status: Binding. In health care, a proposed update to the HIPAA Security Rule would make encryption of electronic protected health information mandatory; it has been moved to the long-term agenda, with final action projected for July 2027.⁷ Status: Draft.

The SEC works through disclosure. Since 2023, public companies must report material cybersecurity incidents on Form 8-K within four business days of deciding they are material, and describe their cyber risk management annually.⁸ Banking and securities industry groups petitioned on 22 May 2025 for the incident item to be rescinded;⁹ this review found no proposed amendment as of October 2026. Status: Binding. The SEC’s amended Regulation S-P adds a duty to run an incident response programme. The notice clock starts when a firm learns that customer information has been, or probably has been, reached or used without permission. From then, the firm must tell the people whose sensitive information is, or probably is, affected as quickly as it can, and within 30 days at most. Limited exceptions apply. Compliance has applied from 3 December 2025 for larger firms and 3 June 2026 for smaller ones.¹⁰ Status: Binding.

Banking supervisors have said little on quantum. The OCC’s June 2026 cybersecurity report says banks should consider how to monitor quantum developments.¹¹ Status: Guidance. No Federal Reserve, FDIC or FFIEC post-quantum expectation was found as of October 2026.

A Brief Word On AI

There is no comprehensive federal AI statute. Executive Order 14365 of December 2025 set up a Department of Justice task force to challenge state AI laws, but it does not itself override them.¹² Several states have acted. Texas’s AI governance act took effect on 1 January 2026,¹³ California enacted a frontier AI transparency law (SB 53) in September 2025,¹⁴ and laws in Colorado and New York apply from 1 January 2027,¹⁵¹⁶ with New York’s frontier AI rules overseen by an office within NYDFS. Status: Binding under state law. AI Regulation At A Glance compares these with other regions, and AI Governance And Regulation covers frameworks in depth. For the global comparison, see the overview.