The Post-Quantum Clock Now Has Federal Deadlines

A June 2026 executive order put fixed dates on the post-quantum migration, and contractor requirements are coming with it. Records signed today have to survive those dates.

Signatures Signed Today Have to Survive 2030 and 2031.

In June 2026 the White House signed an executive order, Securing the Nation Against Advanced Cryptographic Attacks, that turns post-quantum cryptography from a roadmap into a schedule. Federal civilian agencies must migrate high-value systems to post-quantum standards on fixed deadlines: key establishment by the end of 2030 and digital signatures by the end of 2031, with acquisition rules directing contractor compliance expected by 2030. The standards are already published: ML-KEM (FIPS 203) for key establishment, ML-DSA (FIPS 204) for digital signatures and SLH-DSA (FIPS 205) as a hash-based alternative.

Most coverage focuses on encryption and the harvest-now, decrypt-later threat: adversaries collecting encrypted data today to decrypt when quantum computers mature. There is a second problem that gets less attention: signature longevity. A digital signature is a claim that a record existed and has not changed. If that signature relies only on classical algorithms, its evidentiary value has a shelf life. Contracts, compliance attestations, clinical records and audit trails routinely need to hold up for a decade or more, which runs straight past the federal migration dates.

The practical answer is dual signing: apply a classical signature and a post-quantum signature to the same record today. The classical signature satisfies today's verifiers. The post-quantum signature keeps the record provable after the transition. This is how CompassIP built Trust Ledger Anchoring: every anchor is signed with both ECDSA and ML-DSA-87 (FIPS 204) on FIPS 140-3 Level 3 validated HSMs, so a receipt minted today still verifies in 2035 without re-signing anything.

Federal standards tend to become market standards. If your records need to outlive the transition, the cheapest time to add post-quantum protection is when the record is created, not after the deadline arrives.

Source: Executive Order, Securing the Nation Against Advanced Cryptographic Attacks, whitehouse.gov, June 2026. This article is general information, not legal or compliance advice.