QKD and PQC paired in Japan and South Korea, UK-Singapore supervisors, Cisco and Cloudflare PQC plans, Quantinuum claims. Nine signals, six jurisdictions.

OMB M-26-15 migration plan deadline, IETF constrained-device PQC guidance, MAS-UK supervisory convergence, ETSI quantum readiness, ENISA Estonia roadmap.

PQC migration deadlines set by Germany and Singapore, AWS ML-DSA controls, a SEALSQ post-quantum TPM, DRDO QKD and Google magic states. Eight signals.

The week of 5 to 11 October put readiness evidence and capital on the same page. A federal auditor in Washington published a dated baseline showing that none of 24 US agencies had fully addressed all three preparatory practices for post-quantum migration. Europe's law-enforcement agency said timing uncertainty should not be the main concern and urged proactive crypto-agility. Microsoft and the IETF moved post-quantum certificate infrastructure forward on the testing and encod

Europol’s Harvest now, decrypt later report addresses a serious problem. Sensitive information encrypted today could become readable in the future if sufficiently capable quantum computers can break the public-key cryptography protecting it. Published on 7 October 2026, the report examines that exposure through a criminal and law-enforcement lens. The subject deserves attention. The report deserves scrutiny. It is a useful briefing for readers encountering the threat for the

PQC Governance Digest: Cut-off 9 October 2026 The US Government Accountability Office has put a number on federal PQC readiness: none of 24 major agencies had fully carried out three initial steps, namely inventory, funding and testing. Europol told organisations not to wait for certainty on quantum timing, and Microsoft and the IETF moved certificate infrastructure forward. Four signals cleared verification. Four regions returned null. 1. United States: GAO Sets the Federal

The week of 28 September to 4 October fixed the dates and moved the algorithms. The NSA restated its 2027 and 2030 requirements for National Security Systems, NATO attached quarters to its post-quantum cryptography work, and South Korea's science ministry opened a national migration competition. In the same days, Germany's BSI advised against Classic McEliece for new developments, a web infrastructure operator set out a certificate authority built for post-quantum Merkle Tree

BSI Pulls Back on Classic McEliece as NSA Restates PQC Deadlines A national cryptographic authority has told its constituency to stop building new systems on a post-quantum algorithm that, according to industry reporting, an international standard added only four months ago. On 1 October, Germany's BSI advised that Classic McEliece should not be used for new developments after cryptanalytic advances lowered its assessed security level. The same day, the NSA restated that new

The week of 21–27 September was an assurance week. Three independent strands tested the premises cryptographic programmes rest on: a preprint from UC San Diego and Inria forged 1024-bit RSA signatures without factoring the key, public cryptanalysts broke five of China's newly published post-quantum candidate designs within days, and ETSI published guidance treating every stage of the entropy pipeline as untrusted until verified. Around those tests, the compliance and capital

Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 21 September 2026 This week, quantum moved from research infrastructure into sovereign industrial policy. The United States committed over $2.2 billion in combined federal and private capital to quantum manufacturing and fault-tolerant development, NVIDIA launched the orchestration layer

Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 14 September 2026 The week of 8 September was a capital allocation event, not a research update. The U.S. Commerce Department awarded approximately $400 million in Other Transaction Agreements to four quantum hardware companies, each carrying federal equity stakes. In the same 48 hours, IonQ

Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 7 September 2026 This week in The Quantum Weekly the signal finally outran the noise. On 3 September, the G7 Cybersecurity Working Group published Preparing for the Post-Quantum Era: A Call to Action, reframing PQC migration as a collective infrastructure transition rather than a compliance e

The compliance problem nobody is treating as a compliance problem Post quantum cryptography keeps getting framed as a future technical upgrade. That framing is already outdated. GDPR does not care about quantum timelines, industry uncertainty, or vendor roadmaps. GDPR cares about foreseeable risk, state of the art, and negligence. Quantum risk satisfies all three today. The industry keeps waiting for quantum capability. Regulators are waiting for none of it. Why GDPR already

Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 31 August 2026 Stop assuming quantum progress moves in isolated pockets. This week, capital and hardware advanced on the same timeline across multiple regions. Pasqal listed on Nasdaq. Canada announced its largest quantum manufacturing investment to date. IBM expanded its hardware portfo

Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 24 August 2026 This was a week in which post-quantum cryptography stopped being a standards conversation and became a procurement, assurance and deployment conversation across three continents simultaneously. A Canadian module cleared the highest independent hardware validation tier avai

Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 17 August 2026 This week closed a loop opened the week before and started several new ones. Nine days after an AWS cryptographer's preliminary algorithm reopened questions about the mathematics beneath ML-KEM, a formal, machine-checked refutation from researchers at MIT, Stanford and Goo

UK Post-Quantum Cryptography Readiness: What the Evidence Actually Shows Every organisation holding data today with a shelf life beyond the next decade has a quantum problem, whether it has been named yet or not. Encrypted traffic intercepted now can be stored and decrypted later, once a cryptographically relevant quantum computer exists. That risk, harvest now, decrypt later, is why post-quantum cryptography readiness has moved from a research topic to a governance question

🌐The Global Signals That Actually Mattered (3 - 9 August 2026) Brian C CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 10 August 2026 This week's structural signal was theoretical provenance meeting sovereign procurement, moving on independent clocks. An Amazon Web Services cryptographer posted a preliminary polynomial-time quantum algorithm

The Netherlands sits in Tier 2 of SITG-Consulting’s Europe’s Post-Quantum Readiness 2026 assessment. That is an important distinction. The Netherlands has produced some of the strongest practical PQC migration guidance we found anywhere in Europe. But strong guidance is not the same thing as a governed national migration programme. Government Posture: Strong Guidance, No Binding Migration Programme The Dutch position is built around two important pieces of work. The PQC Migra

SITG-Consulting has published Europe’s Post-Quantum Readiness 2026: An Empirical Assessment of the EU-27, an independent assessment of the publicly verifiable state of post-quantum cryptography readiness across all 27 European Union Member States. The research asks a question that is becoming increasingly important for governments, regulators, financial institutions, critical infrastructure operators and organisations operating across European borders: How ready is Europe to