PQC Governance Digest: Cut-off 2 October 2026

Brian Couzens

Oct 3

4 min read

A grid showing the pulls backs and the name of the digest

BSI Pulls Back on Classic McEliece as NSA Restates PQC Deadlines

A national cryptographic authority has told its constituency to stop building new systems on a post-quantum algorithm that, according to industry reporting, an international standard added only four months ago. On 1 October, Germany's BSI advised that Classic McEliece should not be used for new developments after cryptanalytic advances lowered its assessed security level. The same day, the NSA restated that new National Security Systems must support quantum-resistant algorithms from 2027. For organisations treating PQC migration as a one-time algorithm swap, this week is the argument against that assumption.

Europe: a recommended algorithm loses ground, and the ECB names the risk

BSI's notice states that recent cryptanalysis indicates lower security levels for Classic McEliece than previously assumed. There is no practical attack on the parameter sets in Technical Guideline TR-02102-1, but BSI now recommends against the scheme for new developments and for planning new cryptographic applications. BSI has recommended Classic McEliece, like every post-quantum key agreement scheme, only in hybrid combination with a classical key agreement since 2020, which preserves classical security if the post-quantum component fails. FrodoKEM, ML-KEM and HQC are stated to be unaffected; FrodoKEM and ML-KEM should be preferred. A revised TR-02102-1 is planned for early 2027.

ISO/IEC 18033-2 Amendment 2, published in June 2026, is reported to have added Classic McEliece alongside ML-KEM and FrodoKEM. Organisations holding McEliece for long-lived keys should confirm it sits inside a hybrid construction and plan its replacement.

On 30 September, Frank Elderson, Vice-Chair of the ECB Supervisory Board, told the Basel Committee's conference of banking supervisors that quantum computing could become widely available by 2030 and that quantum risk to cryptography "is already a risk" because data can be collected now and decrypted later. No supervisory expectation or deadline accompanied the remark.

United States: the clock is restated, not extended

The NSA's 1 October release introduces no new document. Framed under Executive Order 14412, it restates CNSS Policy 15: starting in 2027, all new commercial National Security Systems must be capable of supporting quantum-resistant algorithms, and legacy systems that cannot are to be phased out by 2030. It warns of harvest-now-decrypt-later collection. NIST separately published CSWP 37B on 30 September, a status report on automating FIPS 140-3 module validation. In our view it bears on how quickly PQC modules can be certified after the FIPS 140-2 sunset, though the paper mentions neither and imposes nothing.

Neither OMB nor the Office of the National Cyber Director published in the window. OMB Memorandum M-26-15 still requires agencies to submit PQC migration plans by 22 October 2026, twenty days from this cut-off.

Alliance and ecosystem: NATO, Korea, Kazakhstan and the certificate supply chain

NATO released the public summary of its Quantum Technology Roadmap on 29 September, approved by Allies on 30 July. Line of effort 4 lists adoption of PQC standards as ongoing, a NATO Industrial Advisory Group study on industry readiness for quantum-resistant cryptography in Q2 2027, and an updated Action Plan for NATO's Response to the Quantum Threat to Cryptography in Q3 2027. Defence suppliers now have dated milestones.

South Korea's MSIT and KISA opened applications on 1 October for a national PQC transition competition and hackathon, with teams migrating cryptographic systems to PQC in a virtual environment. Applications close 30 October; awards follow on 26 November. In Kazakhstan, the Minister of Artificial Intelligence and Digital Development named a national roadmap for transition to PQC as a cybersecurity priority on 29 September, as reported by the state news agency.

On the supply side, Cloudflare announced on 29 September plans to become a public certificate authority, having signed a definitive agreement to acquire a GlobalSign root, with first production Merkle Tree Certificates planned for Q1 2027 and inclusion in Chrome's Quantum-resistant Root Store targeted for early 2027. Companion posts described CryptoLabe, an internal AI tool for cryptographic inventory not offered to customers, and launched PQ key exchange visibility in logs, IKEv2 downgrade protection for IPsec in beta, and experimental ML-KEM and ML-DSA in Workers. Cloudflare says it plans to be one of the first CAs to issue MTCs; that is Cloudflare's own aim.

Strategic implications

For organisations that have not started: first, algorithm selection is a lifecycle decision, not a procurement decision. BSI's reversal shows that inventory and hybrid deployment are the controls that absorb a change in the evidence. Second, deadlines are being restated, not softened. The NSA's 2027 and 2030 dates and OMB's 22 October submission are fixed points that supply chains will be measured against. Third, supervisors and infrastructure providers are moving together. When an ECB supervisor calls quantum risk current and a major infrastructure provider plans a CA around post-quantum issuance, the window for arguing that PQC is premature narrows.

Global sweep

Global: 2 signals. North America: 2. Europe: 2. Asia-Pacific: 2. India and South Asia: null. Latin America: null. Africa and Middle East: null. SAMA's August circular on quantum computing risk, reported to set inventory and assessment deadlines in December 2026 and March 2027, is queued for primary verification.

Previous editions

PQC Governance Digest: Cut-off 25 September 2026: www.sitg-consulting.com/post/fips-140-2-sunset-pqc-compliance-clock-accelerates

Disclaimer

Every signal in this digest was checked against the issuing body's own publication within the stated window, except where the text names a secondary source. Contextual references that rely on industry reporting are attributed. Regions marked null were scanned and returned no qualifying item. This digest is not legal or regulatory advice.