🌐 Quantum Weekly - The Global Signals That Actually Mattered (12 - 18 October 2026)

The week of 12 to 18 October was about dates being written into national policy, and about the supply side that has to meet them. Germany's interior ministry, digital ministry and federal cyber authority carried the EU roadmap timelines into a joint national guideline. Singapore's Cyber Security Agency reaffirmed 2031 for critical information infrastructure, set out 2035 guidance for other exposed organisations and launched pilot funding. The two instruments differ in form and legal force. On the supply side, AWS published an end-to-end ML-DSA signing and policy guide, Lattice claimed a production-ready post-quantum firmware-resilience stack, and SEALSQ previewed a post-quantum TPM and secure element whose stated certification pathways remain incomplete. India's defence research organisation tested quantum key distribution on a live test-range network. Google reported a fault-tolerance building block working on hardware at small scale, and a Barcelona hardware developer closed a Series A first round backed by an industrial defence group and a state fund. Confirmed signals came from Germany, Spain, Switzerland, the United States, Singapore and India. None of the eight changes the evidence on when a cryptographically relevant quantum computer will exist.

🇩🇪 Germany - Three Federal Bodies Carry the EU PQC Timelines into a National Guideline: High-Risk Systems by End-2030

National Policy / EU Roadmap Implementation / Crypto-Agility

The Detail: On 12 October 2026 the Federal Office for Information Security (BSI), the Federal Ministry of the Interior (BMI) and the Federal Ministry for Digital Transformation and Government Modernisation (BMDS) jointly published a guideline on the national implementation of the EU roadmap for the transition to post-quantum cryptography.

• Audience: BSI states the guideline is aimed in particular at federal, state and municipal administrations, and at organisations and companies, including operators of critical infrastructure.

• Timelines: BSI states the guideline confirms the European roadmap. High-risk use cases should move to quantum-safe methods as early as possible, with migration for those systems completed by the end of 2030 at the latest. The overall transition should be largely complete by 2035.

• Near-term steps: heise's reporting on the guideline text states that it also recommends preparatory action by the end of 2026, including planning, an initial cryptographic inventory, first migration measures and the setting of binding dates where possible. These steps are not listed in the BSI press release; they are attributed to that reporting.

• Measures: the recommended measures include clear responsibilities and binding deadlines for the transition, PQC in line with the state of the art, systematic assessment of quantum risk anchored in risk management, and early involvement of manufacturers and supply chains.

• Crypto-agility: BSI describes it as particularly important to design system architectures, procurement processes and risk management so that cryptographic methods or their settings, such as key lengths, can be exchanged quickly and in a controlled way. BSI links this to AI, which it states is increasingly accelerating methods of attack on cryptographic procedures.

• Status: the document is a guideline (Leitlinie). The press release identifies no sanction and no new statutory mandate.

Why it matters: The EU dates now sit in a German national document carrying the names of the interior ministry, the digital ministry and the national cyber authority. The document recommends; it does not legislate. The practical lever is procurement. The guideline names procurement processes as a place where agility must be designed in and recommends binding internal deadlines. My expectation is that replaceability and migration evidence will feature more prominently in public-sector and KRITIS procurement as departments operationalise the guideline. The end-2026 preparatory steps mean 2030 is not a remote date for planning purposes: organisations operating in Germany should treat it as the planning date for high-risk systems and record which systems they classify as high-risk, and why. In "Cryptographic Agility Is a Governance Discipline, Not a Feature" (16 October 2026) I set out why agility claimed without inventory, policy enforcement and tested rollback is a roadmap, and I tracked the guideline's wording and legal status in my "PQC Governance Digest: Cut-off 16 October 2026" (17 October 2026). The Cryptographic Transformation and Modernisation methodology structures that work from executive mandate to evidence.

🇺🇸 United States - AWS Publishes an End-to-End ML-DSA Signing Guide and Ties It to CNSA 2.0 and the EU Cyber Resilience Act

Software Supply Chain / ML-DSA / Policy Enforcement

The Detail: On 12 October 2026 the AWS Security Blog published a two-part series, "Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA" and "Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM".

• Part 1 combines ML-DSA keys in AWS KMS, ML-DSA certificate hierarchies in AWS Private CA and ML-DSA trust anchors in IAM Roles Anywhere into a signing pipeline for binaries, container images and software bills of materials. Part 2 is aimed at security and governance teams and turns those algorithm choices into preventive and detective controls.

• AWS cites CNSA 2.0 (new National Security System acquisitions compliant at deployment from 1 January 2027, and exclusive use of CNSA 2.0 algorithms for software and firmware signing by 2030) and the EU Cyber Resilience Act (full effect on 11 December 2027) as the drivers.

• AWS notes that CNSA 2.0 permits only the ML-DSA-87 parameter set for ML-DSA signatures. The ML-DSA-65 set used in its code-signing examples is, in AWS's words, appropriate for commercial workloads but not permitted on National Security Systems. AWS also notes that CNSA 2.0 approves the stateful hash-based schemes LMS and XMSS for software and firmware signing, which the guide does not cover.

• AWS describes the series, "as of Oct 2026", as "the first end-to-end guide from any cloud provider for post-quantum signing across the software supply chain". That is AWS's claim.

• The underlying service capabilities are not new this week: AWS added ML-DSA to KMS in June 2025, to Private CA in November 2025 and to IAM Roles Anywhere in March 2026.

• On 13 October 2026 the NSA listed version 2.2 ("October 2026 Update") of its CNSA 2.0 and Quantum Computing FAQ on its cybersecurity guidance index. The document link served the December 2024 version 2.1 when retrieved for this edition, so the v2.2 changes are not reported here. The CNSA 2.0 positions AWS cites are those of v2.1, which also states that equipment unable to support CNSA 2.0 must be phased out by 31 December 2030 and that CNSA 2.0 algorithms are mandated by 31 December 2031, unless otherwise noted. I covered the NSA's 1 October National Security System measures in my PQC Governance Digest of 2 October.

Why it matters: Signatures carry the longer exposure. AWS's own example is firmware signed with ECDSA in 2026 and verified on every boot for a 15-year device life. A cloud provider has now documented, in public, how algorithm policy can be enforced across its own service APIs, which gives procurement and audit teams a reference for what "enforced" should look like. The CRA does not prescribe ML-DSA; AWS presents one implementation route for software-integrity controls. Two limits apply. AWS states in Part 2 that the controls operate on AWS service APIs and "don't and can't govern cryptography that runs on compute you control", and that imported or uploaded certificate material is not algorithm-aware. The parameter set is a policy decision with a jurisdictional answer: an organisation selling into US National Security Systems and into EU commercial markets needs both answers written down, and suppliers to National Security Systems should read FAQ v2.2 against v2.1 before quoting either. Key exchange has moved faster than authentication on the public web; in "How Post-Quantum Cryptography Works in TLS 1.3: The Hybrid Handshake Explained" (19 October 2026) I set out why certificates and handshake signatures are still classical. In "NIST SP 800-185: Cryptographic Lifecycle Management Beyond PQC" (13 October 2026) I argued that a PQC programme needs a standing owner for cryptographic change outside the migration itself. Mapping such controls against a defined assurance baseline is the purpose of the Quantum Cryptographic Assurance Standard (QCAS).

🇺🇸 United States - Lattice Ships Sentry 5.0 and Claims the First PQC-Enabled Platform Firmware Resilience Stack

Platform Root of Trust / Firmware Resilience / Vendor Claims

The Detail: On 12 October 2026 Lattice Semiconductor (NASDAQ: LSCC), in a release datelined Hillsboro, Oregon, announced version 5.0 of its Lattice Sentry solution stack, which it describes as "the industry's first post-quantum cryptography (PQC)-enabled Platform Firmware Resilience (PFR) and attestation solution". That is Lattice's claim.

• Algorithms: Lattice states the stack supports ML-DSA, LMS and XMSS for authentication and ML-KEM for key exchange, which it describes as CNSA 2.0-compliant, alongside classical ECDSA and AES-GCM.

• Functions: NIST SP 800-193 protection, detection and recovery for BIOS, BMC and other board firmware; crypto-agility with anti-rollback protection; secure updates, key provisioning, revocation and decommissioning; SPDM-based device attestation; DICE-anchored device identity; and multi-device attestation for disaggregated racks.

• Composition: the stack combines Lattice FPGAs with AMI's Tektagon platform firmware software. Lattice states that demo boards and custom design services are available now, and describes the stack as a "validated, production-ready path to quantum-resistant security". The release names no FIPS 140-3 or CMVP certificate.

• Lattice demonstrated the stack at the OCP Global Summit in San Jose from 13 to 15 October.

Why it matters: Lattice and SEALSQ addressed the same layer in the same week: the hardware root of trust that anchors boot, firmware updates and attestation. The NSA's CNSA 2.0 FAQ treats firmware signing as the urgent case because, in its words, "firmware-signing algorithms are frequently locked in for the life of a system". The two releases describe different states. Lattice claims a production-ready stack with demo boards today; SEALSQ describes certification in progress and secure-element samples in 2027. Neither names a validation certificate. Data-centre and AI-infrastructure buyers should read "CNSA 2.0-compliant", "validated" and "industry-first" in a vendor release as claims until they are mapped to a certificate number, a module version and the configuration in which the post-quantum functions run. The LMS and XMSS support is the practical point for National Security System suppliers, because CNSA 2.0 approves those schemes for firmware and software signing now. The questions that settle such claims are the ones I set out in "Quantum Washing: Four Tells That a Post-Quantum Claim Is Marketing, Not Migration" (15 October 2026).

🇸🇬 Singapore - CSA Reaffirms 2031 CII Target, Sets 2035 Guidance for Other Exposed Organisations and Launches Pilot Funding

Sovereign Timeline / Critical Infrastructure / Pilot Funding

The Detail: On 13 October 2026 Senior Minister K Shanmugam launched Singapore's Cybersecurity Strategy 2026 at Singapore International Cyber Week. Its third pillar commits the Government to "accelerate national quantum-safe migration". On 14 October 2026 the Cyber Security Agency of Singapore (CSA) set out the migration timeline, announced by Minister Josephine Teo.

• Timeline: CSA states that migration of Critical Information Infrastructure (CII) systems should be completed by 2031, and that other organisations exposed to the quantum threat are encouraged to complete migration by 2035. CSA names organisations holding information that must remain confidential for many years, and those providing services such as communications and digital transactions. The 2031 CII milestone is not new: CSA states it issued that guidance to CII owners in June 2026. The in-window elements are the non-CII guidance, the 2035 recommendation, the grant and the public announcement.

• Planning and procurement: CSA's grant page states that CII owners must submit migration plans by 31 March 2027 and complete migration of CII systems by 31 December 2031, and that new procurement of CII systems must factor in quantum-safe considerations from 2028. Non-CII organisations exposed to quantum risk are recommended to have a plan in place by end-2027 and to complete migration by 2035.

• Quantum-Safe Kickstarter Grant: applications are already open. The programme runs from 1 November 2026 to 31 October 2027, with pilots lasting up to six months. The press release describes it as open to all organisations, with priority to CII owners; the grant page limits eligibility to non-government organisations registered and incorporated in Singapore, for activity within their Singapore-based operations. The grant page states it covers up to 70% of project costs, with a 30% cash co-contribution that excludes in-kind contributions such as internal manpower. Prioritised use cases are end-to-end migration of an application or system, cryptographic discovery and inventory, and migration of operational technology, legacy and infrastructure-heavy systems. Participants must report their learnings and demonstrated impact.

• CSA also released an updated Quantum Readiness Index and Quantum-Safe Handbook following public consultation.

• CSA states that it remains uncertain when quantum computers will be capable of breaking current methods.

Why it matters: Singapore has paired a timeline with money, a procurement trigger and a reporting obligation. The 2028 procurement requirement for new CII systems is the governance lever: it moves quantum-safe considerations into purchasing decisions three years before the 2031 completion date. The required pilot reports could create a dated body of local implementation evidence, subject to what CSA publishes and how organisations share outcomes; CSA states it may publish aggregated or anonymised insights, and that individual reports will not be published without consent. The CII date sits one year after the EU end-2030 target for high-risk systems; in my assessment, a group operating in both jurisdictions should plan to the earlier date and record the reasoning. Eligibility needs checking before applying, because the press release and the grant page describe it differently, as I noted in my "PQC Governance Digest: Cut-off 16 October 2026" (17 October 2026). Discovery funded without a mandate produces an inventory with no owner; in "Why 'Start With Discovery' Is the Wrong First Step in PQC Transformation" (12 October 2026) I set out why the executive mandate comes first. A PQC Discovery Sprint run inside that mandate maps directly onto CSA's second prioritised use case.

🇮🇳 India - DRDO Tests a Quantum Key Distribution Platform on a Live Defence Test-Range Network

Defence Communications / QKD / Sovereign Capability

The Detail: On 14 October 2026 India's Defence Research and Development Organisation (DRDO) stated on its official X account that it had "successfully configured and tested Quantum Key Distribution (QKD) platform in the live network of the dynamic test ranges at Proof & Experimental Establishment (PXE), Chandipur", describing the result as advancing India's capabilities in quantum-secured communications.

• Secondary coverage reports that the platform was developed under DRDO's MCC cluster with Bengaluru-based Taqbit Labs as production partner, and that the use case is protection of data from weapon trials. These details are attributed to that coverage.

• The DRDO statement retrieved for this edition does not give link length, key rate or error rate. One outlet published performance figures that no other source carried; they are not repeated here.

Why it matters: A defence test range is a bounded environment under one organisation's control, which in my assessment is where QKD has its strongest case. The test does not alter the position for commercial estates. QKD distributes keys; it does not authenticate the parties, so it still depends on authenticated classical channels, and the NSA's post-quantum resource hub states that quantum cryptographic solutions are limited compared to post-quantum algorithms. Indian enterprises and their foreign counterparties should read this as sovereign defence capability building, run in parallel with, not in place of, PQC migration of authentication and signatures.

🇪🇸 Spain - Indra and the State's Technology Fund Back a €19.6 Million First Close for Fluxonium Developer Qilimanjaro

Capital Markets / Sovereign Capital / Hardware Industrialisation

The Detail: On 14 October 2026 Qilimanjaro Quantum Tech, in a release datelined Barcelona, announced a €19.6 million first close of its Series A.

• Indra Group led the round through IndraMind with €10 million. The Spanish Society for Technological Transformation (SETT), under the Ministry for Digital Transformation and Public Administration, invested a further €9.6 million.

• The company expects to complete the round in the final quarter of 2026, with Avançsa and other existing investors participating.

• Qilimanjaro states the funds will scale and industrialise its quantum computers, advance new chip generations and increase manufacturing and deployment capacity. Its systems use superconducting fluxonium qubits in analog and digital processors.

• The company states that three of its systems operate inside the Barcelona Supercomputing Center, that it has deployed eight systems and that it employs 80 people. It describes itself as "the only Spanish full-stack quantum computing company". That is the company's claim.

• CEO Marta P. Estarellas describes the combination as "sovereign capital and industrial capital". IndraMind's managing director links the investment to solutions for defence, security and industry.

Why it matters: A listed defence and technology group and a state fund now sit together on one quantum hardware cap table. That shapes who can buy, who can invest later and what export and ownership conditions attach to the technology. Regulated buyers taking a service from a supplier of this size carry the third-party risk themselves: continuity, exit, data access and audit rights must be settled before reliance, whatever the shareholder profile. In "Stop Pitching the Product, Start Proving It: Introducing the SITG Founder Programme" (14 October 2026) I set out the evidence regulated buyers ask of early-stage suppliers. The same questions sit inside Cyber Risk and Resilience work on the buyer's side.

🇨🇭 Switzerland - SEALSQ Previews a Post-Quantum TPM and Secure Element; Stated Certification Pathways Remain Incomplete

Hardware Root of Trust / Certification / Supply Timelines

The Detail: On 14 October 2026 SEALSQ Corp (NASDAQ: LAES) announced, in a press release datelined Geneva, that it and its subsidiary IC'Alps will unveil three post-quantum developments at electronica 2026 in Munich, 10 to 13 November.

• VaultIC409: a secure element built on SEALSQ's QS7001 platform, which SEALSQ states is "undergoing Common Criteria EAL5+ certification". It supports classical and post-quantum algorithms including ML-KEM and ML-DSA. SEALSQ states engineering samples are planned for the second quarter of 2027.

• QVault TPM: a Trusted Platform Module that SEALSQ states brings the Trusted Computing Group's post-quantum command set into silicon, generating and holding ML-DSA and ML-KEM keys on-chip alongside RSA and ECC. SEALSQ states the product line "is on a certification path covering FIPS 140-3 and TCG". It states wolfSSL has added wolfTPM support for QVault.

• QASIC: a post-quantum custom ASIC design offer from IC'Alps, based in Grenoble and Toulouse.

Why it matters: The TPM anchors secure boot, device identity and attestation, so it sets the pace of hardware refresh. Devices bought this year will still be in service at the 2030 and 2031 dates now written into US, German and Singaporean policy. For the secure element, the release gives certification as in progress and engineering samples in Q2 2027. For the TPM, it gives a certification path covering FIPS 140-3 and TCG, with no certificate number and no sample or certification dates. Claimed capability, engineering samples, certification targets and validated shipping products are materially different states. "Undergoing" and "on a certification path" describe intent; a certificate number on the NIST or Common Criteria register is the evidence. Procurement teams should ask in writing whether the exact TPM and firmware in a contract can gain post-quantum attestation by update, and what the replacement path is if not. In "Quantum Washing: Four Tells That a Post-Quantum Claim Is Marketing, Not Migration" (15 October 2026) I set out the three questions that settle a vendor claim, and in "Independent Validation: Why Compliance Is Not Enough" (18 October 2026) I explained why a product using approved algorithms is not a validated module. A FIPS 140-3 Gap Analysis tests those claims against the register.

🇺🇸 United States - Google Reports Magic State Cultivation Working on Willow, Easing One Fault-Tolerance Bottleneck at Small Scale

Hardware Architecture / Error Correction / Resource Estimates

The Detail: On 15 October 2026 Google Quantum AI reported a paper published that day in Science showing magic state cultivation working on its Willow processor.

• Google states the protocol reduced errors about 40-fold relative to un-cultivated states and produced T-states with a logical fidelity of 99.99%. The paper's abstract reports a state fidelity of at least 0.9999(1) while retaining 8% of attempts.

• Magic states are a consumable resource needed for universal fault-tolerant computation. Google cites estimates that up to 95% of a quantum computer's capacity might otherwise be needed to produce them.

• Google states it grafted states from a distance-3 colour code to a distance-5 surface code on the same hardware.

• The underlying work first appeared as an arXiv preprint (2512.13908) in December 2025; the peer-reviewed publication is the in-window event.

• Google states that cultivation still needs to be demonstrated at larger scale, and that "plenty of technical challenges remain".

Why it matters: Published resource estimates for attacks on RSA and elliptic-curve cryptography assume that magic states can be produced cheaply at scale. A hardware result that lowers that cost moves one input to those estimates, and risk functions should record it as a dated, peer-reviewed milestone. It is a component demonstration at small code distance, not a demonstration of cryptanalytic capability, and the 99.99% figure describes the prepared states, not a working computer. The migration case does not depend on this result; it rests on dates regulators have already published. In "The Case for Cryptographic Modernisation" (14 October 2026) I set out why post-quantum migration is one more forced change on a list that unmanaged cryptography is already paying for.

🌐 Global Sweep - The Dates Were Written Down; the Supply Is Still Being Built

Ecosystem / Capital Markets / PQC Infrastructure / Hardware Architecture / Sovereign Security

The Detail:

• Sovereign security: Germany and Singapore advanced national quantum-safe migration timelines through different instruments and with different legal force. Germany's guideline carries the EU roadmap targets (end-2030 for high-risk systems, 2035 overall) as recommendations. Singapore restated its June 2026 CII milestones (plans by 31 March 2027, procurement from 2028, completion by end-2031) and recommended 2035 to other exposed organisations. Both name supply-chain or vendor engagement, and Singapore attached grant funding and reporting. India's DRDO tested QKD on a defence test-range network.

• PQC infrastructure: AWS documented ML-DSA signing and algorithm-policy enforcement across its own services. Lattice claimed a production-ready PQC firmware-resilience and attestation stack with demo boards available now. SEALSQ previewed a post-quantum TPM and secure element whose certification is in progress and whose secure-element samples are planned for 2027. Neither release names a validation certificate. The NSA listed version 2.2 of its CNSA 2.0 FAQ on 13 October; its text could not be retrieved for this edition and it is not counted. On the standards track, revision 23 of the IETF X.509 composite ML-KEM draft was posted on 14 October; I recorded its entry to the RFC Editor Queue on 12 October in my digest. It is noted here and not counted as a signal.

• Hardware architecture: Google reported magic state cultivation on Willow in a peer-reviewed paper, a fault-tolerance component at small scale.

• Capital markets: Qilimanjaro closed €19.6 million with an industrial defence group and a state fund as investors.

• Regions with no confirmed in-window signal meeting the primary-source standard: Canada; the United Kingdom; France, Netherlands, Finland, Sweden and Denmark; GCC (Qatar, UAE, Saudi Arabia, Bahrain, Kuwait, Oman); Japan, China, South Korea, Australia and Taiwan; Africa (South Africa, Nigeria, Kenya, Ghana); Latin America (Brazil, Chile, Mexico, Colombia). This records that no signal was verified to the standard; it does not show that nothing occurred.

• Geographic position: eight signals from six jurisdictions. Europe supplied three (Germany, Spain, Switzerland), the United States three, Asia-Pacific two (Singapore, India).

• Standards bodies and regulators with no confirmed in-window PQC output identified: NIST, ENISA, UK NCSC, ANSSI, ETSI, CRYPTREC, ASD.

Why it matters: Policy and supply moved at different speeds in the same seven days. Two governments advanced migration timelines and named procurement and suppliers as the route to meeting them, while the vendor side published a cloud signing guide, a hardware root of trust still in certification and a fault-tolerance component result. The gap between a dated obligation and a certified, shipping product is where migration risk now sits, and closing it starts in procurement and governance.

🔮 SITG-Consulting COMMENT - THE WEEK'S REAL SIGNAL

The week's highest-consequence signal is convergence on dates. Germany and Singapore, through different instruments and with different legal force, both point to 2035 as the outer date and place high-risk or critical systems at 2030 or 2031. Alongside the US federal dates, a multinational now plans against three governments working to similar arithmetic. In my assessment, the date is no longer the uncertain variable. Certified, fielded supply is.

• Germany: the guideline names procurement processes and supply chains. Expect replaceability and migration evidence to feature more prominently in public-sector and KRITIS procurement as departments operationalise the guideline, and expect suppliers who cannot evidence agility to be scored down.

• Singapore: CII plans due by 31 March 2027, quantum-safe considerations in new CII procurement from 2028 and completion by 2031, with a grant that co-funds discovery and OT pilots. The pilot reports could become regional evidence if CSA publishes the aggregated insights it says it may share. Organisations that apply without an executive owner risk producing an inventory nobody acts on.

• AWS: a cloud provider has published what enforced algorithm policy looks like on its own APIs, including where its controls stop. That is a usable benchmark for audit, provided boards remember the boundary: customer-run cryptography is outside it.

• Lattice and SEALSQ: in this evidence set, the hardware root of trust is where vendor claims run furthest ahead of published evidence. Lattice claims a production-ready stack today; SEALSQ's TPM is on a certification path and its secure element samples in 2027. Neither names a validation certificate, and both sit against 2030 and 2031 dates. Every device refresh signed this year needs a written answer on post-quantum attestation.

• Google: a peer-reviewed fault-tolerance result belongs in the risk register as a dated input to resource estimates. It does not change a migration plan already anchored to regulatory dates.

The defining shift: the question for boards has moved from "when" to "can our suppliers deliver in time, and how will we know". In "Quantum Washing: Four Tells That a Post-Quantum Claim Is Marketing, Not Migration" (15 October 2026) I set out the questions that separate a certified capability from a roadmap. Quantum Trust and PQC Assurance Services put supplier claims through that test before they enter a critical path.

⚠️ Important - What Was NOT Missed

• No credible evidence of near-term cryptographically relevant quantum advantage. Google's own release states that magic state cultivation still needs demonstrating at larger scale. CSA states the timing of a capable machine remains uncertain.

• No breakthrough reducing the need for hybrid PQC or for migration of signatures.

• MITRE's September-dated PQC Capability Development Report, made publicly available by the Post-Quantum Cryptography Coalition during the week, states that its research found no evidence of commercially available PQC hardware TPM implementations as of July 2026. It is context, not a 15 October market measurement, and it is not counted.

• Italy: D-Wave announced on 15 October the arrival of an Advantage2 annealing system in Lombardy for installation, funded by Swiss Quantum Technology and to be accessible once installed. The item is not counted because it has no direct PQC, cryptographic-governance or fault-tolerant-computing implication.

• The Quantum Alliance, an open-standards group of nine blockchain organisations, was reported as launched in Lisbon on 15 October 2026. No founding-member primary announcement was retrieved; held pending.

• A community submission to the ECDSA.Fail benchmark on 13 and 14 October reported a secp256k1 point-addition circuit below 900 logical qubits. It is a leaderboard entry, not peer reviewed, and no full attack estimate built on it has been published. Not counted.

• India's Technology Development Board agreement with QNu Labs for ₹150 crore was reported in mid-October coverage, but the date of the official release could not be confirmed inside the window. Excluded.

• Quanfluence's USD 10 million round (7 October 2026) and Taiyi Quantum's funding announcement (10 October 2026) appeared in coverage dated 12 and 13 October. Both primary dates fall before the window. Excluded.

• Coinbase's post-quantum custody work appeared in coverage during the week, with no dated Coinbase primary inside the window. Excluded.

• On 14 October GAO reissued GAO-27-108740, covered in the previous edition, with clarifying revisions, and ECB Supervisory Board Vice-Chair Frank Elderson referred to quantum risk to cryptography in a climate-risk keynote without announcing any supervisory expectation. I recorded both in my digest. Neither is counted.

• Forward context: OMB M-26-15 agency PQC migration plans are due on 22 October 2026; the IETF constrained-devices PQC draft is on the IESG telechat agenda for 22 October; CSA's Kickstarter Grant programme period begins on 1 November, with applications already open; electronica runs from 10 to 13 November.

  
  

⚠️ Disclaimer

This newsletter is produced by SITG-Consulting for informational purposes only. It does not constitute professional advice, whether legal, technical, regulatory, or otherwise. The content reflects publicly available information and the author's independent analysis as of the date of publication. Readers should verify all claims independently and seek qualified professional counsel before making decisions based on this material. SITG-Consulting accepts no liability for actions taken or not taken based on the contents of this newsletter.

Previous edition: https://www.sitg-consulting.com/post/quantum-weekly-the-global-signals-that-actually-mattered-5-11-october-2026 Full archive: https://www.sitg-consulting.com/blog