Post-Quantum Compliance Requirements:
What Organizations Need in 2026

Regulatory bodies worldwide are beginning to mandate post-quantum cryptography adoption. Understanding these requirements is essential for compliance planning and avoiding costly last-minute migrations.

US Federal Requirements

The US government has been most aggressive in setting PQC timelines:

Federal agencies must complete their cryptographic inventory by 2025 and begin active migration. Contractors and suppliers to the federal government face similar requirements.

Financial Services

Financial regulators are increasingly focused on quantum risk:

• FFIEC: Guidance on quantum computing risk assessment expected
• OCC: Including quantum risk in technology risk assessments
• SEC: Disclosure requirements for material quantum risks
• Basel Committee: Considering quantum risk in operational resilience frameworks

Financial institutions should anticipate explicit PQC requirements within 2-3 years.

Healthcare (HIPAA)

Healthcare data has long retention requirements, making it particularly vulnerable to harvest-now-decrypt-later attacks:

• Medical records must be retained for decades
• HIPAA security rule updates expected to address quantum threats
• OCR guidance may require quantum-resistant encryption for long-term data

Proactive healthcare organizations are already implementing PQC for new data.

European Union

EU regulatory landscape for PQC:

• ENISA: Published post-quantum cryptography recommendations
• eIDAS 2.0: May include PQC requirements for digital identity
• NIS2 Directive: Quantum risk likely to be incorporated in cyber requirements
• GDPR: "State of the art" encryption requirement may eventually require PQC

Industry Standards

Industry bodies are updating standards:

• PCI DSS: Monitoring quantum developments, guidance expected
• ISO 27001: Quantum risk assessment becoming part of best practices
• SOC 2: Auditors beginning to ask about quantum readiness

Timeline Recommendations

Based on current regulatory trajectory:

• Now: Begin cryptographic inventory and risk assessment
• 2026: Pilot PQC implementations for high-value systems
• 2027-2028: Production deployment for sensitive systems
• 2030: Anticipated deadline for many regulatory requirements

Documentation Requirements

Prepare documentation that auditors will expect:

• Cryptographic asset inventory
• Quantum risk assessment
• Migration roadmap and timeline
• Testing and validation procedures
• Incident response plans for cryptographic compromises

Practical Steps

Start your compliance journey:

• Inventory: Identify all systems using public-key cryptography
• Prioritize: Rank by data sensitivity and retention requirements
• Vendor assessment: Evaluate suppliers' PQC readiness
• Pilot: Test PQC in non-critical systems
• Document: Maintain records of your quantum readiness efforts

Compliance requirements for post-quantum cryptography are emerging rapidly. Organizations that start preparing now will be well-positioned when mandates become explicit.