Two post-quantum cryptography (PQC) dates fall on consecutive days this winter. The end of 2026 is the date by which all EU Member States should start transitioning to post-quantum cryptography, under the coordinated roadmap the Member States published with the European Commission in June 2025. The next day, January 1, 2027, is the date from which the US National Security Agency (NSA) requires all new acquisitions for National Security Systems (NSS) to comply with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0).
The US date is a procurement requirement on vendors and system integrators: from that day, new NSS acquisitions must comply with CNSA 2.0 unless otherwise noted. The EU date is a recommendation to governments. Under the same roadmap, Member States should move high-risk use cases, including critical infrastructure, to PQC by the end of 2030. Neither date depends on a forecast of when a Cryptanalytically Relevant Quantum Computer (CRQC) will exist, which no one can give with confidence. Policymakers set both dates, and employers that sell into these systems will need engineering and compliance staff to meet them.
What January 1, 2027 requires in the US
CNSA 2.0 is the set of quantum-resistant algorithms NSA approves for systems that carry classified or mission-critical national security information. It specifies ML-KEM-1024 (formerly CRYSTALS-Kyber) for key establishment under FIPS 203 and ML-DSA-87 (formerly CRYSTALS-Dilithium) for digital signatures under FIPS 204. Software and firmware signing uses two stateful hash-based schemes, Leighton-Micali Signatures (LMS) and the eXtended Merkle Signature Scheme (XMSS), standardized in NIST SP 800-208. The suite also keeps AES-256 for encryption and SHA-384 or SHA-512 for hashing.
NSA’s CNSA 2.0 FAQ, now at version 2.2 (October 2026), states that the 2024 update to Committee on National Security Systems Policy 15 (CNSSP 15) requires CNSA 2.0 for new NSS acquisitions from January 1, 2027, unless otherwise noted. Version 2.2 adds an exception for cases where no compliant product exists: the buyer may accept a vendor’s contractual commitment to deliver a CNSA 2.0 update later, although firmware signing should be quantum-resistant at purchase. The FAQ sets two later dates. By December 31, 2030, equipment and services that cannot support CNSA 2.0 must be phased out unless otherwise noted. By December 31, 2031, CNSA 2.0 algorithms are mandated for use unless otherwise noted. NSA intends all NSS to be quantum-resistant by 2035.
The 2027 date applies to new acquisitions. Systems already fielded follow the category schedule in the same FAQ.
| Product category | Support and prefer CNSA 2.0 by | Use CNSA 2.0 exclusively by |
|---|---|---|
| Software and firmware signing | 2025 | 2030 |
| Web browsers, servers, and cloud services | 2025 | 2033 |
| Traditional networking equipment (VPNs, routers) | 2026 | 2030 |
| Operating systems | 2027 | 2033 |
| Niche equipment (constrained devices, large PKI) | 2030 | 2033 |
| Custom applications and legacy equipment | Update or replace by 2033 |
Vendors have less time than the date suggests. Systems designed for NSS programs today may not be delivered until after the gate. A vendor that wants to bid on an NSS program in 2027 needs the algorithms implemented and tested before the bid. In most cases it also needs them inside a validated cryptographic module.
Which employers the 2027 gate affects
The first employers affected are the companies whose products go into NSS. They make network equipment, operating systems, hardware security modules (HSMs), secure communications devices, and embedded systems. The defense primes and integrators that assemble those products into systems face the same requirement. Vendors and integrators will need four kinds of role to meet it.
Implementation engineers. Cryptographic and firmware engineers add ML-KEM-1024 and ML-DSA-87 to protocol stacks and products. They also build LMS or XMSS signing into secure boot and firmware update chains. Stateful hash-based signatures require the signer to track which one-time keys have been used, so this work includes key management design as well as code.
Validation and compliance engineers. NSA expects CNSA 2.0 algorithm implementations to be tested under NIST’s Cryptographic Algorithm Validation Program (CAVP), and the cryptographic modules that contain them to pass FIPS 140-3 testing in the Cryptographic Module Validation Program (CMVP). Commercial products used in NSS also need National Information Assurance Partnership (NIAP) validation. Vendors need engineers who have taken a product through these programs. They also need compliance specialists who can map a product to CNSA 2.0 and the relevant protection profiles.
Cryptographic inventory and architecture. Integrators have to find every use of RSA and elliptic-curve cryptography in the systems they deliver. Then they decide what replaces it and document the result for the government customer. The inventory analyst and quantum-safe architect roles in our guide to PQC careers describe this work.
Program and supplier management. Primes need people who can verify that every component in their supply chain will support CNSA 2.0 on delivery. The same people manage the suppliers that will not.
Many of these roles are on cleared programs. Expect US citizenship requirements and, for work on classified systems, a security clearance. Our guide to visas, relocation, and security clearances explains how clearances work in quantum hiring.
What the EU’s end-2026 milestone sets in motion
The EU roadmap is a set of recommendations to Member States, where the US rule binds vendors at the point of sale. The NIS Cooperation Group developed it in response to the Commission’s Recommendation of April 11, 2024. The Commission’s summary gives two dates. Member States should start the transition by the end of 2026, and the protection of critical infrastructure should move to PQC as soon as possible and no later than the end of 2030. In the roadmap itself, the 2030 milestone covers high-risk use cases. PostQuantum.com’s summary of the roadmap adds the third milestone: completion for as many systems as practically feasible by 2035. It also lists what the first phase involves, namely national strategies, assessments, awareness campaigns, and cryptographic inventories.
Two groups of employers need staff for the end-2026 milestone. National cybersecurity authorities and the ministries behind them need people who can write a national PQC strategy and assess which sectors are high-risk. They also need staff to coordinate inventories across government. The operators those strategies cover work in sectors such as energy, telecommunications, finance, and public administration. They need the same inventory and migration skills as US integrators, with the end of 2030 as the recommended date for their high-risk use cases.
Consultancies and system integrators serve both groups. They deliver much of the inventory and assessment work, and they need PQC specialists on staff before they can bid for it.
Roles on both sides of the Atlantic
| Role | What the work involves | Main driver |
|---|---|---|
| PQC implementation engineer | ML-KEM and ML-DSA in products and protocols | US 2027 gate |
| Firmware security engineer | LMS or XMSS signing in secure boot and updates | US 2027 gate |
| Cryptographic module validation engineer | CAVP algorithm testing and FIPS 140-3 module validation | US 2027 gate |
| Cryptographic inventory analyst | Finding and recording every use of vulnerable cryptography | Both |
| Quantum-safe security architect | Choosing replacements and sequencing migration | Both |
| PQC program lead | Running a migration program against dated milestones | Both |
| PQC policy and risk specialist | National strategies, sector risk assessment | EU end-2026 milestone |
These roles call for applied cryptography and secure engineering, plus the discipline to work through a large estate one system at a time. Security engineers move into them without a physics background, as our guide to quantum careers without a PhD explains.
What this means for candidates and employers
For the US gate, hiring managers look for demonstrable implementation experience. A cryptographer who has shipped ML-KEM in a product, or a firmware engineer who has built a hash-based signing chain, can point to work a hiring manager needs finished before January. EU employers working to the 2026 milestone look for a different profile: people who can run an inventory across a large organization and explain the risk to a regulator. Public-sector roles in Europe often require the national language as well as security vetting.
For employers, both deadlines are close enough that the hire has to be made before the work can start. Listings that name the standard, the parameter set, and the product layer attract the specialists who have done this work before. Our guide to writing a quantum job description covers how to state those requirements. Current roles are listed under quantum security and PQC.
