What does the US post-quantum executive order actually require — and who does it reach?

Two dates, and a silence. As of November 3, 2026, Executive Order 14412 — “Securing the Nation Against Advanced Cryptographic Attacks”, signed June 22, 2026 — sets the first binding post-quantum deadlines for US federal civilian systems: post-quantum key establishment on high-value and high-impact systems by December 31, 2030, and post-quantum digital signatures on those same systems by December 31, 2031 (EO 14412, Sec. 4(b)). Its implementing memo, OMB M-26-15 (June 24, 2026), made every agency’s migration plan due on October 22, 2026 — and as of today, neither OMB nor the Office of the National Cyber Director has published how many plans arrived. The only measured federal baseline is GAO report GAO-27-108740 (October 2026): none of the 24 CFO Act agencies had fully addressed GAO’s three post-quantum transition practices. Rosetta Quantum reads the fine print, section by section, so a security team can cite the order itself — not a vendor’s summary of it.

What does Executive Order 14412 actually order — and by when?

Two binding migrations, wrapped in a scaffold of dated deliverables. The core is Section 4(b): agencies will have to move their high-value assets (HVAs, per OMB M-19-03) and high-impact systems (FIPS 199 “high”) to post-quantum key establishment by December 31, 2030 and to post-quantum digital signatures by December 31, 2031. Everything else in the order exists to make those two dates executable. The fine print, with the section numbers you can cite:

A note on the dates: the order writes most deadlines as “within N days” of the June 22, 2026 signature; the calendar dates above marked with ≈ are that arithmetic, and the two December 31 dates are written explicitly in the text. Section 7 adds the standard fine print that undoes careless readings: everything is “subject to the availability of appropriations”, and the order creates no enforceable rights.

What did OMB M-26-15 add — and what came due on October 22?

The execution playbook — and the first hard deliverable of the whole program. OMB memo M-26-15, “Execution of the Migration to Post-Quantum Cryptography” (June 24, 2026, two days after the order), told every covered agency to submit a migration plan to OMB and ONCD “no later than 120 days from the date of this memorandum” — that is, by October 22, 2026. The memo also fixes the shape of the decade: five phases — Strategy, Planning and Discovery (2026–2027), Pilots and Early Migration (2027–2028), Prioritized Migration (2028–2030), Signature Migration (2031), Full Migration (2035) — plus a floor for transport security: TLS 1.3 “as soon as practicable, but not later than January 2, 2030” (M-26-15, citing EO 14306).

The plan each agency had to file is not a memo of good intentions. M-26-15 lists its required contents: a risk-justified prioritization strategy; timelines and milestones for the migration phases; testing and deployment timelines for TLS 1.3; methods and tools for the cryptographic inventory; a plan for a cryptographically agile architecture; a third-party coordination plan; estimated funding and personnel needs; a risk-management strategy for the transition period; and defined governance roles. Two more details worth citing verbatim: the memo calls the plan a “dynamic document that will mature over time”, and it commits OMB only to “assess agency-wide progress and release further guidance as needed” — it sets no public reporting requirement. Remember that line; it explains the silence in the next section but one.

Who does the mandate reach — and who does it not?

Three rings, one explicit exemption. The binding core covers federal civilian agencies — and inside them, not everything: Section 4(b) binds high-value assets and high-impact systems, with the rest of the federal estate following under M-26-15’s Phase 5 (2035, “based on risk and commercial availability”). The second ring is federal contractors: Section 6(c) will pull them in through acquisition law — a proposed FAR rule due around December 19, 2026, with compliance (NIST FIPS, including PQC) required by December 31, 2030. If you sell software or services to a US agency, that date will become contract language, not policy commentary. The third ring is critical infrastructure: Section 5(a) offers help from Sector Risk Management Agencies and CISA to develop migration plans — assistance, with no deadline attached.

The explicit exemption: National Security Systems. Both the order (Sec. 4(b)) and M-26-15 (“this memorandum does not apply to national security systems”) carve them out — because they already run on a separate, earlier clock: NSA’s CNSA 2.0, under which new NSS acquisitions will have to be quantum-resistant from 2027, all NSS equipment should be QR-capable by 2030, and all NSS should be quantum-resistant by 2031 (NSA presentation on quantum-resistant cryptography, M. Stern, March 17, 2026). The practical reading: the “exempt” systems are on the stricter schedule, not the looser one.

And outside the United States? The UK’s NCSC keeps its three-step guidance — discovery by 2028, high-priority migration by 2031, completion by 2035 (NCSC migration timelines, March 20, 2025) — and in Latin America the count Rosetta tracks is unchanged: 0 of 5 major financial regulators (SFC, CNBV, Banxico, CMF, BCB) have published a PQC deadline (Rosetta board, last full scan October 12, 2026; light re-scan today found nothing new). The deadline map is still a map of absences — which is exactly why the one jurisdiction with binding dates is worth reading in the original.

Did agencies meet the October 22 deadline?

The public record cannot tell you — and the memo was written so that it does not have to. As of Rosetta’s scan on November 3, 2026 — twelve days after the due date — neither OMB nor ONCD has published how many migration plans arrived, which agencies filed, or what the plans contain; and as noted above, M-26-15 sets no obligation to publish any of it. A deadline passed in silence is not evidence of failure — but it is not evidence of compliance either. What exists instead is a measured baseline, and it is not flattering.

That baseline is GAO-27-108740, “Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat” (public version October 2026, based on a sensitive report issued September 2025). GAO measured all 24 CFO Act agencies against three post-quantum transition practices drawn from OMB guidance and found that “none of the 24 selected agencies fully addressed these practices”. The causes GAO names are structural: missing cryptography expertise, missing processes for building cryptographic inventories and identifying transition funding, and missing plans to guide PQC testing. The sensitive version made 89 recommendations to 23 agencies; of the agency responses, 12 agreed, 2 partially agreed, 7 neither agreed nor disagreed, and 1 disagreed with three of its four recommendations (GAO-27-108740 highlights). The honest caveat cuts both ways: GAO’s audit data closes in September 2025, so agencies have had more than a year — and one hard deadline — to improve since. Whether they did is precisely what no published number currently measures.

Is any of this happening because a quantum attack occurred?

No — and the zero belongs next to the deadlines, not buried under them. As of November 3, 2026, re-verified today on the Rosetta board: 0 RSA-2048 keys (or ECC-256 keys) have ever been broken by a quantum computer in the public record, and 0 public breaches are attributed to a quantum attack. The 2026 factoring records that made headlines — RSA-260 in September, then RSA-896 (896 bits, S. Weis, September 19, 2026) — were classical GNFS runs on GPUs, a story Rosetta took apart in the dossier of what has actually been factored.

So why the deadlines? Because the threat model that justifies them is arithmetic, not events: data harvested today can be decrypted by a machine that arrives later (“harvest now, decrypt later” — the category, with Mosca’s inequality worked out, is in this earlier piece), and migrations of this size take most of a decade. On timing, Rosetta’s own position stays what it was when it was sealed: prediction RQ-PRED-QDAY-001 puts the floor for a cryptographically relevant quantum computer at 2031, with a central window of 2033–2039 — a refutable judgment with a scoring rule, not a measurement (the Q-Day piece states its assumptions). Read against that bet, the EO’s 2030/2031 dates will land at or just before the earliest date the house considers plausible — which is what Mosca’s arithmetic recommends when the migration itself consumes the margin.

What should a security chief do with these dates — inside or outside the US government?

Four moves, none of which requires believing anyone’s timeline. First, if you sell to US federal agencies: treat Section 6(c) as a contract clause in gestation — the proposed FAR rule is due around December 19, 2026, and FIPS-including-PQC compliance by December 31, 2030; procurement language tends to propagate to subcontractors well before final rules land. Second, steal the template: M-26-15’s nine required plan elements are a free, citable table of contents for any organization’s PQC migration plan, whether or not OMB will ever read it. Third, sequence by data lifetime, not by anyone’s deadline: if your data must stay confidential longer than your migration will take, your binding date is earlier than any regulator’s — that is Mosca’s inequality, not a sales pitch. Fourth, when the budget conversation starts, put the measured side of the board on the table next to the declared side: ≈70% of browser-originated HTTPS requests on Cloudflare’s network already negotiate post-quantum key agreement, while only ≈15% of scanned origin servers support it (Cloudflare blog, September 29, 2026) — adoption is real, asymmetric, and measured here. The standards those deadlines point at — and when RSA/ECC formally age out under NIST IR 8547 (final, October 27, 2026) — are in the expiry piece and the standards clock.

PQC Board — status as of 2026-11-03

What we don’t know

• Whether agencies filed their plans on October 22. No public tally exists, and M-26-15 does not require one. We will state the answer when a primary source publishes it — not before.
• What the filed plans contain. Quality is the variable that matters, and it is entirely unmeasured in public.
• Whether GAO’s baseline still holds. The audit data closes in September 2025; agencies may have rebuilt inventories and processes since. The next GAO or inspector-general snapshot will say.
• Whether 2030/2031 will hold. The order is explicitly subject to appropriations, the FAR rules are not yet even proposed, and federal IT deadlines have slipped before. In the other direction: a surprise in cryptanalysis could make these dates look slow. Both tails are open.
• Whether the December 2026 and March 2027 deliverables will arrive on time. The NIST pilot start, the CMVP revision, the FAR proposed rule and the CBOM guidance are all dated within the next five months — each is a checkable event, and this board will check them.
• When a cryptographically relevant quantum computer arrives. Rosetta’s RQ-PRED-QDAY-001 (floor 2031, window 2033–2039) is a sealed, refutable judgment — not a measurement. The measured count of quantum-broken keys remains 0.

Rosetta Quantum publishes measured status with sources and dates, including the zeros. This is educational content, not security or legal advice. The future appears here only in future tense.