Drift ·
There is no such thing as a PQC certification
What the post-quantum mandates actually require, and of whom.
Ask three people whether post-quantum cryptography is now a compliance requirement and you will get three answers, usually involving a deadline. The mandates are real and the dates are real. Almost none of them mean what they are being repeated to mean, and the gap is causing organisations to budget for something that does not exist.
There is no post-quantum certification. No body issues one. No mandate requires commercial software to hold one. What exists is a set of instruments with quite different scopes, and conflating them is where the confusion starts.
CNSA 2.0 is the NSA's algorithm suite for National Security Systems. Its procurement gate is real, and it is where most of the circulating deadlines originate: new acquisitions for an NSS are expected to support ML-KEM-1024 and ML-DSA-87 from 1 January 2027. That binds NSS procurement and the vendors selling into it. It does not bind commercial software sold to private companies.
Executive Order 14409 directs federal agencies to migrate high-value systems to post-quantum key establishment by the end of 2030 and signatures by the end of 2031, and directs the FAR Council to propose a rule extending compliance expectations to contractors. That is a federal-contracting obligation arriving over years, not a certification.
FIPS 140-3, through NIST's validation programme, is the closest thing to an actual certification — and it certifies a cryptographic module, not post-quantum readiness as a category. If you implement ML-KEM or ML-DSA and need federal validation, that is the queue you join, and it is currently a long one. FIPS 140-2 certificates moved to historical status in September 2026, so it is also the only queue.
For the private sector, as of today, there is no binding post-quantum requirement in any US sector. Not in finance, not in healthcare, not in critical infrastructure. Advisory guidance, yes. Mandates, no.
So the short answer to do we need to be PQC certified is that there is currently nothing to be certified against. The useful work is elsewhere.
The question that does matter is narrower and almost nobody asks it. Hybrid post-quantum key exchange is already the default in current TLS stacks, which means your traffic is probably protected right now without anyone deciding it should be. Anything in the path that terminates and re-originates TLS — a proxy, a gateway, an inspection tool — re-negotiates that connection on its own terms. If it is built on an older stack, it silently drops the session back to classical encryption. Harvestable today, readable when the hardware arrives.
No certificate covers that property; it can only be measured. The useful question is which key exchange a given product negotiates, and whether that can be shown rather than asserted.
One further point, since it is the part most easily lost. Harvest-now-decrypt-later requires stored ciphertext. A system that never retains the content in the first place has nothing for a future machine to come back for. That is an architectural answer to a cryptographic problem, and it is available today.
This is a description of the regulatory landscape as we understand it, not legal advice. Verify the dates against the primary instruments before you plan against them.