NIST finalizes IR 8547 PQC transition timeline

NIST has moved its post-quantum transition roadmap from draft to final. NIST IR 8547, published in final form on 27 October 2026, identifies the classical public-key algorithms that need to leave service, the approved post-quantum standards that replace them and the period in which organizations should complete the transition.

The event matters because the Initial Public Draft from November 2024 was already widely used as a planning signal. Final publication removes the draft qualifier and connects the general NIST timeline to the accelerated federal policy created by Executive Order 14412 and OMB Memorandum M-26-15. Teams now have a final NIST reference against which to map their cryptographic inventory, procurement requirements and migration evidence.

The final report keeps two transition clocks

The familiar 2030 to 2035 window remains the general NIST transition schedule. Quantum-vulnerable digital signatures and key-establishment schemes are deprecated after 2030 and disallowed after 2035. Deprecated means use is discouraged and should be treated as a risk. Disallowed means the algorithm is no longer permitted for the affected NIST use.

Federal agencies also have an accelerated schedule for systems that carry the greatest risk. The final report states that those earlier policy dates take priority. An organization cannot use the general 2035 disallow date to postpone a migration that falls under the 2030 or 2031 requirements.

These dates describe different obligations. IR 8547 is technical transition guidance and is not, by itself, a statute or procurement clause. Executive Order 14412 and OMB M-26-15 supply the binding federal policy context for agencies. National security systems follow separate direction, and sector regulators or customers can set earlier dates. A supplier therefore needs to identify which clock applies to each product, contract, data class and operating environment.

Key establishment deserves the first migration wave

The final report gives special urgency to key establishment because encrypted traffic captured today may remain valuable long after it was recorded. An attacker does not need a cryptographically relevant quantum computer now to create a harvest-now, decrypt-later exposure. The attacker only needs to collect the ciphertext and wait. Data with a long confidentiality lifetime can therefore be at risk before a future quantum computer exists.

For general use, NIST identifies ML-KEM from FIPS 203 as the approved replacement for quantum-vulnerable key-establishment schemes. ML-KEM-768 is the recommended default parameter set. The report also notes NIST's selection of HQC for future standardization, but selection is not approval: HQC should not be described as an approved NIST standard until its final standard is published.

A practical first wave should cover external TLS termination, service-to-service channels, VPNs, remote administration, key-management interfaces and long-lived encrypted archives. Map every occurrence to a system owner, protocol version, library, certificate path and vendor dependency. Then record whether the component supports a standardized post-quantum mechanism, a transition mechanism, or no usable migration path.

Digital signatures have a different operational burden

Signature migration is not simply an algorithm swap. It reaches certificate authorities, code-signing services, hardware security modules, identity systems, document workflows, firmware verification and every verifier that consumes the resulting signatures. The approved general-purpose standards are ML-DSA and SLH-DSA, with stateful hash-based signatures available for specific firmware and code-signing profiles under SP 800-208.

The 2031 accelerated federal signature gate gives teams one extra year after the key-establishment target, but the dependency chain can be longer. Certificate profiles, trust stores, validation software, signing appliances, audit evidence and rollback controls may all need coordinated changes. A successful library benchmark does not prove that the full signing and verification lifecycle is ready.

Hybrid mechanisms are a bridge, not a finished destination

IR 8547 accommodates hybrid approaches that combine a classical mechanism with a post-quantum mechanism. Hybrids can reduce transition risk when compatibility and assurance need to overlap, but they add message size, negotiation logic, implementation paths and policy complexity. The report treats them as a temporary transition tool rather than a reason to delay support for the standardized post-quantum algorithms.

A hybrid design needs an explicit security rule: which component must remain secure, what happens if one component fails, how downgrade is detected, and when the classical component will be removed. Add those rules to the cryptographic floor and rollback plan. Without them, the hybrid label can hide a classical fallback that defeats the intended protection.

What product and security teams should do now

• Update policy references from the 2024 Initial Public Draft to the final 27 October 2026 publication.
• Separate the general 2030 and 2035 timeline from the accelerated 2030 and 2031 federal policy dates in every roadmap.
• Prioritize systems that protect high-value assets, high-impact services, highly sensitive data or information that must remain confidential into the 2030s.
• Require vendors to identify the exact approved algorithm, parameter set, protocol profile and release in which support is available.
• Test full protocol and certificate paths, not only primitive-level performance.
• Define a downgrade floor, hybrid exit criteria and observable rollback behavior before production deployment.
• Attach owners, budgets, dependencies and acceptance evidence to the PQC migration roadmap.

NIST notes that major cryptographic transitions often take 10 to 20 years. The remaining window is shorter than that historical experience. Organizations that still lack a dependable inventory should begin there, then use a focused post-quantum audit to identify the few systems whose data lifetime, exposure or replacement lead time makes them the critical path.

Limits and open questions

The final report provides a national transition baseline, not a universal implementation profile for every protocol. Standards bodies still need to finish or stabilize many protocol bindings, vendors need validated implementations, and regulated sectors may publish additional requirements. NIST also continues to evaluate additional algorithms. These uncertainties affect sequencing and procurement, but they do not change the final status of IR 8547 or the published dates.

The safest planning interpretation is narrow and evidence based: use approved standards where profiles and implementations are ready, protect long-lived confidentiality first, and do not claim a system is post-quantum merely because one primitive appears in its dependency tree. The updated IR 8547 standards reference tracks the final document and the two clocks in one place.

Primary sources

• NIST, IR 8547, Transition to Post-Quantum Cryptography Standards, final, published 27 October 2026.
• NIST, Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards, published 27 October 2026.
• The White House, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, 22 June 2026.
• Office of Management and Budget, M-26-15, Execution of the Migration to Post-Quantum Cryptography, 24 June 2026.
• NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, 13 August 2024.