Five Months to CNSA 2.0: The Compliance Deadline Quietly Repricing Quantum Security Work
The most concrete date on the quantum calendar this year has nothing to do with qubit counts. Beginning January 1, 2027, new national security system acquisitions must support post-quantum algorithms under the National Security Agency's CNSA 2.0 requirements, according to a review of migration timelines published August 7 by The Quantum Insider. That is under five months away, and unlike a hardware roadmap it does not slip when an experiment fails.
Behind the near-term deadline sits a longer ladder of obligations. The same review cites NIST IR 8547, which deprecates RSA-2048 and ECC-256 by 2030 and disallows them after 2035; European guidance targeting high-risk infrastructure by 2030 and medium-risk systems by 2035; and a UK National Cyber Security Centre schedule calling for cryptographic discovery by 2028, high-priority migration by 2031 and full transition by 2035. Together they define a decade-long replacement cycle for the plumbing of digital trust.
Large technology platforms have already published their own dates. The Quantum Insider notes Google targeting full post-quantum migration across its infrastructure by 2029, Cloudflare aiming for the same year with more than 65% of human-generated traffic already protected as of April 2026, and Microsoft planning early adoption in 2029 and full transition by 2033. In financial infrastructure, SWIFT is expected to have SwiftNet 8.0 post-quantum enabled by 2027.
What is pulling those timelines forward is progress on the machines themselves. The same analysis points to Quantinuum's March 2026 demonstration of 94 error-protected logical qubits and IBM's Starling system targeting 200 logical qubits by 2029 — milestones that are still far from breaking public-key cryptography, but close enough to make the 'harvest now, decrypt later' threat model a budgeting assumption rather than a thought experiment.
For small-cap investors, the interesting question is whether compliance calendars convert into revenue on a comparable schedule. SEALSQ, which builds post-quantum secure chips, offers a live test. In preliminary first-half results filed July 6, the company reported roughly $11 million of revenue, up about 120% from $5 million a year earlier, with roughly $7 million landing in the second quarter, cash and short-term investments of approximately $495 million at June 30, and an active pipeline it put at more than $225 million through 2029, of which more than $60 million is tied to its QS7001 and QVault TPM programs.
The same filing shows how gated that pipeline is. SEALSQ said QS7001 has achieved NIST SP 800-90B entropy source validation and completed Common Criteria fault-injection and side-channel testing, with an EAL5+ evaluation technical report expected in the second half of 2026 and initial commercial revenues expected at the end of that period. Chief executive Carlos Moreira called the first half 'an important inflection point.' In hardware security, the binding constraint is often a certification lab rather than a customer.
Private capital is tracking the same clock at smaller scale. The Quantum Insider reported in July that Czech firm Wultra raised €6.8 million in a Series A to expand a post-quantum digital identity platform — a reminder that the migration wave touches authentication, key management and tooling vendors as much as chipmakers.
The distinction worth holding onto is between a deadline and a market. CNSA 2.0 creates a requirement for a specific buyer on a specific date; the 2030 and 2035 dates create a much larger but slower obligation across regulated industries. Companies positioned against the first may see orders sooner and smaller; those positioned against the second face years of pipeline before recognition. Either way, the migration schedule is now one of the few things in quantum with a date attached that is not set by physics.
