NIST post-quantum standards in 2026: final, selected, draft, or still under evaluation?

A standards portfolio contains artifacts with different authority. A final Federal Information Processing Standard specifies an approved algorithm. A final Special Publication can define secure-use guidance. An Initial Public Draft invites refinement. Selection for standardization starts a drafting and review process; it does not finish one. A candidate moving to another evaluation round remains a candidate.

Collapsing those states creates two opposite errors. A team may deploy an experimental construction as if it were settled, or it may delay all preparation because some complementary standards remain unfinished. The safer method is a dated status ledger that records the exact document, its role, publication state, errata, intended system surface, and next review trigger.

FIPS 203 specifies ML-KEM for key establishment. A KEM lets parties establish a shared secret that can then feed symmetric encryption and authentication. It is not a bulk file-encryption algorithm and should not be described as a drop-in replacement for every use of the word encryption.

FIPS 204 specifies ML-DSA and FIPS 205 specifies SLH-DSA for digital signatures. Signatures support integrity, origin authentication, and verification; they do not provide confidentiality. ML-DSA uses a module-lattice foundation, while SLH-DSA provides a stateless hash-based alternative with different size and performance characteristics. Architecture work must therefore begin by separating key establishment from each signature surface rather than choosing one universal PQC algorithm.

NIST SP 800-227, finalized in September 2025, addresses how KEMs work, the properties applications rely on, and how implementations should use them securely. That guidance is essential because protocol composition, input validation, key derivation, failure behavior, randomness, side-channel resistance, and lifecycle controls can undermine a mathematically sound primitive.

The FIPS publication pages are also living control points. NIST notes an issue for a future FIPS 203 update and links current errata material; the FIPS 204 page records several minor issues for future correction. These notices do not turn the standards back into drafts. They do mean an implementation team must pin the publication and errata state it tested instead of relying on an undated summary copied from another site.

NIST selected HQC in March 2025 as a second post-quantum KEM intended to complement ML-KEM with a different mathematical basis. The selection notice says NIST will draft a standard, publish it for comment, adjudicate feedback, and then publish a final version. Therefore HQC is a selected future standard, not a final FIPS available for an undifferentiated compliance claim in July 2026.

FN-DSA, derived from FALCON, is identified by NIST as FIPS 206 in development. Separately, NIST IR 8610 advanced nine additional digital-signature candidates to a third evaluation round in May 2026. Those candidates may inform future choices, but none becomes approved merely by reaching the next round. An architecture can preserve agility for future diversity without putting non-final candidates into a production baseline prematurely.

A final algorithm does not automatically update TLS, X.509, VPNs, code-signing systems, hardware security modules, certificate authorities, embedded devices, or every cloud service. Each surrounding protocol needs a safe encoding and composition; each library needs a correct implementation; products need integration and lifecycle support; regulated environments may also require algorithm or module validation.

This distinction prevents a common procurement failure: a supplier says that a product supports ML-KEM, while the buyer assumes the relevant protocol path, certificate lifecycle, rollback behavior, and validation scope are all complete. The evidence request should name the exact interface, protocol version, parameter set, build, validation record, interoperability partners, operational limits, and fallback behavior.

A standards watch becomes actionable when every item ends in a decision. Deploy is appropriate only when the required standard, protocol path, implementation, validation posture, and rollback controls meet the system's policy. Pilot is for bounded non-production or carefully isolated use where measurements can resolve a known uncertainty. Monitor applies when a needed specification or product is still moving. Reject applies when the proposal misstates status, lacks provenance, or cannot meet the trust boundary.

The same technology may land in different states for different systems. ML-KEM can be a final algorithm baseline while a specific TLS construction remains a draft. A library may implement final ML-KEM but lack the validation a federal acquisition requires. Recording the reason, owner, evidence, and next review date makes that nuance manageable rather than contradictory.

A useful ledger includes the canonical source URL, publication date, current status, superseded names, applicable errata, function, parameter choices, protocol dependencies, product and validation evidence, decision owner, last review, and next trigger. A trigger can be a new FIPS draft, final RFC, module certificate, vendor release, cryptanalytic result, or revised policy deadline.

This structure also improves public communication. A dated article can say what was final on July 20, 2026 and link readers to living primary records. It should avoid absolute terms such as unbreakable or future-proof: post-quantum algorithms are designed and believed to resist relevant classical and quantum attacks, but they remain subject to cryptanalysis, implementation failures, and future revision like other cryptography.