U.S. and EU post-quantum policy: milestones architecture teams should track.

The United States is pushing federal migration from planning into execution through EO 14412 and OMB M-26-15. CISA's January 2026 product categories help buyers identify which hardware and software classes are likely to use or transition to PQC standards.

The European Union is moving through a coordinated roadmap under the NIS Cooperation Group, supported by the Commission. The roadmap creates a synchronized transition view for Member States and connects PQC to broader cybersecurity resilience.

The practical implication for companies is procurement pressure. Even if a business is not a federal agency or EU public body, customers, regulators, prime contractors, and insurers will increasingly ask for cryptographic inventory, vendor status, and migration evidence.

Most enterprises do not have a single owner for cryptography. Security owns policy, infrastructure owns TLS and VPN, platform owns service mesh, product teams own SDKs, procurement owns vendors, and embedded teams own firmware. Quantum-safe readiness forces those boundaries into one programme.

A policy-aware architecture should define owners for certificates, protocol upgrades, library changes, key lifecycle, signing systems, test environments, exception handling, and customer communications.

A working operating surface can turn policy pressure into execution: discover systems, classify risk, attach standards, create owner workflows, request evidence, approve migration steps, and generate status views for executives and auditors.

This control layer sits between security advisory and product implementation. It links policy, architecture, vendors, tests, and evidence instead of ending with a static report.

The 2026 evidence points to strong convergence, not one unified U.S.-EU treaty for every migration detail. U.S. and EU policy surfaces are aligning around readiness, inventory, and migration pressure, but their legal instruments, timelines, and implementation details remain distinct.

Architecture teams should use the official U.S. and EU sources to identify the concrete ownership, inventory, vendor, testing, and migration work that follows.

The first failure mode is the paper inventory. A cryptographic inventory produced once for a compliance request decays as certificates rotate, libraries update, and vendors ship changes. If the inventory is not attached to owners and refresh workflows, it becomes evidence of a snapshot, not of a program. Policy pressure from OMB-style execution reporting rewards inventories that stay current, not inventories that existed once.

The second failure mode is distributed ownership with no accountable owner. Security owns policy, infrastructure owns TLS and VPN, platform owns service mesh, product teams own SDKs, and embedded teams own firmware. When a deadline arrives, each team can show local progress while the system-level migration has no owner. The fix is structural: one program, named owners per artifact class, and an exception process that surfaces gaps instead of hiding them.

The third failure mode is vendor-shaped blindness. Vendor-managed systems cannot be migrated by internal tickets. If evidence requests and renewal terms are not in place early, the program discovers late that its critical dependencies sit on vendor roadmaps it never influenced. The fourth failure mode is messaging: claiming a transatlantic mandate where the record shows convergence, or presenting QKD as a PQC substitute. Both claims collapse under audit and damage the program's credibility.

Instrument ownership before technology. The earliest useful signal is coverage: what fraction of the cryptographic estate has a named owner for certificates, protocol upgrades, library changes, key lifecycle, and signing systems. This number is cheap to compute, hard to fake, and directly answers the question executives and auditors will ask first. It also exposes the organizational boundaries the migration must cross.

Instrument vendor status second. For every vendor-managed system, track whether an evidence request has been sent, whether a response exists, and whether renewal terms reference PQC transition. CISA's product categories give this tracking a structure: they identify which hardware and software classes are likely to use or transition to PQC standards, so the program can prioritize evidence requests where standards adoption matters most.

Instrument the timeline third. A single completion percentage hides the distinctions that matter. Report standards readiness, product support, pilot success, and production cutover as separate states per system tier. High-risk and long-lived data systems should show movement first. This is the reporting shape that survives contact with board reviews, prime contractor questionnaires, and regulator requests.

The direction of travel is visible in the cited record without speculation. The U.S. track moves from planning into execution through EO 14412 and OMB M-26-15, which means federal inventory and migration reporting becomes routine rather than exceptional. The EU track runs through the NIS Cooperation Group roadmap, which creates a synchronized transition view across Member States and connects PQC to broader cybersecurity resilience. Neither track requires the other to proceed, which is why convergence is the accurate word.

For enterprises, the practical consequence is that procurement pressure compounds. Each reporting cycle on the public-sector side generates questionnaires, contract clauses, and evidence requests on the private-sector side, moving through primes, regulators, and insurers. Programs that already hold a risk-tiered inventory, vendor evidence, and owner workflows answer these requests from existing artifacts. Programs that do not will build them under deadline pressure, in the least favorable order.

EuroQCI continues as an infrastructure track in parallel. The correct posture is to monitor it as European quantum communication infrastructure while keeping the PQC migration plan independent of it. Architecture teams that keep these lanes separate will produce cleaner evidence and avoid the most common audit finding: a roadmap that conflates standards migration with infrastructure research.