Quantum migration: replace a distant deadline with a funded plan.
NIST finalized its transition roadmap on October 27. The practical decision is which systems, suppliers and long-lived data require action first, and who owns the migration.
Compiled and published November 8, 2026 · Sources checked November 8, 2026 · Richard E. Davis, JD, CISSP, CISA, CRISC, AAISM, ITIL
Catch-up edition: the coverage week is not the publication date. Reported facts, our analysis and recommended actions are identified separately. This is an orientation brief, not an institution-specific legal opinion.
Post-quantum migration now has a final federal roadmap
Jurisdiction / sector: United States · cross-sector / federal suppliers Status: Final guidance, not a blanket private-sector law Event or trigger: October 27, 2026
NIST announced final IR 8547. Its federal transition targets distinguish high-value/high-impact key establishment in 2030, signatures in 2031 and the broader 2035 horizon. Those dates should not be presented as one statutory deadline for all businesses.
Our assessment: start with the data that must remain confidential longest and the systems that are hardest to replace. Ask suppliers for dependencies, upgrade plans and test evidence before adding more bespoke cryptography.
What to do and retain. CISO and architecture lead: approve an inventory owner, a migration sequence and an interoperability/rollback test. Preserve supplier responses and exceptions.
Primary sources and review context
Reviewed November 8, 2026. The source supports the reported development; the recommended control actions are davisAIgov analysis.
Prepare for December obligations without moving every AI deadline
Jurisdiction / sector: European Union · AI providers / cross-sector deployers Status: Enacted rules; role-specific transitions Event or trigger: Upcoming: December 2, 2026
The Commission's amended Article 111 display gives qualifying synthetic-content systems placed on the market before August 2, 2026 an Article 50(2) transition to December 2, 2026. Article 113 separately places Annex III high-risk requirements in December 2027 and Annex I requirements in August 2028.
Our assessment: maintain separate provider, deployer, product and market-placement fields in the AI inventory. A postponed high-risk date is not permission to ignore obligations already applicable.
What to do and retain. AI governance and product owners: identify the systems in scope and preserve evidence of the chosen transition and marking approach.
Primary sources and review context
Reviewed November 8, 2026. The source supports the reported development; the recommended control actions are davisAIgov analysis.
Use year-end reviews to distinguish law, proposal and contract
Jurisdiction / sector: California / Colorado / US defense supply chain Status: Readiness watch; not announcements made this week Event or trigger: Forward look to 2027
California's covered ADMT requirements begin January 1, 2027 under its staged regulations. Colorado's SB26-189 also establishes principal ADMT duties from January 1, 2027. The defense program's Phase II suspension remains a separate matter; do not substitute an old November 10 certification deadline for current contract analysis.
Our assessment: ask counsel and compliance to approve a short applicability record for each use case. Link the actual requirement to notice, human-review, recordkeeping and supplier controls, rather than copying a generic calendar.
What to do and retain. Compliance and procurement owners: record authority, affected activity, operative date, exceptions and the exact contract clause where applicable.
Primary sources and review context
Reviewed November 8, 2026. The source supports the reported development; the recommended control actions are davisAIgov analysis.
