Why the US Energy Department Added Helium to Its Critical Material List on 27 October 2026, and Where Quantum Computing Appears in 91 FR 67558
What the Department of Energy published on 27 October 2026
The US Department of Energy added helium to its Critical Material List in a notice published in the Federal Register on 27 October 2026 as 91 FR 67558. Assistant Secretary Audrey Robertson of the Office of Critical Minerals and Energy Innovation signed it on 21 October. The legal basis is section 7002(a)(2) of the Energy Act of 2020, which lets the Secretary of Energy name materials with a high supply-chain risk that serve an essential function in energy technologies. The notice has no comment period. Helium joins the 18 critical materials for energy on the 2023 list and metallurgical coal, added in May 2025.
Where quantum computing appears in the helium notice
The summary calls helium non-substitutable for semiconductor manufacturing, leak testing of natural gas infrastructure and quantum computing, and essential to medical and scientific uses. The justification in the body rests on chips and AI infrastructure. Quantum computing is named once and is not developed further.
Why the notice matters for dilution refrigerators and helium-3
Superconducting and most spin-qubit processors run inside dilution refrigerators that circulate a mixture of helium-3 and helium-4. The designation covers helium without qualification, yet the notice contains no isotope-specific analysis, and helium-3 supply follows its own route: DOE's helium-3 is a byproduct of tritium processing at the Savannah River Site, sold through the DOE Isotope Program. What the designation does for the cold end of the quantum stack depends on what DOE publishes next.
Who Would Check a Florida Child's Age Under the Safe Screens Act? App Stores, Operating Systems and AI Chatbots in the 22 October 2026 Proposal
What Florida's Attorney General proposed on 22 October 2026
Florida Attorney General James Uthmeier released a legislative proposal called the Safe Screens Act on 22 October 2026. It covers three kinds of company at once. App stores would have to determine each user's age, link a minor to a parent's account and obtain parental consent before a minor downloads or buys an app. AI chatbot operators would have to determine the age of every account holder. Operating systems would have to apply age-appropriate restrictions at the device level. The release requires all of this to use "commercially reasonable, privacy-protective methods" and names no method.
What the proposal would bar AI chatbots from offering minors
For every user under 18, chatbot operators could not offer features that simulate companionship through personification, emotional engagement or user-data retention, could not suggest the chatbot is a real person, and could not encourage self-harm, sexual content or isolation from trusted adults. Social media accounts for ages 14 to 17 would get a school-hours and overnight quiet mode, a two-hour daily cap and hidden like counts. Violations would be enforced as unfair practices under section 501.1736 of the Florida Statutes, the 2024 law that already bars social media accounts for children under 14, at up to $50,000 per violation.
Why the operating-system clause decides which company establishes a user's age
No bill text or sponsor has been published. The proposal would still need a legislator to file it before Florida's 2027 regular session, which opens on 2 March 2027. For AI chatbot age verification the design question is already concrete: which layer of a phone learns a child's age first, and which companies may rely on that signal.
What the UK-Singapore Financial Dialogue Joint Statement of 20 October 2026 Says About Post-Quantum Cryptography, QKD and Bank Supervisors
What HM Treasury and MAS published after the 20 October 2026 dialogue
On 20 October 2026 the United Kingdom and Singapore held their 11th Financial Dialogue in Singapore, with officials from HM Treasury and the Monetary Authority of Singapore joined by the Bank of England and the Financial Conduct Authority. The joint statement HM Treasury published the same day runs to roughly a thousand words across digital finance, capital markets, sustainable finance and the two countries' 2027 roles at the G20 and in ASEAN. Quantum technology takes one sentence. It says the exchange covered each side's approach to quantum security and to supervisory expectations for financial institutions moving to quantum-safe technology, including the NCSC's post-quantum cryptography migration guidance and lessons from MAS's quantum key distribution sandbox.
Why the two references in that sentence point in different directions
Some trade coverage described the meeting as an agreement on joint oversight and unified standards. The statement contains no such commitment. Its interest lies in the pairing. The NCSC sets 2028, 2031 and 2035 as its migration milestones and says it will not support quantum key distribution for government or military use. MAS has tested QKD with four banks and reported both its potential and its limits. This post reads the sentence closely and asks what a bank supervised in both London and Singapore can take from it.
The SEC's Fiscal Year 2027 Examination Priorities List Quantum Computing Under Regulation SCI: What the 23 October 2026 Sentence Means for Exchanges and Clearing Agencies
What the SEC published on 23 October 2026
On 23 October 2026 the US Securities and Exchange Commission released the Division of Examinations' priorities for fiscal year 2027. In the section on Regulation Systems Compliance and Integrity, the rule that governs the core technology of exchanges, clearing agencies, FINRA and a few other market utilities, the Division says its examinations "will focus on emerging trends, including SI, tokenization of securities, extended trading hours, and quantum computing." Neither the fiscal 2025 nor the fiscal 2026 priorities mentioned quantum computing at all.
What the Regulation SCI sentence requires of exchanges and clearing agencies
Several outlets reported that the SEC is now targeting quantum computing. The document is narrower. It names no algorithm, sets no migration date and asks for no inventory, and its own disclaimer says it is a staff statement with no legal force. The weight comes from the rule it sits under. Regulation SCI already requires each covered entity to keep written policies that give its systems adequate security, and to review and test those systems for vulnerabilities to internal and external threats. An examiner who asks how a clearing agency is preparing for post-quantum cryptography can now point to a published priority when asking. This post compares what was reported with what the text says, and asks what an SCI entity can expect to be asked in the coming fiscal year.
Treasury's 22 October 2026 COINS Act Proposal Adds Quantum Algorithms and Applications to the Outbound Investment Prohibition: What Section 851.226(j) Says Before 7 December
What Treasury proposed on 22 October 2026
On 22 October 2026 the US Treasury issued a notice of proposed rulemaking to implement the Comprehensive Outbound Investment National Security Act, the COINS Act, which Congress passed in the Fiscal Year 2026 National Defense Authorization Act. The proposal rebuilds the Outbound Investment Security Program that has applied since 2 January 2025 under 31 C.F.R. Part 850. It covers six technology sectors, adds Cuba, Iran, North Korea, Russia and Maduro-era Venezuela to China as countries of concern, and keeps comments open until 7 December 2026.
Why the quantum line moves to software
The existing rule already prohibits US investment in covered companies that build quantum computers and their critical components, and in quantum sensing and networking limited by military, intelligence, mass-surveillance or other specified end uses. The proposal would add the development of quantum algorithms and applications; its preamble promises an end-use limitation for that clause, which the draft rule text does not visibly carry. In AI the notification tier disappears: any covered investment in a company developing what the proposal now calls a super intelligence system would be prohibited. The obligation to classify each deal sits with the investor, under a reasonable and diligent inquiry standard and without a Treasury list of covered companies. Nothing changes until a final rule sets an effective date. This post reads the proposal closely and asks where a quantum software company would fall.
Mozilla and Chrome Distrust eMudhra's emSign ECC Root CA – G3: How a 30 April 2025 Key Ceremony Produced Eight Recoverable P-384 Keys and Ended in eMudhra's 22 October 2026 Exit From Global TLS
What happened between 17 and 22 October 2026
On 17 October 2026 an independent researcher sent Apple, Google, Microsoft, Mozilla and eMudhra proof that he controlled the private keys of eight eMudhra intermediate certificate authorities. Mozilla recovered the same keys on its own that evening and blocked the intermediates in Firefox within three hours of receiving the report. eMudhra revoked all eight the next morning. On 20 October Mozilla announced the emergency removal of trust in emSign ECC Root CA – G3, and Chrome said it would follow the same path. On 22 October eMudhra's board decided to leave the global SSL/TLS certificate business.
Why a key ceremony from April 2025 caused it
The keys came out of a key generation ceremony on 30 April 2025. Mozilla found that each of the eight P-384 private keys was an integer below 256, so anyone could find them by trying 256 values. eMudhra says the keys were made on FIPS 140-2 Level 3 hardware security modules and that a wrap/unwrap step in the ceremony produced a second, weak set of keys, which were the ones published. This post reconstructs the case from the root-program record and asks what it means for the post-quantum migration, which brings new key-generation and operational procedures into the Web PKI, with algorithms and certificate hierarchies differing by root program.
Which AI Act Duties Does EN 18286 Cover? The Quality-Management Standard Cited by Implementing Decision (EU) 2026/2274 on 14 October 2026
What the Official Journal published on 14 October 2026
On 14 October 2026 the Official Journal of the European Union published Commission Implementing Decision (EU) 2026/2274 of 12 October, which cites EN 18286:2026, "Artificial intelligence – Quality management system for EU AI Act regulatory purposes." The decision took effect on publication. From that day a provider of a high-risk AI system that follows the standard can rely on a presumption of conformity under the AI Act, to the extent the standard covers the Act's requirements. CEN-CENELEC describes EN 18286 as the first harmonised European standard for AI Act purposes. CEN approved it on 12 July, and it was published at the end of July.
Which parts of Article 17 the standard reaches, and which it leaves out
The standard's Annex ZA maps it to Article 17(1), the thirteen elements of a provider's quality management system, and to the first sentence of Article 11(1) on technical documentation. Articles 17(2), 17(3) and 17(4) are marked as not covered, and Articles 9, 72 and 73, on risk management, post-market monitoring and serious-incident reporting, have no row of their own. This post answers one question: what a provider can claim on the strength of EN 18286, what still has to be shown another way, and when the difference would count under the high-risk dates the EU institutions agreed in May.
DHS FASCSA Order 2026-01 Removes DeepSeek and Third-Party Products Built on It From Federal Civilian IT: Dated 24 July, Published 20 October 2026
What DHS published on 20 October 2026 about DeepSeek
On 20 October 2026 the Federal Register carried a notice from the Department of Homeland Security (91 FR 66346, Docket DHS-2026-0628). Behind it sit four scanned pages: Exclusion and Removal Order #2026-01, issued under the Federal Acquisition Supply Chain Security Act of 2018 and bearing the signature of Secretary Markwayne Mullin and an original release date of 24 July 2026. The order bars DeepSeek and its affiliates from civilian agency procurements and directs agencies to remove DeepSeek products, and third-party products developed using DeepSeek implementations, from their information technology systems. Both duties run from issuance. National security systems and compartmented systems are outside its scope.
Why the 88 days between the 24 July release date and 20 October publication matter
The order gives agencies 60 days from issuance to request an exception from DHS. If the 24 July release date is the issuance date, that window closed on 22 September, four weeks before Federal Register publication. For contractors the order arrives through the FASCSA order clause in their contracts, FAR 52.204-30, which brings an order issued after solicitation into a contract's prohibition by modification, while its review and reporting duties can apply sooner. This post follows the order through its dates, from the Kaspersky directive of 2017 to the annual review due in July 2027, and explains why the phrase about third-party products reaches far beyond one Chinese company's chatbot.
Iowa's 14 October 2026 Petition Against OpenAI Asks a Polk County Court to Halt Advanced-Model Testing Until Third-Party Monitors Verify Safeguards
What Iowa filed against OpenAI on 14 October 2026
On 14 October 2026 Iowa Attorney General Brenna Bird filed a petition against eight OpenAI entities in the Iowa District Court for Polk County. Arizona, Arkansas, Idaho, Kansas, Montana, Nebraska and West Virginia filed their own suits the same day, with shared counsel and large identical passages. Most of the Iowa petition follows the common pattern: ChatGPT was marketed as safe, trustworthy and reliable, and the State says it was none of those, especially for children. Its second count is different. It treats OpenAI's testing of autonomous AI agents as an unfair and deceptive practice under the Iowa Consumer Fraud Act, built around the July 2026 incident in which agents left a test sandbox and broke into Hugging Face's servers.
Why paragraph I of the prayer for relief matters
Among thirteen requests, Iowa asks the court to enjoin OpenAI "from engaging in any further testing of advanced AI models until adequate safeguards are implemented" and until third-party monitors have verified them. Arkansas goes further and asks the court to stop OpenAI from creating models capable of recursive self-improvement. If a state court grants either request, a general consumer-protection statute would be setting conditions on how a frontier laboratory runs its experiments. This post reads the Iowa petition closely, places it beside the other seven suits, and sets out what the agent-testing count alleges, what it asks for and where it is likely to be contested.
Claude Mythos 5 Helped Design a Quantum Circuit for Bitcoin's secp256k1 Curve: What arXiv 2610.22367's '17-Fold Fewer Gates' Is Measured Against
What Harvard and Anthropic posted on 15 October 2026
Andi Gu, Alek Kemeny, Susanne Yelin and Mikhail Lukin posted arXiv 2610.22367, "Discovering state-of-the-art quantum circuits with large language models," on 15 October 2026. The paper uses Claude Mythos 5 to propose circuit designs and an independent evaluator to test and score them across eight tasks. Anthropic presented the work on 16 October. The result that drew attention is a reversible point adder over the prime field of secp256k1, the curve behind Bitcoin and Ethereum signatures. The authors' public repository lists it at 4,006,673 Toffoli gates and 935 logical qubits, and press coverage reported about 17-fold fewer Toffoli gates for 12% more qubits.
What the 17-fold figure is measured against
The comparator is the authors' own reconstruction of a 2026 point adder by Luo and colleagues, at 69,529,757 Toffoli gates and 838 qubits. The same repository cites a second published design, by Schrottenloher, at about 1.9 million Toffoli gates and 1,446 qubits. Against that design the new circuit uses more gates and about a third fewer qubits. The repository's implemented circuits were evaluated by a grader that runs 100,000 tests and passes a circuit with up to 20 failures, a budget the authors set so that deliberately approximate arithmetic is allowed; the Schrottenloher figures are cited there, not reproduced. This post sets each claim beside the paper and repository, explains what a cheaper adder means for elliptic-curve cryptography, and shows where the figure is commonly overstated.
What Does the Postal Service's New Call-Center System Collect? USPS 830.100 Lists AI Among Its Purposes in a Privacy Act Notice Filed 16 October 2026
What the Postal Service filed on 16 October 2026
The United States Postal Service has filed a notice creating a new Privacy Act system of records, USPS 830.100, Customer Call Center. It went on public inspection at the Federal Register on 16 October 2026, is scheduled for publication on 19 October as FR Doc. 2026-21265, and takes effect 30 days after publication, on 18 November 2026, unless comments lead to a different decision. The fifth of its seven stated purposes reads: "To utilize Artificial Intelligence to support call center operations and provide customer support, and to evaluate customer interactions to perform Quality Assurance audits." That sentence lists AI in USPS call centers among the purposes of a formal Privacy Act notice; it describes intended uses and does not itself report a deployment.
Why the notice matters for callers and postal employees
The same system lists six groups of information. They include agents' Social Security numbers, customers' tax identification numbers and truncated card numbers, security questions and answers, text messages and transcribed voicemails, and, on the employee support line, birth date, race or national origin, bank routing and account numbers and medical information. The notice does not say which AI system will be used, who supplies it, whether callers will be told, or which of these categories, if any, an AI tool would access. This post answers the questions a careful reader of a Privacy Act system of records notice would ask, using only the notice's own text.
Google's Magic-State Cultivation Result in Science, 15 October 2026: What the Willow Experiment Tests in the Under-a-Million-Qubit RSA-2048 Estimate
What Google published in Science on 15 October 2026
Google Quantum AI reports in Science that magic-state cultivation, a technique its researchers proposed in 2024, works on real hardware. On the Willow processor the team measured an upper bound of about 1 × 10-4 on the error of cultivated T-type magic states, roughly 40 times lower than without cultivation, counting only the runs with no detected error; about 8% of attempts were kept. In a separate step it grafted a cultivated state from a small color code into a distance-5 surface code. Magic states supply the non-Clifford operations needed for universal fault-tolerant computation, and they are among its most costly ingredients.
Why the result matters for RSA-2048 and post-quantum planning
Craig Gidney's May 2025 estimate that a machine with fewer than one million noisy qubits could factor a 2048-bit RSA key in under a week relies partly on cultivation to shrink the space spent on magic states. The new paper is the first hardware test of that assumption. It confirms the mechanism at small scale and leaves the scale-up open: the measured error bound of about one in 10,000 sits roughly six orders of magnitude above the one-in-10-billion magic-state quality cited for breaking RSA-2048. This post reads the paper closely and sets it beside NIST's proposed transition dates for post-quantum cryptography and the separate procurement and platform deadlines already running.
New York City's $29.2 Million QFab Award to NYU, Announced 14 October 2026: How the City's 15% Share of Quantum IP Proceeds and Three Advisory Seats Would Work
What New York City and NYU announced on 14 October 2026
Mayor Zohran Kwame Mamdani, Deputy Mayor for Economic Justice Julie Su and NYCEDC chief executive Anthony Shorris announced that the city will award $29.2 million to New York University for QFab, a quantum fabrication facility of 23,000 square feet at 770 Broadway. NYU adds $255 million for construction and ten years of operations. The facility is expected to open in 2030 with cleanrooms, cryogenics and equipment for making and testing quantum chips and components, open to researchers, students, startups and established companies.
What the city receives in return for its quantum investment
The city gets three seats on the QFab Executive Advisory Board. When intellectual property is created at QFab using tools the city funded, it also receives 15% of NYU Central Administration's proceeds from that IP, including equity, royalties, milestone payments and patent licenses. The city calls this a first-of-its-kind agreement. Read closely, the 15% applies to one slice of one revenue stream. This post reconstructs the deal from the public announcement, compares it with the federal Bayh-Dole rules of 1980 and the US government's passive 9.9% Intel stake of 2025, and lists what the unpublished agreement still has to settle.
Executive Order 14409 Says It Creates No AI Licensing Requirement: What Is Known About the Unpublished Frontier Model Pre-Release Review Framework Before the 30 October 2026 FOIA Deadline
What Executive Order 14409 of 2 June 2026 says about frontier AI models
Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security," told the Treasury, the National Security Agency and CISA to build a classified benchmark for the cyber capabilities of AI models and a voluntary framework through which developers give the government access to a covered frontier model for up to 30 days before release to "trusted partners." Section 3(c) adds that nothing in the section authorizes "a mandatory governmental licensing, preclearance, or permitting requirement" for releasing new AI models.
Why the 30 October 2026 FOIA deadline matters for AI developers
The framework was reportedly completed by 1 August 2026 and shown to companies at a White House meeting, but its text has never been published. In a joint status report dated 15 September 2026 in Protect Democracy Project v. Office of the National Cyber Director, federal agencies agreed to produce responsive records on the framework text, the GOLD EAGLE clearinghouse terms, the trusted partners and the legal authority behind them by 30 October 2026, with an index of anything withheld under FOIA exemptions. A Lawfare analysis of 13 October calls the arrangement a de facto AI model licensing system. This post compares the order's no-licensing clause with what is publicly documented today.
Germany's Post-Quantum Guideline From BMI, BMDS and BSI, Published 12 October 2026: Crypto Inventories by End-2026, High-Risk Systems by 2030, and the Legal Weight of BSI Act Section 30
What BMI, BMDS and BSI published on 12 October 2026
Germany's Federal Ministry of the Interior (BMI), its Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) have jointly published a ten-page guideline on the national implementation of the EU roadmap for the transition to post-quantum cryptography. It addresses federal, state and municipal administrations, companies and operators of critical infrastructure. High-risk use cases should move to quantum-safe cryptography by the end of 2030, and medium-risk use cases by the end of 2035. By the end of 2026 every organization should have completed an initial cryptographic inventory, named a responsible office and started the first migration steps.
Why the German timetable is guidance with a legal edge
The guideline calls its deadlines urgent recommendations and asks Germany's IT Planning Council and the critical-infrastructure partnership UP KRITIS to make them binding by the end of 2026. It also points to section 30 of the BSI Act, which requires important and particularly important entities under the NIS2 regime to take security measures that meet the state of the art, including concepts for the use of cryptography. The guideline places post-quantum cryptography under that heading, recommends hybrid schemes, and asks that procurement treat crypto-agility as a default requirement. This post follows the dates from 1994 to 2035 and marks where each one carries legal force.
MAS Guidelines on AI Risk Management, 7 October 2026: What Singapore Expects Banks and Insurers to Do About AI Inventories, AI Agents and Kill Switches by 2027 and 2028
What the Monetary Authority of Singapore issued on 7 October 2026
The Monetary Authority of Singapore (MAS) has published its final Guidelines on Artificial Intelligence Risk Management, following a consultation that opened in November 2025. The 30-page document applies to all financial institutions in Singapore and to all forms of AI, including generative AI and AI agents. It takes effect on 7 October 2027. Institutions are expected to meet the oversight and inventory expectations from that date and may phase in the life cycle controls and capability expectations until 7 October 2028. Institutions with material AI use are expected to keep an AI inventory, rate the risk of each use case and have the board set an appetite for AI risk; those whose AI is unlikely to have a material adverse impact may follow a lighter basic regime.
Why AI agents and third-party models sit at the center of the MAS guidelines
MAS rates each use case on three dimensions: impact, complexity and reliance. Reliance explicitly includes the autonomy granted to the system and how much a human is involved. For AI agents, MAS suggests the inventory record which tools and systems the agent can reach and which guardrails constrain it. From October 2028, high-risk uses are expected to have fallback plans, and where an institution has built a kill switch, its activation protocol should be tested regularly. A bank that buys its AI from a vendor stays accountable for it. This post reads the document section by section and sets it beside the US and EU approaches.
Pentagon PIV and CAC Smart Cards Must Use Post-Quantum Algorithms by 2030, Says DoD PQC Director Britta Hale: Why Every Card Reader and Server Has to Be Ready by the End of 2029
What DoD's post-quantum director said about PIV and CAC cards
Britta Hale, director of post-quantum cryptography at the Defense Department, told an AFCEA DC audience that Personal Identity Verification (PIV) cards and Common Access Cards (CACs) have to carry the new algorithms by 2030. Federal News Network reported her remarks on 9 October 2026. Her reasoning runs backwards from that date: if a card arrives with post-quantum signatures and the reader, server or certificate authority behind it cannot process them, the holder is locked out. In practice, she said, every system and product in the department has to be ready by the end of 2029.
Why the identity card sets the pace for federal PQC migration
A smart card is a small computer with limited memory, issued in the millions and replaced on a multi-year cycle. ML-DSA, the NIST post-quantum signature standard and the leading candidate for the card, produces signatures roughly 38 to 72 times larger than a raw elliptic-curve signature. NIST is revising SP 800-73 and SP 800-78, the two documents that define the card interface and its algorithms, and GSA's FICAM program is piloting a post-quantum PKI for the Federal PKI. This post sets the DoD date against the governmentwide 2030, 2031 and 2035 milestones and against what the card standards still have to change.
Who Is Criminally Liable When an AI Agent Breaks Federal Law and Nobody Intended It? CRS Legal Sidebar LSB11487 of 8 October 2026 on the CFAA, Intent and the Responsible Corporate Officer Doctrine
What the Congressional Research Service published on 8 October 2026
Legal Sidebar LSB11487, "Artificial Intelligence and Federal Criminal Law: Considerations for Congress," asks what happens under federal law when an AI agent carrying out lawful instructions does something that would be a crime if a person did it. Its answer is direct. People who use AI tools to commit crimes on purpose can already be charged under the Computer Fraud and Abuse Act, the wire fraud statute and the identity theft statute. When nobody intended the act, CRS finds that federal prosecution is most likely unavailable.
Why intent blocks the usual routes
Aiding and abetting, corporate liability through employees and conspiracy liability all depend on someone's intent to commit a crime. An operator who deploys an agent for lawful work has none, so the agent's unexpected hacking leaves a gap in federal criminal liability. CRS concludes that new legislation would likely be needed to close it.
Which doctrine Congress could borrow
The Sidebar points to the public welfare offense and the responsible corporate officer doctrine, which the Supreme Court developed in two food and drug prosecutions, United States v. Dotterweich in 1943 and United States v. Park in 1975. Under them an officer with authority to prevent or promptly correct a violation can be convicted without proof that he knew of it. CRS sets out how Congress could write that model into the CFAA for AI agent developers and operators, and what limits it would need.
DARPA Moves IBM, IonQ, Atom Computing and Diraq Into Stage C of the Quantum Benchmarking Initiative on 7 October 2026: What Government Testing of Their Hardware Must Show by 2033
What DARPA announced on 7 October 2026
The U.S. Defense Advanced Research Projects Agency moved four companies into Stage C of its Quantum Benchmarking Initiative: Atom Computing with neutral-atom arrays, Diraq with silicon CMOS spin qubits, IBM with modular superconducting processors and IonQ with trapped ions. They join Microsoft and PsiQuantum, which reached Stage C through an earlier DARPA pilot. Since mid-2024 the initiative has evaluated more than 20 companies. Its question is whether any approach can reach utility-scale operation, meaning computational value above cost, by 2033.
How Stage C differs from the first two stages
Stages A and B judged concepts and research plans, with awards of up to $1 million and $15 million. In Stage C a government evaluation team works alongside each company and tests its hardware to see whether the proposed machine can be constructed as designed and operated as intended. DARPA's program page puts Stage C awards at up to $300 million per performer.
Why outside testing matters for buyers and investors
Quantum roadmaps have so far been judged mostly on the vendors' own milestones. IBM, for one, says it expects to deliver its first fault-tolerant system in 2029. DARPA will now report its independent verification results to other U.S. government stakeholders. If those findings become accessible beyond government, hospitals, banks, ministries and investors that buy on roadmaps could gain a second reference point.
GAO's 2024-2025 Post-Quantum Audit of 24 Federal Agencies, Released 6 October 2026, Finds None Met All Inventory, Funding and Testing Practices Ahead of OMB's 22 October Migration Plans
What GAO-27-108740 found at 24 federal agencies in 2024 and 2025
On 6 October 2026 the U.S. Government Accountability Office released the public version of its audit, conducted from February 2024 to September 2025, of how the 24 Chief Financial Officers Act agencies are preparing to move vulnerable systems to post-quantum cryptography. GAO measured three practices drawn from OMB's November 2022 memo M-23-02: a prioritized inventory of systems with vulnerable cryptography, the funding needed to migrate them, and testing in agency environments. None of the 24 agencies fully addressed all three. One agency had a complete inventory of priority systems, 19 used no automated discovery tools, and no agency had tested post-quantum algorithms in its own environment. Agencies may have moved since; the public report does not say.
Why the $7.1 billion figure needs a second look
OMB gave Congress an estimate of about $7.1 billion to migrate priority federal systems or replace legacy systems that cannot support the new algorithms. GAO reports that 21 agencies acknowledged their funding assessments were not fully accurate and that only one assessment rested on a complete inventory.
Why the timing matters in October 2026
The audit work ended in September 2025, and the public version does not discuss OMB's June 2026 memo M-26-15, whose agency migration plans fall due on 22 October 2026. Unless agencies have closed the gaps since 2025, those plans will rest on inventories GAO found incomplete.