Federal agencies must upgrade to quantum-proof encryption by 2027

What it does

This bill directs federal agencies to develop and execute a strategy for migrating their computer systems from current encryption methods to quantum-resistant encryption before quantum computers become powerful enough to break existing security. It requires the creation of standards, a pilot program upgrading at least one critical system per agency by 2027, cost assessments, and annual progress reports to Congress.

Why we flagged it

The bill's core function is mandating federal agencies upgrade encryption systems to defend against future quantum computing threats. It is a public-sector cybersecurity and infrastructure modernization measure, not a private-sector subsidy or deregulation.

What the text implies

• The bill does not mandate private-sector adoption of post-quantum cryptography, only federal systems and critical infrastructure providers—leaving non-critical private companies potentially vulnerable to quantum attacks for years longer.
• Cost estimates are not yet known; the bill requires a survey and report, meaning Congress will not know the full fiscal impact before passage. Implementation could require billions in IT spending across agencies.
• The 2027 pilot deadline for 'at least one' system per agency is a minimal threshold; full migration timelines are not specified, potentially leaving many federal systems vulnerable for a decade or more.
• The bill references the Quantum Economic Development Consortium but does not specify how private vendors will be selected or whether competitive bidding will be required, creating potential for vendor lock-in.

Who it affects

Ordinary citizens benefit from stronger cybersecurity protections for federal systems that hold sensitive personal data and critical infrastructure. The bill mandates transparency through reporting and cost assessment, reducing the risk of future quantum-enabled breaches of government databases containing citizens' information.

Who stands to gain

• cybersecurity software vendors
• IT infrastructure companies
• quantum-resistant cryptography developers
• systems integrators and consulting firms

Named in the bill

National Institute of Standards and Technology (NIST), Subcommittee on the Economic and Security Implications of Quantum Information Science, Office of Electronic Government, Office of Management and Budget (OMB), Comptroller General, Quantum Economic Development Consortium, Critical Infrastructure Protection Act of 2001, National Quantum Initiative Act, Sector Risk Management Agencies, VRSN (Verisign), AMD, HPE (Hewlett Packard Enterprise) — and 2 more

Where it stands

1 cosponsor: 1 Republicans.

• Jul 30, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• Jul 30, 2025 — Referred to Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Read twice and referred to the Committee on Homeland Security and Governmental Affairs”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

2 lobbying clients named this bill on 2 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $350,000 in lobbying spend. A filing names 32 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 41% of bills with at least one filing.

Gary Peters, the sponsor, reported $-186,100 in PAC receipts in the 2026 cycle.

• Business Software Alliance — $320,000 on 1 filing
• Bsa the Software Alliance (formerly Bsa Business Software Alliance Inc) — $30,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.