NIST IR 8547 is NIST's transition plan for moving from quantum-vulnerable cryptography to post-quantum algorithms. NIST's project page says quantum-vulnerable algorithms are to be deprecated and removed from NIST standards by 2035, with high-risk systems moving much earlier. The document itself was a draft when we checked.
What it is
IR 8547 is an Internal Report, not a standard. Its abstract says it covers NIST's expected approach to moving from quantum-vulnerable algorithms to post-quantum digital signature and key-establishment schemes, and it identifies existing quantum-vulnerable standards.
Its status
NIST lists the report as an Initial Public Draft published on 12 November 2024. Public comments closed on 10 January 2025, and NIST said comments would be used to revise the plan. We could not retrieve a final version, so treat the draft as the best available signal and check NIST for updates.
What the project page says about timing
NIST's page, last updated August 2026, says that under the IR 8547 timeline quantum-vulnerable algorithms are to be deprecated and removed from NIST standards by 2035. It adds that high-risk systems will move much earlier. The exact interim dates and definitions are in the draft document, and we did not read them from the source, so do not quote specific dates from this post.
What 2035 does and does not mean
- It is about NIST standards removing algorithms. It is not a law that applies to every company.
- Contract and sector rules may reference NIST, so customers could ask about it.
- It is an outer limit. Anything with long-lived data or long product lifetimes should move sooner.
How to plan
- Read the draft yourself and note the dates for the algorithms you use.
- Inventory where those algorithms appear. See Start a cryptographic inventory this week.
- Add post-quantum migration to your product roadmap as a multi-year item with owners.
- Track product lifetimes. A device shipped in 2030 may still be in service in 2040.
For the broader question of timing, see Is Q-Day coming in 2027? Myth versus fact.
Questions to ask your vendors
Because the transition affects products you buy as well as code you write, turn the timeline into vendor questions. Which of your products use quantum-vulnerable public-key algorithms? Which will support the NIST post-quantum standards, and when? Can customers choose algorithms by configuration? Will old and new algorithms run side by side during a transition?
Record the answers beside your inventory. Vendors with no plan are a risk to put on your register, with a review date, so the gap is visible before an audit or a customer asks.
One more practical point: put the dates you read from the draft into your own risk register with a review reminder after NIST publishes any revision. That way a change in the document turns into a scheduled review rather than a surprise.
Quick check
Is IR 8547 a binding rule?
It is an Internal Report listed as an initial public draft, so it is guidance on NIST's expected approach, not a regulation.
Sources
Last reviewed: 19 October 2026.
