Which AI and quantum deadlines affect our vendors?
CyberRank Research
Two sets of dates now shape vendor risk. Under the EU AI Act, transparency duties apply from 2 August 2026 and Annex III high-risk duties from 2 December 2027. For quantum, the EU asks for planning by the end of 2026, and NIST deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035. CyberRank shows where each vendor stands against both today.
TL;DR
- AI Act: 2 August 2026 transparency, 2 December 2027 Annex III high-risk, 2 August 2028 AI in Annex I products.
- Quantum: EU planning by the end of 2026; NIST deprecation after 2030 and disallowance after 2035.
- Each date only helps once it reaches your vendor tiers, questionnaires, contracts and monitoring.
- CyberRank tracks vendors' AI use and quantum-crypto posture (Beta) so you can measure them against the dates.
The answer, piece by piece
| Part of the question | Short answer | Read more | How CyberRank helps |
|---|---|---|---|
| AI Act dates | Short answer2 Aug 2026 transparency; 2 Dec 2027 Annex III high-risk; 2 Aug 2028 Annex I | Read moreAI Act dates after the 2026 Omnibus | How CyberRank helpsCandidate AI Act level per vendor (Beta) |
| Post-quantum dates | Short answerEU planning by end of 2026; NIST deprecates after 2030, disallows after 2035 | Read morepost-quantum deadlines | How CyberRank helpsQuantum-crypto posture per vendor (Beta) |
| Turning dates into vendor work | Short answerPut the dates into tiers, questionnaires, contracts and monitoring | Read morethe TPRM lifecycle | How CyberRank helpsNightly reassessment and change events |
The deadlines in one table
| Date | Source | What applies | What to ask vendors |
|---|---|---|---|
| 2 Aug 2026 | SourceEU AI Act | What appliesArticle 50 transparency duties; Commission enforcement for GPAI | What to ask vendorsWhich features generate content, and how is it marked? |
| 2 Dec 2026 | SourceEU AI Act | What appliesContent marking for generative systems already on the market | What to ask vendorsThe same, for products you already use |
| End of 2026 | SourceEU PQC roadmap | What appliesTransition planning and cryptographic inventories begin | What to ask vendorsDo you have a cryptographic inventory? |
| 2 Dec 2027 | SourceEU AI Act | What appliesHigh-risk duties for Annex III areas | What to ask vendorsEvidence for uses that are high-risk candidates |
| 2 Aug 2028 | SourceEU AI Act | What appliesHigh-risk duties for AI in Annex I products | What to ask vendorsThe same, for AI built into products |
| 2030 | SourceNIST, EU roadmap | What appliesQuantum-vulnerable algorithms deprecated; EU high-risk use cases protected | What to ask vendorsWhen will key exchange be post-quantum? |
| 2035 | SourceNIST | What appliesQuantum-vulnerable algorithms disallowed | What to ask vendorsWhen will certificates and signatures follow? |
AI Act dates
The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk dates back; prohibited practices and GPAI duties already apply. For vendor risk, 2 December 2027 is the main line: by then you should know which vendors' AI falls in an Annex III area and what evidence their providers hold. Each date is explained in detail in our article about the EU AI Act and your vendors.
Post-quantum dates
NIST's transition document became final on 27 October 2026. Because recorded traffic can be decrypted later, key exchange comes first and certificate signatures follow. The dates and the order of work are explained in detail in our guide to quantum security and post-quantum cryptography.
Turning dates into vendor work
A date only helps if it reaches the vendor lifecycle: tier vendors so you know who to ask first, add the questions at assessment, write dates and notice of changes into contracts, and monitor between reviews. The six lifecycle stages are explained in detail in our guide to third-party risk management.
Where CyberRank does not help
CyberRank does not tell you which legal dates apply to a specific system; your legal team should confirm AI Act dates against the consolidated text. It cannot confirm a vendor's migration plan or its AI Act compliance. It shows where each vendor stands today, from public evidence.
References
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating