Post-Quantum Cryptography Transition and Cybersecurity Enhancement Act of 2026

Section 1. Short Title. This Act may be cited as the 'Post-Quantum Cryptography Transition Act'. Section 2. Findings. Congress finds that the emergence of quantum computers threatens the integrity of widely-used cryptographic algorithms, necessitating a coordinated transition to post-quantum cryptographic standards across government and critical infrastructure. Section 3. Authority. The Director of the National Institute of Standards and Technology (NIST) shall, within 18 months, issue final standards for post-quantum cryptographic algorithms. The Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of the Cybersecurity and Infrastructure Security Agency (CISA), shall issue regulations requiring all federal agencies and owners/operators of critical infrastructure designated under section 9 of this Act to implement these standards within a reasonable timeframe not to exceed 5 years from the date of the standard's publication. Section 4. Funding. There is authorized to be appropriated $2.5 billion for fiscal years 2027 through 2031 to carry out this Act, to be allocated as follows: (1) $1 billion for grants to small and medium-sized businesses for transition costs; (2) $500 million for NIST and CISA technical assistance and workforce training; (3) $1 billion for research and development of next-generation cryptographic methods. Funding shall be offset by a one-time 0.5% surcharge on gross receipts of financial institutions with assets over $50 billion, deposited into the Cryptographic Transition Fund. Section 5. Oversight. The Government Accountability Office shall report biannually to Congress on progress, costs, and security risks of the transition. The CISA shall maintain a public dashboard of compliance status and incident reports. Section 6. Enforcement. The Secretary of Homeland Security may issue civil penalties not to exceed $50,000 per day for non-compliance by critical infrastructure entities after a 180-day warning period. Willful failure to comply that results in a data breach shall be subject to treble damages in civil actions brought by the Attorney General. Section 7. Judicial Review. Any regulation issued under this Act may be challenged in the United States Court of Appeals for the District of Columbia Circuit within 60 days of promulgation. The court shall set aside any regulation found to be arbitrary, capricious, or inconsistent with this Act. Section 8. Sunset. This Act shall expire 10 years after the date of enactment, except that sections 3 and 6 shall remain in effect for existing regulations until compliance is fully achieved as determined by the Secretary. Section 9. Critical Infrastructure Definition. The term 'critical infrastructure' means systems and assets defined in 42 U.S.C. § 5195c(e), and shall include entities identified by CISA under Presidential Policy Directive 21, including financial services, energy, communications, and healthcare sectors.