Vendor-Neutral Advisory
AI Governance
Compliance
CNSA 2.0 Deadline: What It Means for AI Programs
Eric Anderson
In brief
- From January 1, 2027, new National Security System acquisitions are expected to support CNSA 2.0, the NSA's post-quantum cryptography suite, by default.
- AI stacks combine long-lived data, signed model artifacts, heavy encrypted traffic and deep commercial supply chains. All of it is in scope.
- The purchases you make between now and January decide whether your AI program inherits a replacement project.
Jan 1, 2027
Acquisition gate for National Security Systems
2030
Signing and networking use CNSA 2.0 exclusively
2033
Cloud, browsers and operating systems follow
2035
Goal: every National Security System quantum-resistant
Most coverage of CNSA 2.0 treats post-quantum cryptography as a networking and PKI story. It is also an AI story, and when it comes to CNSA 2.0 compliance, AI programs are among the least prepared.
AI systems built for defense, intelligence and government contractors are cryptography-heavy by design. They move training data between enclaves, sign and distribute model weights, call inference endpoints over TLS, and run on GPU clusters and cloud platforms that sit inside an NSS boundary. Every one of those touchpoints is in scope. If your AI program is still being specified, sourced or built, the January gate applies to what you are buying right now.
What CNSA 2.0 requires, and when
CNSA 2.0 is the NSA's list of approved algorithms for National Security Systems, built to resist attacks from future quantum computers. Unlike most guidance, it does not leave room for interpretation. It names exact algorithms at exact strengths, drawn from NIST's new post-quantum standards: FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA).
Key establishment
ML-KEM-1024
Digital signatures
ML-DSA-87
Encryption
AES-256
Hashing
SHA-384 / SHA-512
Software & firmware signing
LMS / XMSS
The January 2027 date is a procurement gate, not a deployment deadline. From that day, new NSS acquisitions are expected to support CNSA 2.0 by default. Products also need FIPS 140-3 validation and, for NSS use, NIAP evaluation against updated Protection Profiles. The longer "exclusive use" deadlines then arrive category by category.
| System category | Support and prefer | Use exclusively |
|---|---|---|
| Software and firmware signing | 2025 | 2030 |
| Traditional networking (VPNs, routers) | 2026 | 2030 |
| Web browsers, servers and cloud services | 2025 | 2033 |
| Operating systems | 2027 | 2033 |
| Niche equipment and large PKI | 2030 | 2033 |
| Custom applications and legacy equipment | – | Update or replace by 2033 |
Source: NSA CNSA 2.0 advisory, as summarized by Encryption Consulting and PQShield. NSM-10 sets 2035 as the goal for quantum-resistant cryptography across all NSS.
One more pressure point sits behind the dates: validation queues. FIPS 140-3 certificates have averaged well over 500 days from submission to active status. A vendor that has not entered the queue yet will not have a validated module before 2028, no matter how good its engineering is.
Why AI programs face higher CNSA 2.0 risk
AI programs concentrate the four things CNSA 2.0 cares about most.
The data has to stay secret for decades
Defense and intelligence training sets often include imagery, signals and operational records that stay sensitive for 20 years or more. That is the target of "harvest now, decrypt later" collection: traffic recorded today can be read once a capable quantum computer exists.
Risk starts now, not at the deadline
Model weights are the crown jewels
A trained model can represent millions of dollars of compute and years of curated data. Weights move between training clusters, staging and edge devices, and every copy should be signed. Model artifacts that ship like software will be held to the same signing bar.
Software signing goes CNSA-only by 2030
AI is network-hungry
Distributed training, retrieval-augmented generation and agent workflows generate constant TLS and VPN traffic between services. Post-quantum keys and signatures are far larger than classical ones, and that overhead lands on every handshake in a latency-sensitive inference path.
ML-DSA-87 signature ~4,600 bytes vs. 96 for ECDSA P-384
The supply chain is long and mostly commercial
A typical AI stack pulls in a cloud platform, GPU servers, an operating system, an ML framework, a vector database, an API gateway and several SaaS tools. Many of those vendors don't see themselves as defense suppliers. If they perform cryptography inside an NSS boundary, they are in scope.
One non-compliant component can disqualify a solution
Where post-quantum cryptography lives in an AI stack
Most AI teams have never inventoried their cryptography, because it is buried in components they bought rather than built. Walk the stack from the top down. The bottom three layers, shaded below, are the hardest: hardware can't be fixed with a software patch.
| Layer | Where crypto shows up | CNSA 2.0 question to ask |
|---|---|---|
| Inference & APIs | TLS on endpoints, API gateways, service mesh | Can the gateway negotiate post-quantum TLS and still hit latency targets? |
| Model artifacts | Weight files, containers, model registries | Are artifacts signed, and with which algorithm? |
| Data pipelines | Transfers between enclaves, encrypted storage, key management | Is key exchange ML-KEM-1024 and data at rest AES-256? |
| Identity & PKI | Certificates for services, users and AI agents | Can the CA issue ML-DSA-87 certificates? Is a hybrid plan in place? |
| Cloud platform & HSMs | Hypervisor, key management service, HSMs, region links | Are HSMs FIPS 140-3 validated with PQC? What's the NIAP roadmap? |
| Training infrastructure | GPU server firmware, BMCs, cluster networking, OS | Is firmware signed with LMS or XMSS? Does the OS support CNSA 2.0? |
| Edge & tactical | Field devices running models close to the mission | Can the hardware handle larger keys and signatures at all? |
CNSA 2.0 checklist for AI programs before January 1, 2027
You will not finish a post-quantum migration before January. You can make sure nothing you buy from here on locks you out.
Scope it
- Decide whether you are in scope. Ask of every AI system: does it, or will it, sit inside or connect to a National Security System? If you sell to primes or agencies, assume yes until proven otherwise.
- Inventory your cryptography. Walk the stack above and record the algorithm, library and vendor at each layer. You cannot plan a migration you cannot see. MALA's free Compliance Gap Check is a quick place to start.
Buy it right
- Put CNSA 2.0 in every open solicitation. Any GPU, cloud, HSM, networking or software purchase still in evaluation should require CNSA 2.0 support, FIPS 140-3 validation status and a written NIAP roadmap. Our RFP & Requirements Builder can help you write those requirements in, and our AI infrastructure buying guide for regulated industries covers the rest of the checklist.
- Get evidence from vendors, not promises. Ask for CMVP certificate numbers, CAVP results for ML-KEM and ML-DSA, and dates. A "PQC-ready" slide is not a certificate.
Buying a classical-only component in December is buying a replacement project.
Build it ready
- Start signing model artifacts now. Treat weights and containers like firmware. Pilot LMS or XMSS signing in your model registry so the 2030 deadline is a configuration change, not a rebuild.
- Test post-quantum TLS on your inference path. Measure the latency and bandwidth cost of larger keys and certificates before production traffic forces the issue.
- Design for crypto-agility. CNSA 2.0 is the NSA's current answer, not a permanent one. Put cryptography behind interfaces so algorithms can be swapped without rewriting applications.
Avoid
- Don't plan around waivers. Waivers exist for genuinely unavoidable gaps and are approved case by case. When a compliant competitor is available, a program office has little reason to grant one.
CNSA 2.0 FAQ for AI and IT leaders
We're not a defense contractor. Does CNSA 2.0 apply to us?
Formally, CNSA 2.0 applies to National Security Systems and the vendors that supply them. In practice, the reach is wider. A cloud provider hosting a classified workload, a SaaS tool running inside an NSS-adjacent environment, or a component maker whose part ends up in a defense system all inherit the requirement through the system boundary. Banks and other regulated industries are also adopting CNSA 2.0 voluntarily as a benchmark for post-quantum readiness. CNSA 2.0 is also separate from CMMC; if you hold defense contracts, see CMMC readiness for government contractors too.
Does the January gate mean our existing AI systems stop working?
No. The gate applies to new acquisitions. Systems already deployed keep running, but they face the later exclusive-use deadlines in 2030 and 2033. The practical risk is in the pipeline: a program that buys classical-only infrastructure this quarter will deliver a system that is out of date on arrival.
Can we just wait for our cloud and GPU vendors to handle it?
Only if you have evidence they will. Vendor timelines depend on validation queues that run more than a year, and your contract may not require them to meet any date. Ask for certificate numbers and roadmap commitments now, and write them into renewals.
Is hybrid cryptography acceptable during the transition?
Hybrid approaches, which pair a classical and a post-quantum algorithm, are a common bridge for certificates and TLS while tools mature. They help with compatibility, but the end state CNSA 2.0 describes is post-quantum algorithms used on their own. Plan hybrid as a step, not the destination.
The bottom line
CNSA 2.0 turns post-quantum cryptography from a research topic into a buying criterion. For AI programs, the exposure is not one product. It is the cloud, the GPUs, the HSMs, the gateways and the PKI underneath every model. The decisions that matter most are the purchases being made between now and January 1. That makes it as much a sourcing question as a compliance one, and it belongs in every AI strategy review.
The teams that come through this well will not be the ones with the most cryptographers. They will be the ones that knew where their cryptography lived, asked vendors for proof before signing, and kept their options open as the standards keep moving.
Independent. Vendor-neutral. No fee to you.
Have an AI infrastructure purchase in flight?
MALA compares 430+ providers on CNSA 2.0 readiness, validation status and roadmap, then negotiates terms that protect you if a vendor's timeline slips. Bring a renewal, an RFP or a question.
An advisor responds within one business day.
Sources
- Commercial National Security Algorithm Suite 2.0 advisory, National Security Agency
- FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard, NIST
- FIPS 204: Module-Lattice-Based Digital Signature Standard, NIST
- The 2027 Procurement Gate: Why CNSA 2.0 Compliance Starts Now, PostQuantum.com
- CNSA 2.0 for the Defense Industrial Base, PostQuantum.com
- What is CNSA 2.0?, Encryption Consulting
- CNSA 2.0 compliant crypto solution, PQShield
For informational use only. Not legal advice.
