Post-quantum cryptography has moved from research competition to commercial deployment. NIST published the final version of IR 8547, Transition to Post-Quantum Cryptography Standards, on October 27, 2026. It sets the transition schedule: quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed after 2035, with earlier deadlines for federal high-value assets and high-impact systems. The remaining questions for technology companies are practical: which implementations carry residual patent risk, how to contribute to ongoing protocol and additional-signature work without creating problems, and where a product portfolio can still create defensible value.
Most migration consultancies inventory cryptographic assets and write roadmaps. We focus on the technical–legal intersection: what is being standardized, who owns related IP, and how a company can implement or contribute cleanly.
We built PQScope for this work. It is the proprietary graph we use to connect the research record, the people and organizations behind it, the standards process, and the patent disclosures. That graph is the foundation for the advice we give.
What the graph shows
PQScope surfaces research momentum, organization activity, patent linkages, and the distinction between algorithm-level contributions and implementation-level work. It tracks the live state of the NIST process, including the finalized standards (FIPS 203, 204, and 205), the selected-but-not-yet-final algorithms (HQC, FN-DSA), and the ongoing additional digital-signatures round. It follows IETF drafts, protocol profiles, and the contributor networks that shape them.
We use the graph for early warning on protocol changes, for diligence on whether a claimed contribution is actually reflected in the record, and for understanding which research groups are driving particular use cases (constrained devices, hybrid key exchange, side-channel resistance).
The October 2026 collection spans thousands of research items, researcher profiles, and organizations, with source records retained so findings can be inspected. Coverage is not complete, and relationships are sometimes inferred. That is the point of working with it rather than treating it as a finished database.
Freedom-to-operate for implementations
NIST secured royalty-free licenses covering certain patent portfolios asserted against ML-KEM. Those licenses are important, but they are not a blanket freedom-to-operate for every product that implements the standard. Hardware accelerators, side-channel countermeasures, hybrid constructions, protocol integrations, and novel parameter choices can still implicate third-party claims.
We use PQScope to map the known license commitments, the residual patent landscape, and the specific design choices in a client’s implementation. The output is a risk assessment that distinguishes what the NIST licenses cover from what still requires attention, together with practical recommendations on design adjustments or defensive filings.
IP strategy for contributions and products
NIST prefers royalty-free or clearly licensed contributions so that standardization is not hindered. Companies that participate in the additional-signatures process, IETF protocol work, or implementation profiles need to decide what to disclose, what to patent, and how to structure statements.
We advise on:
- Timing and content of patent statements and royalty-free commitments.
- Defensive or complementary portfolios around implementations, optimizations, crypto-agility mechanisms, and protocol uses.
- Inventorship and co-authorship issues when research teams and product teams collaborate.
- How to position a portfolio so that it supports commercialization without impeding standards adoption.
For product companies that are not submitting algorithms, the same questions apply to the features they add on top of the standards: performance improvements, secure implementations, integration with existing systems, and crypto-agile architectures.
Engagement forms
Typical engagements include:
- Scoped freedom-to-operate assessments for a specific algorithm, hybrid construction, or product feature.
- Standards-contribution strategy for teams participating in NIST or IETF processes.
- Portfolio architecture for research organizations or startups whose work intersects the standards.
- Investor or acquirer diligence that evaluates a target’s technical position, contribution history, and residual FTO risks against the graph.
- Ongoing retainers that surface relevant research, patent, and process developments as they occur.
We work with product teams, research organizations, and investors. We do not run cryptographic inventory or full migration programs; those are better handled by specialist implementers. We provide the IP and standards layer that those programs usually lack, using a graph we built for the work.