TCG hands hardware buyers a version number: PC Client TPM Profile 1.07

The useful part of this is a string. "PC Client Platform TPM Profile 1.07" fits on a purchase order line, and a part either implements it or it does not. The profile also names what it sits on, the TPM 2.0 Library Specification version 1.85 ^[4], so a buyer ends up checking two version numbers against a datasheet instead of reading vendor prose about quantum safety, which is the stated point of publishing the requirements at all ^[2].

The second label is where the exposure sits. By the guidance's own definitions, a part sold as PQC-upgradable is a part that does not meet the profile on the day it lands on your dock ^[12]. That can still be a good deal, and it gives existing hardware a route forward, but the account of the guidance sets out no schedule for the update and no consequence if it never ships ^[15]. A promise of future firmware becomes a supplier obligation only when someone writes the designation, the profile version, and a date into the contract.

There is also a gap between the specification and the mark. TCG says it will extend certification to modules meeting the PQC-ready criteria, which concedes that conformance to 1.07 is currently a claim a vendor makes about itself ^[13]. No date appears for when those programs start operating ^[14]. Until they do, the profile number is a better question than the ones it replaces rather than an answer.

The easiest thing to underrate here is the attestation language. TCG's framing is that resilience is not one algorithm swapped for another, and that platform identities and attestation must hold their integrity over very long periods ^[11]. Identities minted this year may need to remain secure for decades ^[8], which outlasts the refresh cycle of nearly everything they are soldered into. The upgradable designation is exactly where that mismatch lands: a decades-long trust assumption resting on a firmware update that has not shipped.

One line in the write-up deserves less weight than the specification does. It states that a vast majority of businesses still lack a formal roadmap for the transition, with no figure, survey, or date attached ^[16]. The profile is checkable. That sentence is not.