Brazil Doesn't Have a PQC Deadline Because It Already Finished the First Step

Most PQC regulation on this tracker is about the future: a deadline by which organizations must have migrated away from vulnerable algorithms. Brazil's ICP-Brasil standard skips that question almost entirely, because it isn't managing a migration -- it's defining what's approved today, and ML-KEM and ML-DSA are already on the list.

A binding standard with algorithms live, not scheduled

Brazil's national PKI authority, ITI (Instituto Nacional de Tecnologia da Informação), formally incorporated NIST's post-quantum algorithms into version 6.0 of DOC-ICP-01.01 -- the Cryptographic Standards and Algorithms document governing every ICP-Brasil digital certificate -- via Instrução Normativa ITI nº 35, published in the Diário Oficial da União (Brazil's official gazette) on 30 January 2026.

The specifics are concrete: ML-DSA per FIPS 204 (variants ML-DSA-44, -65, -87), ML-KEM per FIPS 203 (variants ML-KEM-512, -768, -1024) for key agreement, and envelope schemes such as aes256WithMLKEM768Encryption. These sit alongside, not instead of, a broader standard update that simultaneously consolidated modern elliptic curves (Ed25519, Ed448, Curve25519) and retained RSA and Brainpool, plus added new certificate types (Electronic Seal, Specific Applications).

Coverage extends to services under ITI's direct responsibility, explicitly including the Gov.br platform's advanced digital-signature feature -- meaning post-quantum algorithms are already an option inside Brazil's federal government digital-identity infrastructure, not just a technical specification sitting unused.

Why "no deadline" doesn't mean "no urgency"

Read mechanically, Brazil's standard scores poorly on this tracker's deadline-concreteness axis: no year, no phased timeline, no "by 2030" language anywhere in the norm. That's accurate, but it understates what's actually happened. Most countries' PQC deadlines answer the question "by when must you stop using vulnerable algorithms." Brazil's standard answers a different, earlier question: "which post-quantum algorithms can you use starting now." The first question requires a deadline because it's forcing a transition away from something. The second doesn't, because it's simply expanding what's permitted.

That's a meaningfully different regulatory posture than a roadmap like the EU's or UK's. Those countries are still building toward the moment Brazil's PKI authority has already reached for new ICP-Brasil certificates: the moment where PQC algorithms are a live, approved, usable option rather than a future requirement.

What's still missing

The gap is on the other side of the migration question: Brazil's standard sets no requirement -- no deadline, no penalty -- for existing ICP-Brasil certificates built on RSA or elliptic-curve cryptography to migrate to the new post-quantum options. The standard adds PQC to the approved list; it doesn't deprecate what's already there or set a sunset date. An organization with an existing ICP-Brasil certificate has no compliance clock running yet, even though a quantum-safe alternative already exists for new certificates.

Scope is also narrower than it might first appear: this is ICP-Brasil's PKI and digital-signature ecosystem specifically, not an economy-wide mandate. And like most PQC instruments on this tracker, it names no cryptographic-inventory or CBOM requirement -- there's no mechanism built into the standard for identifying which existing certificates would need to migrate if a deadline were eventually set.

What to do with this

If you issue or rely on ICP-Brasil certificates, ML-KEM and ML-DSA are available to you now, not eventually -- a genuinely actionable option most countries on this tracker can't yet offer their own PKI ecosystems. If you're holding existing RSA- or elliptic-curve-based certificates, there's no forcing deadline today, but ITI has shown it moves on this topic by amending the standard directly rather than issuing separate guidance, which makes a future deprecation announcement a real possibility worth tracking rather than a remote one.

The Brazil country page tracks the standard with its primary source.