Norway Won't Give You a PQC Deadline. It Will Tell You the Date Doesn't Matter as Much as Starting.

Every other country on this tracker, binding or not, names at least one year. Norway doesn't. Its national security authority's quantum-migration guidance contains no date of any kind -- and reading why reveals something more honest than most confident-sounding timelines manage.

The guidance with nothing to point to on a calendar

Norway's National Security Authority (Nasjonal sikkerhetsmyndighet, NSM) publishes official guidance under a dedicated "Kvantemigrasjon" (quantum migration) section on nsm.no -- an overview page, a migration guide (veileder), and cryptographic recommendations. It directs Norwegian organizations, particularly system owners in critical sectors (telecom, finance, health, energy, petroleum), to risk-assess their IT systems for quantum vulnerabilities and transition to quantum-safe cryptography.

What it doesn't contain, anywhere in the available text, is a year. Not 2030, not 2035, not a phased sequence of target dates the way the EU, UK, Germany, or dozens of other jurisdictions on this tracker structure their guidance. NSM's own language states only that migration "tar tid" (takes time) and that organizations should begin "allerede nå" (already now) -- an instruction to start immediately, paired with an explicit refusal to promise a finish line.

Why that might be the more honest choice

It's tempting to read "no deadline" as weaker guidance than a country that confidently states "by 2030." But consider what a deadline actually represents in most of this guidance: an estimate, usually inherited from the same handful of sources (NIST's timelines, the EU's roadmap, BIS financial-sector projections) rather than independently derived national analysis. Several countries on this tracker relay the same 2030 or 2035 figure without stating where it originated -- Finland's guidance is unusually transparent about attributing its dates to the EU roadmap specifically, as this tracker's Finland coverage notes, but most simply present the number as if it were their own.

Norway's guidance sidesteps that by not claiming a precision it can't actually back with independent analysis. "Migration takes time, start now" is a less satisfying answer than a specific year, but it's arguably a more defensible one -- it doesn't imply a false confidence about exactly when a cryptographically relevant quantum computer will arrive, a figure genuinely uncertain across the entire expert community this guidance ultimately depends on.

What this costs Norway on this tracker

The absence of a deadline is a real gap by this tracker's own rubric -- deadline concreteness scores zero, since there's genuinely nothing to cite. That's not a rhetorical point; it has a practical cost. An organization trying to build an internal migration timeline, budget cycle, or board presentation benefits from a date to work backward from, even a non-binding one borrowed from elsewhere. NSM's approach, while arguably more intellectually honest, gives Norwegian organizations less structure to plan against than a confidently-stated (if less rigorously derived) foreign deadline would.

Where the real risk analysis is happening

Norway's financial-sector engagement is more substantive than NSM's guidance alone suggests. Finanstilsynet (the Financial Supervisory Authority) devotes a dedicated section of its 2025 annual ICT risk report to quantum-computing threats, naming "steal data today, decrypt later" attacks directly and recommending firms adopt new encryption algorithms as they become available -- genuine, independently authored risk analysis, not NSM's guidance restated by an adjacent body. Norges Bank's 2026 Financial Infrastructure Report separately discusses quantum threats and explicitly confirms NSM holds sector-wide advisory responsibility, without committing Norges Bank to its own PQC requirements.

What to do with this

If you operate in Norway's critical sectors, the absence of a deadline doesn't reduce the urgency NSM's own language conveys -- "start already now" is a real instruction, just one without a date to anchor a project plan against. The practical move is to borrow a reference timeline from elsewhere (the EU's 2030/2035 structure is the most proximate and relevant) for internal planning purposes, while following NSM's recommended first step regardless: a detailed mapping of your organization's actual cryptographic assets and risks, which is the one piece of this guidance that doesn't depend on getting a date right.

The Norway country page tracks NSM's guidance and the independent financial-sector risk analysis with their primary sources.