South Korea's First PQC Mandate Is a Month Away, If the Reporting Holds Up

South Korea has run one of the most methodical national post-quantum cryptography programs anywhere -- a two-round algorithm competition, a final slate of four national algorithms, two rounds of government pilot deployments across seven sectors. And as of this writing, none of it is legally required, because the one validation scheme that would make it binding doesn't support post-quantum algorithms yet.

That might change next month. We can't fully confirm it does.

The gap this would close

Korea's cryptography-validation scheme, KCMVP, is the thing that actually binds government agencies today: under the e-Government Act, the head of an administrative agency "shall" use only cryptographic modules validated by NIS. We checked the current KCMVP validated list directly. It has ARIA, SEED, LEA, HIGHT, and AES as block ciphers; SHA-2, LSH, and SHA-3 as hash functions; RSA-PSS, KCDSA, EC-KCDSA, and ECDSA for signatures; DH and ECDH for key establishment.

Zero post-quantum algorithms. Not KpqC's own four national finalists, not NIST's ML-KEM, ML-DSA, or SLH-DSA.

MSIT's own May 2026 research agenda explains why: one of four funded R&D tasks running through 2030 is explicitly to introduce PQC into KCMVP. Until that evaluation technology exists, no PQC algorithm -- Korean or international -- can be validated for Korean government use, regardless of what any transition plan says.

That's the state of play this reported amendment would change.

What the reporting says

Multiple independent Korean outlets -- Lawtimes (legal trade press), Financial News, Boannews (security trade press), and Electronic Times (technology press) -- report that an amendment to the Quantum Science Technology and Quantum Industry Promotion Act passed the National Assembly plenary on 23 April 2026 and cleared Cabinet approval on 12 May 2026, adding a new Article 18-2. The reported requirement: heads of central administrative agencies, local governments, and public institutions must establish and apply a quantum security system -- PQC or QKD -- based on technical guidelines the Minister of Science and ICT prepares in consultation with the Director of NIS. Reporting consistently gives an effective date of 20 November 2026.

A separate reported provision, a new Article 10, would add a mandatory "quantum technology utilization impact assessment" before implementing quantum-technology projects in space, defense, communications, energy, finance, and transportation that touch national security or public welfare.

If accurate, this is the first binding PQC mandate in Korea's regulatory history -- not a competition result, not a pilot program, an actual statutory duty with a named population.

Why we're not calling it confirmed

We tried to verify Article 18-2 directly against the gazetted text at law.go.kr, Korea's national legal information center, and could not retrieve readable article content through a direct fetch. That's a tooling limitation on our end -- law.go.kr's search and document viewer did not return usable text to the method available to us -- not evidence the reporting is wrong.

What tips this toward "credible, pending confirmation" rather than "unverified rumor" is convergence: four independent outlets, from different parts of the trade press (legal, financial, security, technology), agree on the same article number, the same passage dates, and the same effective date. That kind of agreement across outlets that don't normally cite each other is a real signal. It's also not a substitute for reading the statute.

We're treating this the same way we treat a few other strong-but-unconfirmed leads on this tracker -- reported clearly, with the gap stated plainly, and no score change until someone can read the primary text.

A supply-side number worth remembering either way

One Korean financial-press report, independent of the statute story, adds a concrete and checkable detail: as of 15 September 2026, only three vendors held KCMVP certification for PQC-capable modules. If the reported mandate takes effect on schedule and reaches the reported population of 600-plus entities -- central ministries, local governments, public institutions -- that's a significant certified-supply gap regardless of exactly when the legal effective date lands.

NIS has reportedly announced a phased verification timeline alongside this: KEM verification targets selected by January 2027, verification conducted through January 2028, mandatory deployment from January 2029; digital-signature verification following roughly two years behind. Seven algorithms are reportedly under evaluation across both categories, including the four KpqC finalists.

What to do with this

If you operate in or sell into South Korea's public sector, 20 November is worth putting in a calendar regardless of how confident you are in the reporting -- the downside of checking and finding nothing changed is small, and the downside of missing a real statutory deadline isn't. If you're a vendor, the three-certified-supplier number is the more immediately actionable fact: certification capacity, not policy language, may be the actual bottleneck here.

Either way, the underlying technical work doesn't change based on which date turns out to be right: an inventory of where cryptography runs in your systems is the precondition for any PQC transition plan, statute or no statute.

The South Korea country page tracks this story and will update as soon as the statute text can be independently confirmed.