Thailand's PQC Plan Is Running on Two Separate Clocks, and Neither Has Legal Force Yet

Thailand has two separate, independently developed PQC timelines running at once -- one from its cybersecurity agency, targeting 2035, and one from its central bank's own payment-settlement system, targeting 2030. Neither is binding law. A third, newer plan may be closing the gap between them, but we couldn't confirm it well enough to treat as settled.

Two real documents, two different clocks

NCSA (Thailand's National Cyber Security Agency, สกมช.) runs a dedicated public platform called QUANTA at pqc-learn.ncsa.or.th, with a migration roadmap laying out four phases:

"2024-2026: การสำรวจและประเมินความเสี่ยง ระบุสินทรัพย์ที่มีมูลค่าสูง..." (Survey and risk assessment: identify high-value assets...)

"2027-2030: การบูรณาการ PQC เริ่มใช้อัลกอริทึมที่ผ่านการรับรองจาก NIST (ML-KEM, ML-DSA)..." (PQC integration: begin using NIST-certified algorithms (ML-KEM, ML-DSA)...)

"Target 2035: ความทนทานต่อควอนตัม บรรลุเป้าหมายการเปลี่ยนผ่านระบบ PQC อย่างสมบูรณ์" (Target 2035: quantum resilience -- fully complete the PQC transition)

Separately, the Bank of Thailand committed to something more specific but on a tighter timeline, in its BAHTNET Modernization Stakeholder Consultation Paper (July 2026) -- BAHTNET being Thailand's real-time gross settlement system:

"Aligned with the BIS financial system quantum-readiness roadmap, post-quantum cryptography will be built in from day one to ensure the system's cryptographic foundation remains secure as quantum computing matures and related risks increase. A published migration roadmap targeting 2030 completion will provide guidance for Thailand's financial system to collectively achieve readiness."

Two real, dated, government-published documents -- one targeting full national transition by 2035, the other targeting the core financial settlement infrastructure by 2030, five years earlier. They were developed independently and don't cross-reference each other in the text available. If you're trying to understand "Thailand's PQC deadline" as a single number, there isn't one yet -- there are two, for different scopes, from different authorities.

Neither one is a rule yet

Both documents are explicitly non-binding in their own terms. QUANTA is an educational and awareness platform -- a public resource, not a directive with compliance consequences. BOT's BAHTNET paper is a stakeholder consultation, and it says so directly, going as far as polling respondents on their own readiness rather than telling them what's required: "How aware is your organization of the implications of post-quantum cryptography for your own systems and data?" with "we have an active post-quantum migration program targeting 2030 readiness" as a top answer choice.

Neither names a formal cryptographic-inventory or CBOM reporting requirement with a deadline attached.

A newer plan may be narrowing the gap, unconfirmed

Thai press coverage from mid-2026 describes NCSA introducing a "Quantum-Ready 2030" roadmap -- a decade-spanning strategy sequencing transformation across phases, acknowledging (per that reporting) that nationwide simultaneous deployment is financially impossible. Multiple independent search results describe a Phase 1 running 2026-2027 centered on "systematic cryptographic asset inventories," and a 2030 target for new government and critical-infrastructure projects to deploy PQC or hybrid encryption.

We tried to verify this against primary reporting and ran into a paywall (Bangkok Post, the original source) and a blocked syndication mirror, so we can't quote it directly or confirm it reflects a formal NCSA document rather than a characterization of remarks at an event. It's consistent enough across independent outlets to be worth watching, and if confirmed, it would meaningfully tighten the gap between QUANTA's 2035 target and BOT's 2030 target for the financial sector specifically. Until it's independently verifiable, treat it as a credible but unconfirmed development, not a citable source.

What to do with this

If you operate in Thailand's financial sector, BOT's BAHTNET consultation is the nearer and more specific signal -- 2030, explicitly tied to the BIS roadmap, with PQC built in "from day one" of the modernized settlement system. If you're elsewhere in the Thai economy, QUANTA's four-phase structure through 2035 is the broader reference point, though it carries no compliance obligation today.

Either way, the practical first step doesn't depend on which timeline eventually becomes binding: a real inventory of where cryptography runs in your systems is the precondition both documents eventually point toward, whether or not Thailand's "Quantum-Ready 2030" roadmap turns out to formalize that requirement.

The Thailand country page tracks both confirmed documents with their primary sources.