Tracker
PQC migration requirements, by country
Every jurisdiction is approaching post-quantum migration differently. Some have binding deadlines, others have non-binding guidance. This tracker follows primary sources directly.
- Guidance
AUAustralia
Australia's ASD issues non-binding PQC guidance recommending organisations cease traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA) by end-2030, with interim milestones for a transition plan (2026) and commencing migration (2028), but the guidance carries no statutory mandate, no explicit CBOM/inventory requirement, and no enforcement mechanism.
- Guidance
BEBelgium
Belgium has published no national PQC algorithm list or deadline of its own. Its practical guidance is a white paper led by the Belgian Cyber Security Coalition and the Quantum Circle, which the CCB contributed to rather than issued, and its timelines are adopted wholesale from the EU's coordinated roadmap: planning by end-2026, full migration by end-2030 for high-risk and end-2035 for medium-risk use cases.
- Mandated
BRBrazil
Brazil's national PKI authority ITI has formally mandated NIST-standardized post-quantum algorithms (ML-KEM/ML-DSA) into its binding ICP-Brasil certificate standard (DOC-ICP-01.01 v6.0, Jan 2026), but the instrument sets no migration deadline, defines no inventory/CBOM obligation, and names no enforcement penalty, limiting its reach to the PKI/digital-signature sector rather than the broader economy.
- Guidance
BNBrunei
Cyber Security Brunei published a national Post-Quantum Cryptography Migration Framework in mid-2026, a risk-based five-phase roadmap for government, critical infrastructure, and the private sector, with 2030 and 2035 target years but no binding mandate or CBOM requirement.
- Regulated
CACanada
Canada's ITSM.40.001 roadmap sets concrete migration years (initial plans by April 2026, high-priority systems by end-2031, remaining systems by end-2035) for Government of Canada departments, but it is framed as guidance whose actual binding force is deferred to a forthcoming Treasury Board policy instrument, with no published enforcement mechanism yet.
- Guidance
CNChina
China's Cryptography Law and Commercial Cryptography Regulations, its two governing statutes, contain zero mentions of quantum cryptography of any kind. Neither of China's two national standards registries (GM/T, GB/T) has a single post-quantum standard; both list only quantum key distribution, a different technology. SCA has funded PQC research since 2023 and its national algorithm-selection competition has been running since February 2025, but the public-key track's own submission deadline of 30 June 2026 has passed with no results published.
- Guidance
CZCzech Republic
Czech Republic's NÚKIB has endorsed a non-binding 18-member EU joint statement recommending PQC migration "by 2030 at the latest" and has itself deployed quantum-resistant cryptography on its own web portal, but no binding mandate, defined sector scope, inventory/CBOM requirement, or enforcement mechanism has been established.
- Guidance
EUEuropean Union
ENISA has published substantive, independent technical guidance on post-quantum cryptography since 2021, predating and more specific than the European Commission's 2024 Recommendation, which itself sets no binding migration deadlines.
- Guidance
FIFinland
Finland's National Cyber Security Centre (Kyberturvallisuuskeskus, under Traficom) publishes a PQC transition guide reproducing the EU NIS Cooperation Group's roadmap -- high-risk systems migrated by end-2030, medium/low-risk systems by end-2035 -- and recommends organizations build a cryptographic inventory as an immediate first step, but the guide is explicitly advisory, not a Finnish regulatory mandate.
- Regulated
FRFrance
France's ANSSI has published a detailed three-phase PQC migration roadmap (hybrid-mandatory through at least 2030, standalone PQC optional only in phase 3) enforced through its security-visa/qualification scheme for security products, but the policy carries no cryptographic inventory mandate and no stated penalty regime, and applies only to vendors seeking ANSSI certification rather than economy-wide.
- Guidance
DEGermany
Germany's BSI has published detailed, technically specific PQC migration guidance, including a hybrid-cryptography requirement for high-security applications, but the source is explicitly non-binding recommendations with no statutory mandate, no stated deadline year, undefined scope, and no named inventory/CBOM obligation.
- Regulated
GHGhana
Ghana's Bank of Ghana Cyber and Information Security Directive (March 2026) binds regulated financial institutions to monitor cryptanalysis developments and update algorithms against quantum threats, and requires Board-level review before adopting quantum computing technologies, but sets no deadline and no explicit CBOM mandate.
- Regulated
HKHong Kong
Hong Kong's HKMA launched a banking-sector Quantum Preparedness Index and whitepaper (July 2026), setting a 2030 target for full sectoral readiness (QPI score of 10) via guidance and engagement rather than binding rules, with no CBOM/inventory mandate specified.
- Regulated
INIndia
India has no national PQC mandate, but it has two binding sectoral requirements already in force: IRDAI's 2026 Information and Cyber Security Guidelines add an audited control requiring insurers to maintain a cryptographic asset inventory for post-quantum preparedness, and SEBI's CSCRF requires the same of securities-market entities. CERT-In separately publishes the country's most detailed CBOM specification, and DST's National Quantum Mission sets 2029 and 2033 targets designed to be made binding by sectoral regulators rather than by DST itself.
- Guidance
IDIndonesia
BSSN, Indonesia's national cyber and crypto agency, has formed a National Task Force for Post-Quantum Cryptography Migration Preparation and is drafting a national PQC migration roadmap, confirmed on the record by named senior BSSN and coordinating-ministry officials -- real institutional activity, but no roadmap, task-force charter, or draft regulation has been published yet, and a separately-cited BSSN cryptography regulation turns out to be unrelated to PQC.
- Regulated
ILIsrael
The Bank of Israel's Banking Supervision Department mandated, under a binding banking directive, that banks and payment providers map their encrypted data assets (functionally a cryptographic bill of materials) and submit an initial PQC preparedness plan by January 2026.
- Regulated
ITItaly
Italy's ACN has published PQC transition guidance (July 2024) and joined a 21-agency EU joint statement, but there is no binding, economy-wide PQC mandate, no published migration deadline, and no explicit CBOM/inventory requirement. Enforcement teeth exist only indirectly via NIS2's general supervisory regime (D.Lgs. 138/2024, inspections from Oct 2026), not via this guidance itself.
- Monitoring
JPJapan
CRYPTREC tracks PQC standardization and has begun evaluating NIST's finalized algorithms for inclusion in Japan's approved cryptographic list, without yet setting a binding migration deadline.
- Mandated
KWKuwait
Central Bank of Kuwait's Cyber-security and Operational Resilience Framework (CORF) contains a dedicated section of binding 'shall' clauses requiring regulated financial entities to adopt quantum-resistant cryptography, build a quantum-readiness strategy with migration timelines, and test PQC algorithms before deployment -- a genuine, enforceable migration mandate, though scoped to finance, not tied to named NIST algorithms, and without a cryptographic-inventory or CBOM requirement.
- Guidance
LVLatvia
Latvia's national NIS2 cybersecurity authority published Cryptography Guidelines (September 2025) recommending organizations prepare for post-quantum cryptography via hybrid classical-PQC implementations, and the Ministry of Defence separately joined the EU-funded QARC pilot project to develop a national PQC implementation roadmap -- real, dated activity, but both are advisory rather than binding, and neither names a compliance deadline or CBOM requirement.
- Monitoring
LTLithuania
Lithuania's Ministry of National Defence convened a National Coordination Work Group for Transition to Post-Quantum Cryptography in mid-2025, tasked with producing a national PQC transition plan by Q3 2026, which had not yet been published as of this page's last check.
- Guidance
LULuxembourg
Luxembourg's government published a national Quantum Strategy in 2025 with a dedicated PQC transition roadmap (Foundation 2025-2027, Scale-up 2027-2030, Commercial 2030+) and a named action on cryptographic inventories, but the strategy is aspirational and cross-sectoral, not a binding regulatory instrument, and the financial regulator CSSF has issued nothing PQC-specific of its own.
- Guidance
MYMalaysia
Malaysia's Cabinet approved MyKriptografi, the National Cryptography Policy, on 28 November 2025. It carries a genuine mandatory tier — national trusted cryptographic products are mandatory for Official Secrets and for NCII entities' classified data — but it sets no post-quantum migration deadline and never asks for a cryptographic inventory. Separately, CyberSecurity Malaysia has published a five-phase PQC Migration Framework whose first phase requires a cryptographic asset inventory, and Malaysia's national trusted algorithm list already includes the NIST post-quantum standards.
- Guidance
NLNetherlands
The Netherlands has no binding PQC mandate; AIVD and NCSC jointly issued January 2024 guidance urging organizations to inventory cryptographic assets (including via CBOM) and migrate before quantum computers can break common algorithms, expected between 2030 and 2040.
- Guidance
NZNew Zealand
New Zealand's NCSC issued non-binding advisory guidance in the NZISM (Jan 2022) directing government agencies to inventory their cryptographic assets and begin planning for post-quantum migration, but it sets no deadline, carries no enforcement mechanism, and does not extend beyond government systems.
- Mandated
NGNigeria
Nigeria's NCC Cyber Resilience Framework (CRF-NCS) imposes a binding PQC mandate on telecom service providers with a hard compliance deadline of February 23, 2027, though it stops short of naming an explicit cryptographic inventory/CBOM requirement or detailing enforcement penalties.
- Guidance
NONorway
Norway's National Security Authority (NSM) publishes non-binding quantum-migration guidance urging critical-sector organizations to map their cryptographic assets and begin transitioning now, but sets no deadline and no enforcement mechanism.
- Guidance
PHPhilippines
DICT's National Cybersecurity Plan 2023-2028 names quantum computing as the reason it will eventually define an accepted cryptographic standard, but commits only to publishing technical papers, not an algorithm, timeline, or CBOM requirement. Separately, the same plan makes a software bill of materials mandatory for government software procurement -- a binding SBOM clause, not a PQC-specific one. No Philippine regulator has published anything more concrete, and a vendor claim that a 2025 central-bank circular sets a quantum-safe deadline is not supported by that circular's own text.
- Regulated
PLPoland
Poland's Council of Ministers adopted a national Cybersecurity Strategy in March 2026 with a dedicated section on migrating to post-quantum cryptography, including a binding task assigning the Ministry of Digital Affairs to produce a national PQC migration plan by 2029 -- a real, dated, government-adopted commitment, though the 2029 deliverable is the plan itself, not completed migration, and no specific algorithm or CBOM requirement is named.
- Monitoring
RURussia
Russia's national cryptography standards body has run a dedicated post-quantum working group since 2019, developing candidate algorithms to eventually extend the GOST cryptographic standard series, but no standard has been formally adopted, and no mandate, deadline, or CBOM requirement exists yet.
- Mandated
SASaudi Arabia
Saudi Arabia's National Cybersecurity Authority published National Cryptographic Standards (NCS-2:2025), a binding standard requiring that all cryptographic systems and solutions support post-quantum cryptography algorithms, naming ML-KEM, Classic McEliece, ML-DSA, and SLH-DSA by their NIST FIPS numbers -- the most concrete, present-tense binding PQC mandate found anywhere in this tracker, though scoped to systems the standard governs generally rather than tied to a migration deadline or cryptographic-inventory requirement.
- Regulated
SGSingapore
CSA's Quantum-Safe Migration Handbook sets three dated milestones for Critical Information Infrastructure owners — a migration plan by 31 March 2027, quantum-safe-ready procurement from 1 January 2028, and migration complete by 31 December 2031 — but the Handbook itself states it is "not mandatory, prescriptive or exhaustive," and the binding Cybersecurity Code of Practice issued thirteen days later contains no quantum requirement at all. Separately, MAS has told financial institutions since February 2024 to maintain a cryptographic inventory, and announced in July 2026 that binding supervisory expectations are coming.
- Guidance
SISlovenia
Slovenia's URSIV has issued a non-binding May 2026 recommendation (adapted from the EU NIS Cooperation Group's PQC Roadmap FAQ) urging entities under the Information Security Act, and others, to begin transitioning to post-quantum cryptography, but the source sets no deadline, no defined sector scope, and no inventory/CBOM or enforcement requirement.
- Regulated
KRSouth Korea
South Korea selected four national post-quantum algorithms (KpqC) in January 2025 and has run three rounds of government pilot deployments since, but none of the four are yet validated for government use: Korea's binding cryptography-validation scheme, KCMVP, contains no post-quantum entries at all. The neither of the two national transition plans behind this work has been published in full by any Korean government body we could find, and the widely-cited 2035 date is KISA's own framing of an industry threat forecast, not a stated government completion deadline.
- Guidance
ESSpain
Spain's CCN-CERT (under CNI) issued non-binding technical recommendations (CCN-TEC 009 / BP-37) urging organizations to adopt hybrid PQC solutions 'as soon as possible.' The guidance carries no statutory mandate, no hard deadline, no defined sector scope, and no inventory/CBOM requirement.
- Guidance
SESweden
Sweden's NCSC (FRA-hosted) issued 2026 national guidance, not binding law, setting concrete, economy-wide target dates of end-2030 for long-sensitivity data (e.g. health data) and end-2035 for the full transition to quantum-safe cryptography, using mandatory "ska" phrasing within an otherwise recommendations-only document.
- Guidance
CHSwitzerland
Switzerland's FINMA issued non-binding supervisory guidance (9 July 2026) recommending that supervised financial institutions have a board-strategy-based PQC migration roadmap in place by mid-2027, following a survey finding most lacked one; the NCSC/BACS has separately published informational technical guidance on PQC.
- Guidance
TWTaiwan
Taiwan's approach is a non-binding industry-alliance guideline (backed by MODA/ADI as a sponsor, not an enforcer) that lays out a four-step PQC migration roadmap including an explicit cryptographic asset inventory step, but sets no deadline, no defined regulatory scope, and no enforcement mechanism.
- Guidance
THThailand
Thailand's National Cyber Security Agency runs a dedicated public PQC platform with a four-phase national roadmap naming NIST-standardized algorithms (ML-KEM, ML-DSA) and target years through 2035, and the Bank of Thailand's BAHTNET modernization consultation paper commits to building post-quantum cryptography in from day one with a 2030 migration-roadmap target -- real, detailed, dated public planning, though both remain advisory or in-consultation rather than binding on Thailand's financial sector or economy at large.
- Guidance
UAUkraine
SSSCIP's own regulatory work plan documents an in-progress amendment adding a national lattice-based signature standard, DSTU 9212:2023, to Ukraine's list of approved post-quantum-period cryptographic algorithms -- real, dated evidence of active standards work, though the amendment itself was still a planned action, not yet a completed mandate, as of the plan's issue date. Ukraine separately maintains an older lattice-based encryption standard, DSTU 8961:2019 ("Skelya"), documented in independent academic literature though not confirmed directly against SSSCIP's or UkrNDNC's own primary records.
- Mandated
AEUnited Arab Emirates
The UAE's National Encryption Policy, approved by the Cybersecurity Council via a binding Executive Regulation, requires government entities to submit approved plans migrating from RSA/ECC to post-quantum cryptography with ongoing performance monitoring, but the source provides no specific migration deadline and does not state the mandate extends beyond government systems.
- Guidance
GBUnited Kingdom
The UK's PQC policy is non-binding NCSC guidance with a concrete three-milestone roadmap (2028/2031/2035) covering organisations broadly across IT and OT systems, implying but not naming a cryptographic inventory requirement, with no enforcement mechanism yet in place.
- Regulated
USUnited States
The US mandates PQC migration for federal civilian agencies via OMB Memorandum M-26-15, with a concrete five-phase timeline running through full migration by 2035 and an automated cryptographic inventory/CBOM required as the foundation of each agency's mandatory migration plan.
- Guidance
UYUruguay
Uruguay's National Cybersecurity Strategy 2024-2030 commits the government to identifying critical infrastructure operators' post-quantum cryptography needs and developing a transition plan, and separately commits to building a new national public-key infrastructure resistant to quantum-computing threats -- real, dated strategic commitments, but not yet a binding mandate with a deadline or inventory requirement for any regulated entity.
- Regulated
VNVietnam
Vietnam's Decision 125/QĐ-TTg (6 July 2026) sets a national 2026-2035 roadmap to build quantum-resistant cryptography and PQC/QKD capability for critical information systems, but it is framed as a strategic government plan with named standards/infrastructure objectives rather than a binding regulation, and it contains no explicit cryptographic-inventory or enforcement mechanism in the cited evidence.