Does Australia have a post-quantum cryptography (PQC) law?

No. Nothing published for Australia carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Australian Signals Directorate (ASD), via the Australian Cyber Security Centre.

What is Australia's PQC migration deadline?

2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Australian Signals Directorate (ASD), via the Australian Cyber Security Centre.

Does Australia require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

AUGuidance

Australia

Australia's ASD issues non-binding PQC guidance recommending organisations cease traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA) by end-2030, with interim milestones for a transition plan (2026) and commencing migration (2028), but the guidance carries no statutory mandate, no explicit CBOM/inventory requirement, and no enforcement mechanism.

Australia's post-quantum cryptography posture is classified as guidance, led by Australian Signals Directorate (ASD), via the Australian Cyber Security Centre, with a migration target of 2030. It scores 40/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

ASD recommends organisations cease using traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA) by the end of 2030, with milestones of having a refined transition plan by end-2026 and commencing transition (starting with critical systems and data) by end-2028. This is guidance/recommendation, not a binding mandate, published in ASD's "Planning for post-quantum cryptography" (first published July 2022, updated September 2025), part of the ISM/ACSC guidance suite.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source explicitly frames this as 'ASD recommends' guidance (PROTECT-level guidance, part of the ISM/ACSC guidance suite), not a binding statutory or regulatory mandate with penalties, so it scores 0.
Deadline concreteness	20/20	The evidence gives specific hard years: refined transition plan by end-2026, commence transition by end-2028, and cease traditional asymmetric cryptography by end-2030. It scores the maximum 20 for named years.
Scope of coverage	10/20	The guidance is addressed to 'organisations' generally within ASD/ACSC's guidance suite (government and regulated entities it advises), not stated as economy-wide or covering all critical infrastructure, nor is it limited to a single named regulated sector in the evidence, placing it at a mid-level 10 for an unspecified but organization-directed scope.
Inventory/CBOM requirement	0/20	The evidence only addresses migration timelines for ceasing specific algorithms (RSA, DH, ECDH, ECDSA); no explicit cryptographic inventory/CBOM requirement or general risk-assessment obligation is mentioned, so it scores 0.
Regulatory activity	10/20	A named authority (ASD, via the Australian Cyber Security Centre) issues and updates this guidance, but the evidence describes no enforcement mechanism such as fines, audits, or certification tied to it, so it scores 10 for a named authority without visible enforcement teeth.
Total	40/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

APRA (Australian Prudential Regulation Authority)
Has published guidance
In a 24 June 2026 address to the AFIA Risk Summit ("Fighting fire with fire"), an APRA Member set an explicit supervisory expectation that regulated entities begin mapping where cryptography is relied upon across their systems, data, and third-party providers, and committed APRA to escalate supervisory engagement over the coming year, with boards expected to show progress against ASD's timeline. This is APRA's own expectation-setting, not merely a restatement of ASD's deadline.
RBA (Reserve Bank of Australia)
Has published guidance
The RBA's Payments System Board, at its June 2026 meeting, broadened its remit from card-payment encryption to system-wide cryptographic issues across the Australian payments system, reaffirmed a December 2030 industry cryptographic-uplift target, and endorsed opening a formal consultation on strengthening cryptographic practices, potentially using the RBA's own standard-setting powers under the Payment Systems (Regulation) Act.
ASIC (Australian Securities and Investments Commission)
Not yet addressed, a gap to watch
ASIC's most recent relevant output, an 8 May 2026 open letter to AFS licensees on cyber uplift, addresses frontier-AI-driven cyber risk and does not mention post-quantum cryptography, quantum computing, or cryptographic inventory anywhere.

FAQ: Australia and PQC

Does Australia have a post-quantum cryptography (PQC) law?: No. Nothing published for Australia carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Australian Signals Directorate (ASD), via the Australian Cyber Security Centre.
What is Australia's PQC migration deadline?: 2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Australian Signals Directorate (ASD), via the Australian Cyber Security Centre.
Does Australia require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.