Does Brazil have a post-quantum cryptography (PQC) law?

Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Instituto Nacional de Tecnologia da Informação (ITI), Brazil's national PKI authority, published in the Diário Oficial da União.

What is Brazil's PQC migration deadline?

None. No migration deadline has been published for Brazil by any regulator we checked, including Instituto Nacional de Tecnologia da Informação (ITI), Brazil's national PKI authority, published in the Diário Oficial da União.

Does Brazil require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

BRMandated

Brazil

Brazil's national PKI authority ITI has formally mandated NIST-standardized post-quantum algorithms (ML-KEM/ML-DSA) into its binding ICP-Brasil certificate standard (DOC-ICP-01.01 v6.0, Jan 2026), but the instrument sets no migration deadline, defines no inventory/CBOM obligation, and names no enforcement penalty, limiting its reach to the PKI/digital-signature sector rather than the broader economy.

Brazil's post-quantum cryptography posture is classified as mandated, led by Instituto Nacional de Tecnologia da Informação (ITI), Brazil's national PKI authority, published in the Diário Oficial da União. It scores 30/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

Brazil's national PKI authority (ITI) formally incorporated NIST post-quantum algorithms ML-KEM (FIPS 203) and ML-DSA (FIPS 204) into version 6.0 of the official Cryptographic Standards and Algorithms document (DOC-ICP-01.01) governing ICP-Brasil digital certificates, via Instrução Normativa ITI nº 35, de 30 de janeiro de 2026, published in the Diário Oficial da União. The norm's PQC rollout explicitly extends to services under ITI's responsibility including the Gov.br platform's advanced signature feature. The document specifies ML-DSA (conforme FIPS 204) with variants ML-DSA-44/65/87, ML-KEM-512/768/1024 for key agreement, and envelope schemes such as aes256WithMLKEM768Encryption; it also concurrently consolidated modern elliptic curves (Ed25519, Ed448, Curve25519) alongside RSA/Brainpool and added new certificate types (Electronic Seal, Specific Applications).

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	10/20	The source is a binding regulatory instrument (Instrução Normativa ITI nº 35, de 30 de janeiro de 2026, published in the Diário Oficial da União) whose Article 5 'formally approves version 6.0 of DOC-ICP-01.01,' making the PQC algorithm specifications (ML-DSA, ML-KEM) mandatory for ICP-Brasil certificate infrastructure: a binding statutory/regulatory mandate, but no penalty clause is quoted in the evidence, so it falls short of a full 20 with enforceable penalties and is scored as binding regulation without a stated penalty mechanism.
Deadline concreteness	0/20	No specific year, phased timeline, or directional migration language (e.g. 'by 2030') appears anywhere in the claim or evidence. The source only states the algorithms were 'formally incorporated' into v6.0 of the standard as of the Jan 30 2026 publication date, with no future compliance deadline mentioned.
Scope of coverage	10/20	Coverage is explicitly scoped to ICP-Brasil digital certificate infrastructure and named services 'under ITI's responsibility including the Gov.br platform's advanced signature feature': a specific regulated domain (national PKI/digital signature ecosystem), not economy-wide critical infrastructure, matching the rubric's 10-point tier for sector-specific scope.
Inventory/CBOM requirement	0/20	Neither the claim nor the evidence mentions any cryptographic inventory, asset-discovery obligation, CBOM mandate, or even a general risk-assessment requirement. The source is limited to specifying which PQC algorithms and key sizes (ML-DSA-44/65/87, ML-KEM-512/768/1024) are approved for use, with no inventory-related language at all.
Regulatory activity	10/20	ITI is explicitly named as the issuing national PKI authority and the instrument is a formal regulatory norm published in the Diário Oficial da União, but the evidence describes only algorithm approval/standard-setting (Article 5 approving DOC-ICP-01.01 v6.0) with no quoted fines, audit regime, or certification-enforcement mechanism, matching the rubric's 10-point tier of 'named authority, no visible enforcement teeth yet.'
Total	30/100	A blunt sum of the five columns to its left.

FAQ: Brazil and PQC

Does Brazil have a post-quantum cryptography (PQC) law?: Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Instituto Nacional de Tecnologia da Informação (ITI), Brazil's national PKI authority, published in the Diário Oficial da União.
What is Brazil's PQC migration deadline?: None. No migration deadline has been published for Brazil by any regulator we checked, including Instituto Nacional de Tecnologia da Informação (ITI), Brazil's national PKI authority, published in the Diário Oficial da União.
Does Brazil require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.