Japan

Japan's cryptographic governance runs through CRYPTREC (Cryptography Research and Evaluation Committees), which maintains Japan's official list of recommended cryptographic algorithms for government and critical systems. CRYPTREC has a long track record of closely tracking, and sometimes contributing to, international standardization, including NIST's PQC process.

What's required

As of the latest published CRYPTREC guidance, Japan has not issued a binding PQC migration mandate. CRYPTREC is in an active evaluation phase for NIST's finalized ML-KEM, ML-DSA, and SLH-DSA algorithms, consistent with its historical approach of adopting internationally vetted algorithms into its own recommended list (CRYPTREC Ciphers List) rather than developing a fully separate domestic standard.

NISC (National center of Incident readiness and Strategy for Cybersecurity) coordinates broader national cybersecurity strategy, within which quantum-readiness is an emerging theme that is not yet codified.

Who it applies to

• Government systems and agencies, which are expected to follow CRYPTREC's recommended algorithm list once PQC entries are finalized.
• Critical infrastructure operators, under general cybersecurity strategy guidance from NISC, though without PQC-specific binding timelines yet.
• Private sector organizations, who typically follow CRYPTREC recommendations as a de facto standard even without legal compulsion, given the list's role in government procurement.

What organizations need to do

1. Monitor CRYPTREC's ciphers list directly: updates adding ML-KEM/ML-DSA/SLH-DSA will be the clearest signal of Japan's position hardening from "monitoring" to "guidance" or "mandated."
2. Expect Japan's eventual approach to closely mirror NIST's algorithm choices, unlike China's sovereign-algorithm path. This reduces the risk of needing a separate cryptographic profile for the Japanese market.
3. Organizations already complying with NIST-aligned PQC migration for other markets are unlikely to face additional Japan-specific algorithm work, only process/inventory documentation aligned to CRYPTREC's eventual requirements.

Enforcement and current status

No enforcement mechanism exists yet specific to PQC migration. CRYPTREC's list carries practical authority through government procurement requirements, but a binding private-sector mandate with penalties has not been published as of this writing.