Does New Zealand have a post-quantum cryptography (PQC) law?

No. Nothing published for New Zealand carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber Security Centre (NCSC) New Zealand.

What is New Zealand's PQC migration deadline?

None. No migration deadline has been published for New Zealand by any regulator we checked, including National Cyber Security Centre (NCSC) New Zealand.

Does New Zealand require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

NZGuidance

New Zealand

New Zealand's NCSC issued non-binding advisory guidance in the NZISM (Jan 2022) directing government agencies to inventory their cryptographic assets and begin planning for post-quantum migration, but it sets no deadline, carries no enforcement mechanism, and does not extend beyond government systems.

New Zealand's post-quantum cryptography posture is classified as guidance, led by National Cyber Security Centre (NCSC) New Zealand. It scores 20/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

New Zealand's NCSC (via the NZISM v3.5 release, January 2022) added a new section to Chapter 17 (Cryptography) of the New Zealand Information Security Manual to help agencies prepare for the impacts of quantum computing on encryption. The guidance's main focus: agencies should gather information about their cryptographically protected assets and start planning for migration to post-quantum cryptographic standards. Note: this is advisory guidance, not a mandate, and the cited URL (ncsc.govt.nz/news/january-2022-new-zealand-information-security-manual-v3-5-release/) currently returns HTTP 404, since the content appears to have moved/been retired during a site restructure (NZISM content is now hosted at nzism.gcsb.govt.nz). The Wayback Machine confirms this exact URL was live with this exact content from January 2022 through at least February 2025.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source explicitly adds advisory content to the NZISM ('should gather...start planning') with no stated penalties or binding force, and the verifier notes confirm 'this is advisory guidance, not a mandate,' so this is guidance/non-binding only (0).
Deadline concreteness	0/20	No specific year or phased timeframe is stated anywhere in the evidence. It only says agencies 'should gather' information and 'start planning for migration,' with no date attached (0).
Scope of coverage	0/20	The guidance is addressed to 'agencies' within the NZISM, a manual for government information security, with no mention of economy-wide or specific regulated private-sector coverage. Scope is effectively government systems / undefined beyond that (0).
Inventory/CBOM requirement	10/20	The evidence explicitly directs agencies to 'gather important information about their cryptographically protected assets,' which is a named (if informally worded) cryptographic inventory task, not merely implied by a general risk obligation, but it stops short of naming a formal 'CBOM' mandate, so it sits between an explicit named requirement and a general implication (10).
Regulatory activity	10/20	NCSC New Zealand (part of GCSB) is the named authority publishing this guidance via the NZISM, but the evidence shows no enforcement mechanism, fines, audits, or certification scheme tied to this quantum-readiness section (10).
Total	20/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Reserve Bank of New Zealand (RBNZ)
Not yet addressed, a gap to watch
Not yet addressed directly. RBNZ has not issued a PQC- or CBOM-specific circular, standard, or guidance; its only documented engagement is a reactive comment given to Radio New Zealand journalists for an August 2026 news feature, not a regulatory publication.
Financial Markets Authority (FMA)
Not yet addressed, a gap to watch
Not yet addressed directly. FMA has not issued a PQC- or CBOM-specific circular, standard, or guidance; its only documented engagement is a reactive comment given to Radio New Zealand journalists for an August 2026 news feature, not a regulatory publication.

FAQ: New Zealand and PQC

Does New Zealand have a post-quantum cryptography (PQC) law?: No. Nothing published for New Zealand carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber Security Centre (NCSC) New Zealand.
What is New Zealand's PQC migration deadline?: None. No migration deadline has been published for New Zealand by any regulator we checked, including National Cyber Security Centre (NCSC) New Zealand.
Does New Zealand require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.