Russia

Russia runs its own sovereign cryptographic standards track: the GOST series, maintained by TC 26 (Технический комитет по стандартизации «Криптографическая защита информации») under Rosstandart, with the FSB as lead regulator. This is structurally similar in independence to China's approach, but at an earlier stage for post-quantum specifically.

What's verified

TC 26 has operated Working Group 2.5, "Постквантовые криптографические механизмы" (Post-Quantum Cryptographic Mechanisms), since 2019, alongside a related working group on quantum key distribution systems (WG 4.5). This is confirmed directly on TC 26's own site, which lists the working group and its leadership under Subcommittee No. 2.

What this is not: there is no adopted GOST standard for post-quantum algorithms as of this writing. Candidate algorithm names circulate in Russian-language technical press, but none has cleared formal standardization. TC 26 itself has not published a target date, and informal press estimates of a 2026–2027 standard are not sourced to TC 26 directly and should be treated as speculative.

Who it applies to

Nobody yet, in a binding sense: there is no standard to comply with. Once a GOST post-quantum standard is adopted, it would likely apply the way existing GOST cryptographic standards do: mandatory for Russian government systems and regulated sectors (notably banking, where the Central Bank of Russia's existing cryptographic rules already require GOST-compliant algorithms), optional elsewhere.

What organizations need to do

1. There is nothing to comply with yet. Organizations operating in Russia under existing GOST cryptographic obligations should watch TC 26's publications directly rather than relying on secondary reporting of expected timelines.
2. Multinational organizations already navigating Russia's sovereign-algorithm requirements (GOST R 34.10/34.11 today) should expect a future post-quantum GOST extension to follow the same dual-track pattern China's SM-series does: a separate cryptographic profile from NIST-aligned markets, not a drop-in replacement.

Enforcement and current status

No enforcement mechanism exists because no standard exists to enforce. Russia's existing cryptographic regulations (GOST-mandated algorithms for government and regulated-sector systems) carry real enforcement weight independent of this, but nothing in that existing framework yet addresses post-quantum algorithms specifically.