Does Saudi Arabia have a post-quantum cryptography (PQC) law?

Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is National Cybersecurity Authority (NCA / الهيئة الوطنية للأمن السيبراني).

What is Saudi Arabia's PQC migration deadline?

None. No migration deadline has been published for Saudi Arabia by any regulator we checked, including National Cybersecurity Authority (NCA / الهيئة الوطنية للأمن السيبراني).

Does Saudi Arabia require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

SAMandated

Saudi Arabia

Saudi Arabia's National Cybersecurity Authority published National Cryptographic Standards (NCS-2:2025), a binding standard requiring that all cryptographic systems and solutions support post-quantum cryptography algorithms, naming ML-KEM, Classic McEliece, ML-DSA, and SLH-DSA by their NIST FIPS numbers -- the most concrete, present-tense binding PQC mandate found anywhere in this tracker, though scoped to systems the standard governs generally rather than tied to a migration deadline or cryptographic-inventory requirement.

Saudi Arabia's post-quantum cryptography posture is classified as mandated, led by National Cybersecurity Authority (NCA / الهيئة الوطنية للأمن السيبراني). It scores 48/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

Saudi Arabia's National Cybersecurity Authority (NCA) publishes the National Cryptographic Standards (NCS-2:2025), which states its own binding force directly:

"تحدد المعايير الوطنية للتشفير (NCS-2:2025) الحد الأدنى لمتطلبات التشفير المطلوب من الجهات الوطنية الالتزام..." ("The National Cryptographic Standards (NCS-2:2025) set the minimum cryptographic requirements that national entities are required to comply with...")

The document explicitly supersedes its predecessor: "هذه النسخة من الوثيقة (NCS-2:2025) تحل محل النسخ السابقة (NCS-1:2020)... فإن هذه النسخة (NCS-2:2025) ملغية للنسخة السابقة، وتحل محلها" ("This version of the document (NCS-2:2025) replaces the prior version (NCS-1:2020)... this version voids the prior version and replaces it").

Section 2-5, "Post-Quantum Algorithms" (خوارزميات ما بعد الحوسبة الكمية), names specific NIST-standardized algorithms by their FIPS numbers: ML-KEM per FIPS 203 (ML-KEM-512/768 for baseline, ML-KEM-1024 for advanced), Classic McEliece, ML-DSA per FIPS 204, and SLH-DSA per FIPS 205. Its operative clauses are binding:

"٢-٥-٥-١ يجب استخدام نظم التشفير لما بعد الحوسبة الكمية؛ مع نظم تشفير كلاسيكية." ("§2-5-5-1: Post-quantum cryptography systems must be used, together with classical cryptography systems.")

"٢-٥-٥-٢ يجب أن تدعم جميع نظم وحلول التشفير خوارزميات التشفير لما بعد الحوسبة الكمية (PQC)." ("§2-5-5-2: All cryptographic systems and solutions must support post-quantum cryptography (PQC) algorithms.")

A separate section, §8 "Quantum Key Distribution (QKD)," adds five further sub-clauses, including a requirement that QKD implementations be hybrid ("using post-quantum algorithms alongside classical algorithms for authentication and key agreement"), continuous QBER monitoring, and conformance to ISO/IEC 23837.

What we checked and did not find

Multiple third-party compliance and consulting blogs (cyberarrow.io, wattlecorp.com, entrust.com) attribute this quantum-risk mandate to NCA's separate "Essential Cybersecurity Controls" (ECC-2:2024) -- that attribution is wrong. ECC-2:2024, fetched directly and checked in full, contains zero occurrences of "quantum," "post-quantum," or "PQC" anywhere. The real mandate lives in NCS-2:2025, a distinct document, and should be cited there rather than to ECC-2:2024. SAMA (the central bank) has likewise published no PQC-specific circular of its own -- its Cyber Security Framework, including its own dedicated Cryptography principle, contains zero mentions of quantum computing. NCS-2:2025 itself sets no specific compliance deadline and names no cryptographic-inventory or CBOM requirement.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	18/20	NCS-2:2025 uses يجب ("shall/must") throughout its PQC clauses, in a document that explicitly states it 'sets the minimum cryptographic requirements national entities must comply with' and that it supersedes and cancels the prior version (NCS-1:2020). This is a hard, present-tense, binding mandate -- 'all cryptographic systems and solutions must support post-quantum cryptography algorithms' -- not a future-readiness aspiration, which is why it scores near the top of the mandate-strength tier.
Deadline concreteness	3/20	The standard sets no specific compliance year or phased migration timeline -- the requirement to support PQC algorithms applies now, as a present-tense baseline standard, rather than via a dated transition schedule.
Scope of coverage	12/20	NCS-2:2025 applies to national entities generally ('الجهات الوطنية') for civil and commercial cryptographic purposes -- broader than a single regulated sector like banking or telecom, though the evidence reviewed does not establish it as covering literally every organization in the economy.
Inventory/CBOM requirement	0/20	No cryptographic-inventory, asset-discovery, or CBOM requirement was found anywhere in the document.
Regulatory activity	15/20	NCA is Saudi Arabia's national cybersecurity authority, and NCS-2:2025 is a formally versioned, gazetted-equivalent standard that explicitly cancels and replaces its 2020 predecessor -- substantial regulatory activity. It falls short of full marks because the evidence reviewed does not show a specific audit or penalty regime tied to the PQC clauses themselves.
Total	48/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Saudi Central Bank (SAMA)
Not yet addressed, a gap to watch
SAMA's Cyber Security Framework -- including its dedicated Cryptography principle -- was read in full and contains zero occurrences of "quantum" anywhere in the document. SAMA-regulated entities are separately bound by NCA's NCS-2:2025 as the national cryptographic standard, but SAMA has not issued a PQC-specific circular of its own.
NCA -- Essential Cybersecurity Controls (ECC-2:2024)
Not yet addressed, a gap to watch
Multiple vendor/compliance blogs attribute a quantum-risk mandate to ECC-2:2024, but the actual document -- fetched directly and grepped in full -- contains zero occurrences of "quantum," "post-quantum," or "PQC." That claim does not survive contact with the primary text; the real binding PQC mandate lives in NCS-2:2025, a separate NCA document, and should not be attributed to ECC-2:2024.

FAQ: Saudi Arabia and PQC

Does Saudi Arabia have a post-quantum cryptography (PQC) law?: Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is National Cybersecurity Authority (NCA / الهيئة الوطنية للأمن السيبراني).
What is Saudi Arabia's PQC migration deadline?: None. No migration deadline has been published for Saudi Arabia by any regulator we checked, including National Cybersecurity Authority (NCA / الهيئة الوطنية للأمن السيبراني).
Does Saudi Arabia require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.