Does Thailand have a post-quantum cryptography (PQC) law?

No. Nothing published for Thailand carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber Security Agency (NCSA / สกมช.).

What is Thailand's PQC migration deadline?

2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from National Cyber Security Agency (NCSA / สกมช.).

Does Thailand require a Cryptographic Bill of Materials (CBOM)?

Not as a requirement. Cryptographic inventory work does appear in the sources listed on this page, but none of it creates an obligation to produce or report one. The score rationale below quotes exactly what each source says.

THGuidance

Thailand

Thailand's National Cyber Security Agency runs a dedicated public PQC platform with a four-phase national roadmap naming NIST-standardized algorithms (ML-KEM, ML-DSA) and target years through 2035, and the Bank of Thailand's BAHTNET modernization consultation paper commits to building post-quantum cryptography in from day one with a 2030 migration-roadmap target -- real, detailed, dated public planning, though both remain advisory or in-consultation rather than binding on Thailand's financial sector or economy at large.

Thailand's post-quantum cryptography posture is classified as guidance, led by National Cyber Security Agency (NCSA / สกมช.), with a migration target of 2035. It scores 45/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

Thailand's National Cyber Security Agency (NCSA / สกมช.) runs a dedicated public education and roadmap platform, "QUANTA" (pqc-learn.ncsa.or.th), whose migration roadmap page lays out a four-phase national timeline citing NIST guidance and the Quantum Economic Development Consortium's 2022 quantum-safe-organization guide:

"2024-2026: การสำรวจและประเมินความเสี่ยง ระบุสินทรัพย์ที่มีมูลค่าสูงและช่องทางการสื่อสารที่เสี่ยงต่อการถูกโจมตีในทุกภาคส่วน" (Survey and risk assessment: identify high-value assets and communication channels vulnerable to attack across all sectors)

"2027-2030: การบูรณาการ PQC เริ่มใช้อัลกอริทึมที่ผ่านการรับรองจาก NIST (ML-KEM, ML-DSA) ในจุดเชื่อมต่อโครงสร้างพื้นฐานหลัก" (PQC integration: begin using NIST-certified algorithms (ML-KEM, ML-DSA) at core infrastructure connection points)

"2031-2034: การทำงานร่วมกันเต็มรูปแบบ เปลี่ยนผ่านระบบเครือข่ายเกตเวย์ทางการเงินและระบบควบคุมพลังงานทั่วประเทศ" (Full interoperability: transition financial-gateway networks and nationwide power-control systems)

"Target 2035: ความทนทานต่อควอนตัม บรรลุเป้าหมายการเปลี่ยนผ่านระบบ PQC อย่างสมบูรณ์" (Target 2035: quantum resilience -- fully complete the PQC transition)

Separately, the Bank of Thailand's BAHTNET Modernization Stakeholder Consultation Paper (dated July 2026) commits explicitly to a quantum-safe settlement system:

"Aligned with the BIS financial system quantum-readiness roadmap, post-quantum cryptography will be built in from day one to ensure the system's cryptographic foundation remains secure as quantum computing matures and related risks increase. A published migration roadmap targeting 2030 completion will provide guidance for Thailand's financial system to collectively achieve readiness."

The same paper directly polls respondents on their own PQC posture: "How aware is your organization of the implications of post-quantum cryptography for your own systems and data?" with a top answer option of "we have an active post-quantum migration program targeting 2030 readiness."

What we checked and did not find

Both documents remain planning-stage: NCSA's roadmap is educational guidance on a public awareness platform, not a binding directive, and BOT's paper is explicitly a stakeholder consultation, not yet an issued rule. Neither document names a formal cryptographic-inventory or CBOM reporting requirement with a compliance deadline. Thai financial-press reporting (a March 2026 seminar) quotes NCSA Secretary-General Air Chief Marshal Amorn Chomchai committing to publish a "National Post Quantum Cryptography Migration Plan" within the following year -- this plan was not yet published as of this page's last review and is not cited as a source here.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	5/20	NCSA's roadmap and BOT's consultation paper are both advisory/planning documents -- NCSA's platform is explicitly educational ('ควรเริ่มต้นวางแผน,' organizations should begin planning), and BOT's paper is a stakeholder consultation, not yet a directive, so no binding obligation exists yet for any regulated entity.
Deadline concreteness	15/20	NCSA's roadmap names four explicit phases with year ranges (2024-2026, 2027-2030, 2031-2034, complete by 2035) and ties specific NIST-standardized algorithms (ML-KEM, ML-DSA) to the 2027-2030 phase. BOT separately targets 2030 for its own migration roadmap. This is unusually concrete for a guidance-stage jurisdiction.
Scope of coverage	10/20	NCSA's roadmap is framed nationally, spanning critical infrastructure broadly (financial gateways and national power-control systems are both explicitly named in the 2031-2034 phase), while BOT's paper is scoped to Thailand's financial settlement system specifically -- combined, this covers more than a single narrow sector.
Inventory/CBOM requirement	3/20	NCSA's 2024-2026 phase calls for identifying high-value assets and vulnerable communication channels across all sectors, an inventory-adjacent action, but neither document names a formal cryptographic inventory or CBOM requirement with a reporting obligation.
Regulatory activity	12/20	NCSA (a real national cybersecurity agency) runs a dedicated public PQC platform with a detailed national roadmap, and BOT (the central bank) has issued a substantive consultation paper with concrete PQC content -- genuine, active regulatory-adjacent engagement, though neither has yet converted planning into a binding rule.
Total	45/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Bank of Thailand (BOT)
In progress, no guidance yet
BOT's BAHTNET Modernization Stakeholder Consultation Paper (July 2026) commits to building post-quantum cryptography into the new settlement system 'from day one,' aligned with the BIS financial system quantum-readiness roadmap, and states a migration roadmap will target 2030 completion. This is a consultation-stage document, not yet a binding directive, and directly polls respondents on their own PQC migration awareness and progress.

FAQ: Thailand and PQC

Does Thailand have a post-quantum cryptography (PQC) law?: No. Nothing published for Thailand carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber Security Agency (NCSA / สกมช.).
What is Thailand's PQC migration deadline?: 2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from National Cyber Security Agency (NCSA / สกมช.).
Does Thailand require a Cryptographic Bill of Materials (CBOM)?: Not as a requirement. Cryptographic inventory work does appear in the sources listed on this page, but none of it creates an obligation to produce or report one. The score rationale below quotes exactly what each source says.