Does United Arab Emirates have a post-quantum cryptography (PQC) law?

Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is UAE Cybersecurity Council (in coordination with the UAE National Cryptography Centre).

What is United Arab Emirates's PQC migration deadline?

None. No migration deadline has been published for United Arab Emirates by any regulator we checked, including UAE Cybersecurity Council (in coordination with the UAE National Cryptography Centre).

Does United Arab Emirates require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

AEMandated

United Arab Emirates

The UAE's National Encryption Policy, approved by the Cybersecurity Council via a binding Executive Regulation, requires government entities to submit approved plans migrating from RSA/ECC to post-quantum cryptography with ongoing performance monitoring, but the source provides no specific migration deadline and does not state the mandate extends beyond government systems.

United Arab Emirates's post-quantum cryptography posture is classified as mandated, led by UAE Cybersecurity Council (in coordination with the UAE National Cryptography Centre). It scores 40/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

The UAE Cybersecurity Council formally approved a National Encryption Policy, together with an accompanying Executive Regulation, that mandates encryption controls for data at rest and in motion and defines binding national requirements for key management, post-quantum cryptography, implementation, and ongoing performance monitoring. Per the Executive Regulation, government entities are required to develop and submit clear, well-defined, officially approved transition plans migrating from traditional encryption (RSA/ECC) to post-quantum cryptographic standards. (Note: no source, including the official u.ae primary page, corroborates the claim that this was done "in coordination with the UAE National Cryptography Centre"; that attribution should be dropped or independently verified before use, as it appears to be an unsupported addition not found in any primary or secondary source.)

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	20/20	The policy's Executive Regulation 'mandates encryption controls' and 'requires' government entities to develop and submit 'officially approved transition plans' migrating from RSA/ECC to post-quantum cryptography, a binding regulatory mandate, though the evidence identifies this obligation as applying to government entities rather than an economy-wide statute, so it is scored as fully binding for the covered subset.
Deadline concreteness	0/20	No specific year or phased timeframe appears anywhere in the evidence or verified claim. Entities must submit 'officially approved transition plans,' but no target date or migration deadline is quoted or paraphrased from the source.
Scope of coverage	0/20	The verified claim states the transition-plan mandate applies to 'government entities,' and the evidence describes the policy only in terms of encryption controls generally, with no statement that coverage extends to critical infrastructure or the economy at large.
Inventory/CBOM requirement	10/20	There is no named CBOM/cryptographic-inventory requirement in the evidence, but the mandate to 'develop and submit clear, well-defined, officially approved transition plans' from RSA/ECC to PQC plainly implies an underlying inventory of current cryptographic usage to plan that migration, matching the 'implied via a general risk-assessment/migration obligation' tier.
Regulatory activity	10/20	A named authority (UAE Cybersecurity Council, approving the policy and its Executive Regulation) is identified and 'ongoing performance monitoring' is referenced in the evidence, but no fines, audits, or certification enforcement mechanism is quoted or described, so teeth remain unconfirmed.
Total	40/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Central Bank of the UAE (CBUAE)
Not yet addressed, a gap to watch
Not yet addressed directly. No circular or notice in CBUAE's official notifications archive addresses PQC or cryptographic inventory.
Securities and Commodities Authority (SCA)
Not yet addressed, a gap to watch
Not yet addressed directly. SCA's own website now redirects to a rebranded UAE Commodities and Markets Authority domain; no PQC/CBOM content was found under either identity.
TDRA (Telecommunications and Digital Government Regulatory Authority)
Not yet addressed, a gap to watch
Not yet addressed directly. TDRA's cybersecurity services (penetration testing, vulnerability detection, SIEM) do not include anything naming post-quantum cryptography or cryptographic inventory.

FAQ: United Arab Emirates and PQC

Does United Arab Emirates have a post-quantum cryptography (PQC) law?: Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is UAE Cybersecurity Council (in coordination with the UAE National Cryptography Centre).
What is United Arab Emirates's PQC migration deadline?: None. No migration deadline has been published for United Arab Emirates by any regulator we checked, including UAE Cybersecurity Council (in coordination with the UAE National Cryptography Centre).
Does United Arab Emirates require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.