Does United Kingdom have a post-quantum cryptography (PQC) law?

No. Nothing published for United Kingdom carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is NCSC (National Cyber Security Centre, UK).

What is United Kingdom's PQC migration deadline?

2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from NCSC (National Cyber Security Centre, UK).

Does United Kingdom require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

GBGuidance

United Kingdom

The UK's PQC policy is non-binding NCSC guidance with a concrete three-milestone roadmap (2028/2031/2035) covering organisations broadly across IT and OT systems, implying but not naming a cryptographic inventory requirement, with no enforcement mechanism yet in place.

United Kingdom's post-quantum cryptography posture is classified as guidance, led by NCSC (National Cyber Security Centre, UK), with a migration target of 2035. It scores 60/100 on this tracker's rubric, one of the more binding and actively enforced rules on this tracker, and that is not a measure of how secure or advanced the country actually is.

What's verified

NCSC UK has published formal guidance ("Timelines for migration to post-quantum cryptography," at ncsc.gov.uk/guidance/pqc-migration-timelines) setting a three-milestone PQC migration roadmap for UK organisations: by 2028, complete a full discovery exercise, define migration goals, and build an initial migration plan; by 2031, carry out early/highest-priority PQC migration activities and refine the plan into a thorough roadmap; by 2035, complete migration to PQC across all systems, services and products. NCSC states this 10-year window (2025–2035) is "a sufficient period for a rich set of PQC standards to appear, for an ecosystem of products that uses them to be developed, and for uptake to become widespread."

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source is explicitly 'guidance' (not statute or regulation): the verifier notes confirm this is 'guidance/milestones for organisations to self-assess against, not a binding mandate with enforcement,' so it scores at the non-binding floor.
Deadline concreteness	20/20	The source publishes three specific target years (2028, 2031, and 2035) for discovery/planning, priority migration, and full migration respectively, which are explicit years rather than directional language.
Scope of coverage	20/20	The guidance is addressed to 'UK organisations' broadly with a 10-year window for 'uptake to become widespread' across 'IT and operational technology (OT) systems,' indicating an economy-wide/cross-sector scope rather than a single regulated sector or government-only scope.
Inventory/CBOM requirement	10/20	The 2028 milestone requires organisations to 'complete a full discovery exercise' and 'build an initial migration plan,' which is a general discovery/risk-assessment obligation that plainly implies a cryptographic inventory, but the source does not name 'CBOM' or 'cryptographic inventory' explicitly.
Regulatory activity	10/20	NCSC is named as the issuing authority and has published the roadmap/milestones, but the evidence describes guidance and target dates with no mention of fines, audits, or certification mechanisms to enforce compliance.
Total	60/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Bank of England / PRA (Prudential Regulation Authority)
Has published guidance
Has published its own guidance. An October 2025 Bank of England publication on innovation in AI, distributed ledger technology, and quantum computing devotes a substantive section to post-quantum cryptography, names "harvest now, decrypt later" as a defined risk, discloses that the Bank has developed risk scenarios for post-quantum threats and is piloting a PRA supervisory briefing on quantum risks, and notes the Bank co-chairs the G7 Cyber Expert Group with the US Treasury. This is independent, dated BoE/PRA action beyond restating NCSC's timeline.
FCA (Financial Conduct Authority)
In progress, no guidance yet
The FCA's one relevant artifact, an October 2025 research note on quantum computing applications in financial services, explicitly disclaims representing the FCA's official position and covers quantum computing use cases (portfolio optimisation, fraud detection) rather than post-quantum cryptography or cryptographic inventory. The FCA is also a founding member of the UK Quantum Regulators Forum (launched 28 April 2025 with official government terms of reference), a real, dated coordination body, though not itself a PQC/CBOM guidance document.
UK Quantum Regulators Forum, terms of reference →

FAQ: United Kingdom and PQC

Does United Kingdom have a post-quantum cryptography (PQC) law?: No. Nothing published for United Kingdom carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is NCSC (National Cyber Security Centre, UK).
What is United Kingdom's PQC migration deadline?: 2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from NCSC (National Cyber Security Centre, UK).
Does United Kingdom require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.