UYGuidanceUruguay
Uruguay's National Cybersecurity Strategy 2024-2030 commits the government to identifying critical infrastructure operators' post-quantum cryptography needs and developing a transition plan, and separately commits to building a new national public-key infrastructure resistant to quantum-computing threats -- real, dated strategic commitments, but not yet a binding mandate with a deadline or inventory requirement for any regulated entity.
Uruguay's post-quantum cryptography posture is classified as guidance, led by AGESIC (Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento). It scores 30/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.
What's verified
Uruguay's National Cybersecurity Strategy 2024-2030, published by AGESIC, names post-quantum cryptography in two separate action lines. Under "Línea 5.2" (strengthening critical information infrastructure), one action commits the government to:
"Identificar las necesidades de las IIC respecto de la criptografía poscuántica y desarrollar un plan de transición." ("Identify critical information infrastructure operators' needs regarding post-quantum cryptography and develop a transition plan.")
Under "Línea 5.3" (strengthening critical infrastructure's digital resilience), a separate action commits to building new quantum-resistant public-key infrastructure:
"Desarrollar una nueva infraestructura de clave pública nacional, alineada con los estándares internacionales y resistente a las amenazas de la tecnología cuántica, a través de la colaboración público-privada y la adopción de algoritmos criptográficos poscuánticos." ("Develop a new national public-key infrastructure, aligned with international standards and resistant to quantum-technology threats, through public-private collaboration and the adoption of post-quantum cryptographic algorithms.")
These are real, dated commitments inside a formally published national strategy running through 2030, naming post-quantum cryptography and post-quantum algorithms explicitly.
What we checked and did not find
Neither action carries its own target year, penalty, or reporting mechanism -- both are framed as government-led planning and infrastructure-building commitments rather than obligations on regulated entities. Neither Banco Central del Uruguay nor URSEC, Uruguay's financial and telecom regulators respectively, has published a PQC-specific circular or supervisory guidance of its own. No cryptographic inventory or CBOM requirement is named anywhere in the strategy.
Score rationale
Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.
| Axis | Score | Why |
|---|---|---|
| Mandate strength | 4/20 | The strategy commits the government itself to action ('el país deberá,' government-led planning) rather than imposing an obligation on private or public operators directly; it is a national strategic plan, not a regulatory instrument with compliance obligations. |
| Deadline concreteness | 5/20 | The strategy runs through 2030 as an overall horizon, but the PQC-specific actions -- identifying critical-infrastructure needs and developing a transition plan, and building a new quantum-resistant PKI -- carry no individual target year of their own within the document. |
| Scope of coverage | 10/20 | The relevant actions are scoped to 'infraestructuras de la información crítica' (critical information infrastructure operators), a defined but broad category spanning multiple sectors, not the whole economy and not a single regulated industry. |
| Inventory/CBOM requirement | 3/20 | The strategy commits to 'identificar las necesidades de las IIC respecto de la criptografía poscuántica' (identify critical-infrastructure operators' PQC needs), which implies some assessment process, but does not name a cryptographic inventory, CBOM, or structured asset-listing requirement. |
| Regulatory activity | 8/20 | AGESIC is a real, named national authority that published a dated, substantive strategy naming PQC directly in two separate action lines, but neither BCU nor URSEC -- the regulators that would make anything binding for banks or telecom operators -- has published anything of its own. |
| Total | 30/100 | A blunt sum of the five columns to its left. |
Related regulators
Sector bodies checked independently, not assumed from the primary source above.
- Not yet addressed, a gap to watch
Banco Central del Uruguay (BCU)
No BCU circular or supervisory guidance specifically addressing post-quantum cryptography or cryptographic inventory was located.
- Not yet addressed, a gap to watch
URSEC (Unidad Reguladora de Servicios de Comunicaciones)
No URSEC circular or guidance specifically addressing post-quantum cryptography was located.
FAQ: Uruguay and PQC
- Does Uruguay have a post-quantum cryptography (PQC) law?
- No. Nothing published for Uruguay carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is AGESIC (Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento).
- What is Uruguay's PQC migration deadline?
- None. No migration deadline has been published for Uruguay by any regulator we checked, including AGESIC (Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento).
- Does Uruguay require a Cryptographic Bill of Materials (CBOM)?
- Not as a requirement. Cryptographic inventory work does appear in the sources listed on this page, but none of it creates an obligation to produce or report one. The score rationale below quotes exactly what each source says.