Timeline
PQC migration deadlines, by country
Two years do most of the work: 2030 and 2035 account for more than half of every deadline a government has published. Israel moved first, setting January 2026 for its banks. 22 more countries have a real PQC policy on the books with no date attached to it at all.
Deadlines by year
Busiest: 2030
2026
1 jurisdiction
- Regulated
Bank of Israel, Banking Supervision Department
The Bank of Israel's Banking Supervision Department mandated, under a binding banking directive, that banks and payment providers map their encrypted data assets (functionally a cryptographic bill of materials) and submit an initial PQC preparedness plan by January 2026.
Primary source →
2027
2 jurisdictions
- Mandated
Nigerian Communications Commission (NCC)
Nigeria's NCC Cyber Resilience Framework (CRF-NCS) imposes a binding PQC mandate on telecom service providers with a hard compliance deadline of February 23, 2027, though it stops short of naming an explicit cryptographic inventory/CBOM requirement or detailing enforcement penalties.
Primary source → - Guidance
FINMA (Eidgenössische Finanzmarktaufsicht) and NCSC/BACS (Bundesamt für Cybersicherheit)
Switzerland's FINMA issued non-binding supervisory guidance (9 July 2026) recommending that supervised financial institutions have a board-strategy-based PQC migration roadmap in place by mid-2027, following a survey finding most lacked one; the NCSC/BACS has separately published informational technical guidance on PQC.
Primary source →
2029
1 jurisdiction
- Regulated
Rada Ministrów (Council of Ministers) / Ministerstwo Cyfryzacji (Ministry of Digital Affairs)
Poland's Council of Ministers adopted a national Cybersecurity Strategy in March 2026 with a dedicated section on migrating to post-quantum cryptography, including a binding task assigning the Ministry of Digital Affairs to produce a national PQC migration plan by 2029 -- a real, dated, government-adopted commitment, though the 2029 deliverable is the plan itself, not completed migration, and no specific algorithm or CBOM requirement is named.
Primary source →
2030
8 jurisdictions
- Guidance
Australian Signals Directorate (ASD), via the Australian Cyber Security Centre
Australia's ASD issues non-binding PQC guidance recommending organisations cease traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA) by end-2030, with interim milestones for a transition plan (2026) and commencing migration (2028), but the guidance carries no statutory mandate, no explicit CBOM/inventory requirement, and no enforcement mechanism.
Primary source → - Guidance
Centre for Cybersecurity Belgium (CCB)
Belgium has published no national PQC algorithm list or deadline of its own. Its practical guidance is a white paper led by the Belgian Cyber Security Coalition and the Quantum Circle, which the CCB contributed to rather than issued, and its timelines are adopted wholesale from the EU's coordinated roadmap: planning by end-2026, full migration by end-2030 for high-risk and end-2035 for medium-risk use cases.
Primary source → - Guidance
National Cyber and Information Security Agency (NÚKIB)
Czech Republic's NÚKIB has endorsed a non-binding 18-member EU joint statement recommending PQC migration "by 2030 at the latest" and has itself deployed quantum-resistant cryptography on its own web portal, but no binding mandate, defined sector scope, inventory/CBOM requirement, or enforcement mechanism has been established.
Primary source → - Guidance
National Cyber Security Centre Finland (Kyberturvallisuuskeskus), under Traficom
Finland's National Cyber Security Centre (Kyberturvallisuuskeskus, under Traficom) publishes a PQC transition guide reproducing the EU NIS Cooperation Group's roadmap -- high-risk systems migrated by end-2030, medium/low-risk systems by end-2035 -- and recommends organizations build a cryptographic inventory as an immediate first step, but the guide is explicitly advisory, not a Finnish regulatory mandate.
Primary source → - Regulated
ANSSI (Agence nationale de la sécurité des systèmes d'information)
France's ANSSI has published a detailed three-phase PQC migration roadmap (hybrid-mandatory through at least 2030, standalone PQC optional only in phase 3) enforced through its security-visa/qualification scheme for security products, but the policy carries no cryptographic inventory mandate and no stated penalty regime, and applies only to vendors seeking ANSSI certification rather than economy-wide.
Primary source → - Regulated
BSI (Bundesamt für Sicherheit in der Informationstechnik), with BMI and BMDS
Germany moved from pure guidance to a real mandate in 2026: NIS2-regulated entities are legally required under Section 30 BSIG to keep cryptography at the state of the art, and a joint BSI/BMI/BMDS national implementation guideline (September 2026) attaches concrete milestones -- cryptographic inventory by end-2026, high-risk systems quantum-safe by 2030, near-complete migration by 2035 -- and names CBOM/CycloneDX directly as the way to build that inventory. The guideline's own language is still mostly "should," but the legal hook behind it is real.
Primary source → - Regulated
Hong Kong Monetary Authority (HKMA)
Hong Kong's HKMA launched a banking-sector Quantum Preparedness Index and whitepaper (July 2026), setting a 2030 target for full sectoral readiness (QPI score of 10) via guidance and engagement rather than binding rules, with no CBOM/inventory mandate specified.
Primary source → - Regulated
Ministry of Economic Affairs and Climate, with AIVD and NCSC-NL
The Dutch cabinet published a nationwide Quantum Strategy in October 2026 with a dated PQC migration timetable for central government -- cryptographic policy and risk integration by end-2026, mature cryptographic asset management by end-2027, high-risk systems migrated by 2030 -- and ties it to a real statutory hook, the Cyberbeveiligingswet's cryptography-policy requirement. DNB separately runs the most developed sector-specific cryptographic-inventory expectation for financial institutions. Binding force is strongest for central government; private-sector and critical-infrastructure coverage remains advisory.
Primary source →
2031
2 jurisdictions
- Regulated
Treasury Board of Canada Secretariat (TBS), with the Canadian Centre for Cyber Security (CCCS)
Treasury Board of Canada Secretariat already issued the binding policy instrument that CCCS's ITSM.40.001 roadmap said was forthcoming: a Security Policy Implementation Notice (SPIN), in force since October 2025, requiring every Government of Canada information system using cryptography to migrate to PQC on a dated schedule, including a cryptographic-inventory update by 2028 and mandatory PQC procurement clauses from April 2026. OSFI separately requires the same of federally regulated banks and insurers.
Primary source → - Regulated
Cyber Security Agency of Singapore (CSA), with GovTech and IMDA
CSA's Quantum-Safe Migration Handbook sets three dated milestones for Critical Information Infrastructure owners — a migration plan by 31 March 2027, quantum-safe-ready procurement from 1 January 2028, and migration complete by 31 December 2031 — but the Handbook itself states it is "not mandatory, prescriptive or exhaustive," and the binding Cybersecurity Code of Practice issued thirteen days later contains no quantum requirement at all. Separately, MAS has told financial institutions since February 2024 to maintain a cryptographic inventory, and announced in July 2026 that binding supervisory expectations are coming.
Primary source →
2035
6 jurisdictions
- Guidance
Cyber Security Brunei (CSB)
Cyber Security Brunei published a national Post-Quantum Cryptography Migration Framework in mid-2026, a risk-based five-phase roadmap for government, critical infrastructure, and the private sector, with 2030 and 2035 target years but no binding mandate or CBOM requirement.
Primary source → - Guidance
NCSC Sweden (Nationellt cybersäkerhetscenter, hosted at Försvarets radioanstalt/FRA)
Sweden's NCSC (FRA-hosted) issued 2026 national guidance, not binding law, setting concrete, economy-wide target dates of end-2030 for long-sensitivity data (e.g. health data) and end-2035 for the full transition to quantum-safe cryptography, using mandatory "ska" phrasing within an otherwise recommendations-only document.
Primary source → - Guidance
National Cyber Security Agency (NCSA / สกมช.)
Thailand's National Cyber Security Agency runs a dedicated public PQC platform with a four-phase national roadmap naming NIST-standardized algorithms (ML-KEM, ML-DSA) and target years through 2035, and the Bank of Thailand's BAHTNET modernization consultation paper commits to building post-quantum cryptography in from day one with a 2030 migration-roadmap target -- real, detailed, dated public planning, though both remain advisory or in-consultation rather than binding on Thailand's financial sector or economy at large.
Primary source → - Guidance
NCSC (National Cyber Security Centre, UK)
The UK's PQC policy is non-binding NCSC guidance with a concrete three-milestone roadmap (2028/2031/2035) covering organisations broadly across IT and OT systems, implying but not naming a cryptographic inventory requirement, with no enforcement mechanism yet in place.
Primary source → - Regulated
Office of Management and Budget (OMB), Executive Office of the President
The US mandates PQC migration for federal civilian agencies via OMB Memorandum M-26-15, with a concrete five-phase timeline running through full migration by 2035 and an automated cryptographic inventory/CBOM required as the foundation of each agency's mandatory migration plan.
Primary source → - Regulated
Prime Minister's Office / Authority of Information Security (Cục An toàn thông tin), Vietnam
Vietnam's Decision 125/QĐ-TTg (6 July 2026) sets a national 2026-2035 roadmap to build quantum-resistant cryptography and PQC/QKD capability for critical information systems, but it is framed as a strategic government plan with named standards/infrastructure objectives rather than a binding regulation, and it contains no explicit cryptographic-inventory or enforcement mechanism in the cited evidence.
Primary source →
Policy on record, no deadline set
Each of these has a real, verified PQC policy. None of them attaches a date to it.
FAQ: PQC migration deadlines
- What is the deadline for post-quantum cryptography migration?
- There is no single global deadline. 20 jurisdictions on this tracker have published a dated target, ranging from 2026 to 2035. The most common target years are 2030 and 2035. Which one applies to an organization depends on where it operates and which regulator supervises it, and most of these dates bind only critical infrastructure or a specific regulated sector rather than the whole economy.
- Is the 2035 PQC deadline mandatory?
- It depends on the jurisdiction. Some 2035 targets sit in binding instruments, others in non-binding guidance or strategy documents that set direction without imposing an obligation. Each country page on this tracker records the exact wording of its source, including whether the document says must, should, or is to.
- Which country has the earliest PQC migration deadline?
- Of the jurisdictions tracked here, Israel carries the earliest published target, at 2026, per Bank of Israel, Banking Supervision Department. Read that country's page for what the date actually covers before treating it as a general deadline.