Name: Post-Quantum Migration Deadlines by Country
Creator: PostQuantumSecurity.org
Published: 2026-10-21
License: https://creativecommons.org/licenses/by/4.0/

Type: Live Tracker

Last updated: October 2026

2030 the year most high-risk systems should be quantum-safe

The EU, Germany, the Netherlands, Australia and US federal agencies all target 2030 for their most critical systems, and almost every jurisdiction targets 2035 for the rest.

Governments have started to put dates on the move to post-quantum cryptography. This tracker lists the official milestones, who issued them, whom they apply to and how binding they are, with a link to every source. It is updated when a government publishes or changes a timeline.

Timeline at a Glance

Milestones by jurisdiction, 2026–2035

Hover or tap a point for the milestone. Colour shows how binding the source is.

⚖️ Mandatory, Guidance, Draft or Announced?

Mandatory for scope means binding on the organisations it covers, for example US federal agencies or national security systems; it does not bind private companies outside that scope. Official guidance comes from a government body but is phrased as a recommendation, even when regulators may later rely on it. Draft documents may still change, and announced policies have been stated publicly but not yet published in full. Several sources disagree on how binding some dates are; we label each one by the wording of the source itself.

All Milestones by Date

Date	Jurisdiction	Milestone	Status	Source
April 2026Passed	Canada	Initial departmental migration plans due; annual progress reporting begins.	Official guidance	Canadian Centre for Cyber SecurityOfficial document
22 Oct 2026	United States (federal civilian)	Each agency submits a PQC Migration Plan to OMB and ONCD (120 days after the memo).	Mandatory for scope	White House and OMBOfficial document
End of 2026	European Union	First steps: national PQC roadmaps, cryptographic inventories, quantum risk analysis, pilots for high- and medium-risk use cases.	Official guidance	NIS Cooperation Group, with the European CommissionOfficial document
From 2027	France	ANSSI aims to require post-quantum cryptography for products entering qualification.	Announced	ANSSIOfficial document
2028	United Kingdom	Migration goals defined, full discovery of cryptography completed, initial plan drafted.	Official guidance	National Cyber Security Centre (NCSC)Official document
2 Jan 2030	United States (federal civilian)	TLS 1.3 or a successor supported.	Mandatory for scope	White House and OMBOfficial document
End of 2030	Australia	Stop using traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA).	Official guidance	Australian Signals Directorate (ASD)Official document
End of 2030	European Union	Migration of high-risk use cases completed; quantum-safe software and firmware upgrades enabled by default.	Official guidance	NIS Cooperation Group, with the European CommissionOfficial document
After 2030	France	Buying products without post-quantum cryptography will no longer be reasonable, according to ANSSI.	Announced	ANSSIOfficial document
End of 2030	Germany	High-risk use cases migrated “as early as possible, at the latest by the end of 2030”.	Official guidance	BMI, BMDS and BSIOfficial document
End of 2030	Netherlands	High-risk use cases migrated; software and firmware use quantum-safe cryptography by default.	Official guidance	Dutch cabinetOfficial document
End of 2030	United States (federal civilian)	PQC key establishment for high-value assets, high-impact systems and highly sensitive data.	Mandatory for scope	White House and OMBOfficial document
2030	United States (national security systems)	Exclusive use of CNSA 2.0 for software and firmware signing and for traditional networking equipment (VPNs, routers).	Mandatory for scope	NSAOfficial document
2030	United States (NIST standards)	RSA and elliptic-curve algorithms at 112-bit security (e.g. RSA-2048, P-224) deprecated.	Draft	NISTOfficial document
End of 2031	Canada	High-priority systems migrated.	Official guidance	Canadian Centre for Cyber SecurityOfficial document
2031	United Kingdom	Highest-priority migration activities completed.	Official guidance	National Cyber Security Centre (NCSC)Official document
2031	United States (federal civilian)	PQC digital signatures for the same priority systems.	Mandatory for scope	White House and OMBOfficial document
2033	United States (national security systems)	Exclusive use for web browsers and servers, cloud services, operating systems and niche equipment; custom applications and legacy equipment updated or replaced.	Mandatory for scope	NSAOfficial document
End of 2035	Canada	Remaining systems migrated.	Official guidance	Canadian Centre for Cyber SecurityOfficial document
End of 2035	European Union	Migration of medium-risk use cases completed; low-risk use cases migrated as far as feasible.	Official guidance	NIS Cooperation Group, with the European CommissionOfficial document
2035	Germany	Overall transition largely completed.	Official guidance	BMI, BMDS and BSIOfficial document
2035	Japan	In principle, government agencies complete the migration to PQC.	Official guidance	Inter-ministerial PQC liaison council, Cabinet SecretariatOfficial document
End of 2035	Netherlands	Medium-risk use cases migrated; low-risk use cases migrated as far as possible.	Official guidance	Dutch cabinetOfficial document
2035	United Kingdom	Migration of all systems, services and products completed.	Official guidance	National Cyber Security Centre (NCSC)Official document
2035	United States (federal civilian)	Remaining systems migrated, based on risk and availability of commercial products.	Mandatory for scope	White House and OMBOfficial document
2035	United States (national security systems)	All national security systems quantum-resistant (NSM-10 goal).	Mandatory for scope	NSAOfficial document
2035	United States (NIST standards)	All quantum-vulnerable public-key algorithms disallowed.	Draft	NISTOfficial document

By Jurisdiction

European Union Official guidance

NIS Cooperation Group, with the European Commission: Coordinated Implementation Roadmap for the Transition to PQC (23 June 2025).
Scope: All Member States; public administrations and critical sectors.
Source

End of 2026First steps: national PQC roadmaps, cryptographic inventories, quantum risk analysis, pilots for high- and medium-risk use cases.
End of 2030Migration of high-risk use cases completed; quantum-safe software and firmware upgrades enabled by default.
End of 2035Migration of medium-risk use cases completed; low-risk use cases migrated as far as feasible.

Germany Official guidance

BMI, BMDS and BSI: Guideline for the national implementation of the EU PQC roadmap (12 October 2026).
Scope: Federal, state and municipal administrations; companies, including critical-infrastructure operators.
Source

End of 2030High-risk use cases migrated “as early as possible, at the latest by the end of 2030”.
2035Overall transition largely completed.

United States (federal civilian) Mandatory for scope

White House and OMB: Executive Order “Securing the Nation Against Advanced Cryptographic Attacks” (22 June 2026) and OMB Memorandum M-26-15 (24 June 2026).
Scope: Federal civilian agencies; excludes national security systems.
Source

22 Oct 2026Each agency submits a PQC Migration Plan to OMB and ONCD (120 days after the memo).
2 Jan 2030TLS 1.3 or a successor supported.
End of 2030PQC key establishment for high-value assets, high-impact systems and highly sensitive data.
2031PQC digital signatures for the same priority systems.
2035Remaining systems migrated, based on risk and availability of commercial products.

United States (national security systems) Mandatory for scope

NSA: Commercial National Security Algorithm Suite 2.0 (CNSA 2.0).
Scope: National security systems and their vendors.
Source

2030Exclusive use of CNSA 2.0 for software and firmware signing and for traditional networking equipment (VPNs, routers).
2033Exclusive use for web browsers and servers, cloud services, operating systems and niche equipment; custom applications and legacy equipment updated or replaced.
2035All national security systems quantum-resistant (NSM-10 goal).

United States (NIST standards) Draft

NIST: NIST IR 8547, Transition to Post-Quantum Cryptography Standards (initial public draft, November 2024).
Scope: Algorithms approved for federal use; widely followed by industry.
Source

2030RSA and elliptic-curve algorithms at 112-bit security (e.g. RSA-2048, P-224) deprecated.
2035All quantum-vulnerable public-key algorithms disallowed.

United Kingdom Official guidance

National Cyber Security Centre (NCSC): Timelines for migration to post-quantum cryptography (March 2025).
Scope: Mainly large organisations, critical national infrastructure and bespoke IT.
Source

2028Migration goals defined, full discovery of cryptography completed, initial plan drafted.
2031Highest-priority migration activities completed.
2035Migration of all systems, services and products completed.

Canada Official guidance

Canadian Centre for Cyber Security: Roadmap for the migration to PQC for the Government of Canada, ITSM.40.001 (23 June 2025).
Scope: Federal departments; non-classified systems.
Source

April 2026Initial departmental migration plans due; annual progress reporting begins.
End of 2031High-priority systems migrated.
End of 2035Remaining systems migrated.

Australia Official guidance

Australian Signals Directorate (ASD): Information Security Manual and “Planning for post-quantum cryptography”.
Scope: Government and organisations following the ISM.
Source

End of 2030Stop using traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA).

Netherlands Official guidance

Dutch cabinet: Government-wide quantum strategy, Rijksbrede Quantumstrategie (October 2026).
Scope: Central-government organisations.
Source

End of 2030High-risk use cases migrated; software and firmware use quantum-safe cryptography by default.
End of 2035Medium-risk use cases migrated; low-risk use cases migrated as far as possible.

France Announced

ANSSI: Published position on post-quantum cryptography and product qualification.
Scope: Security products entering ANSSI qualification; purchasing advice for all organisations.
Source

From 2027ANSSI aims to require post-quantum cryptography for products entering qualification.
After 2030Buying products without post-quantum cryptography will no longer be reasonable, according to ANSSI.

Japan Official guidance

Inter-ministerial PQC liaison council, Cabinet Secretariat: Interim report on PQC migration for government agencies (November 2025).
Scope: Government agencies.
Source

2035In principle, government agencies complete the migration to PQC.

What's New

21 October 2026Tracker launched with 11 sources across the EU, Germany, the United States, the UK, Canada, Australia, the Netherlands, France and Japan, including Germany's 12 October 2026 guideline and the US OMB memorandum M-26-15.

Methodology

We list milestones from national governments, cybersecurity agencies and standards bodies that set a dated target for migrating to post-quantum cryptography. Each jurisdiction shows when we last checked it and whether that check was against the primary document or against reputable secondary reporting. This tracker summarises public documents; it is not legal advice. Corrections and additions are welcome via the contact form below.

Download the Data

📄 pqc-deadlines.csv: every milestone with status, scope and source (CC BY 4.0).

How to Cite This Tracker

APA: PostQuantumSecurity.org. (2026–). Post-quantum migration deadlines by country [Live tracker]. https://www.postquantumsecurity.org/trackers/pqc-deadlines.html

Please include the "Last updated" date shown at the top of the page.

Post-Quantum Migration Deadlines by Country