My Updated Global PQC Migration Timeline Tracks 162 Milestones as More Regulators Set Earlier Deadlines

On 12 October 2026, Germany’s Federal Ministry of the Interior (BMI), its Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and its Federal Office for Information Security (BSI) published a national PQC guideline. The guideline is addressed to federal, state and municipal administrations, to companies and, in particular, to operators of critical infrastructure. It calls its dates urgent recommendations. The first is 31 December 2026, by which all of them should have finished a preparation phase, with responsibilities assigned, binding implementation plans of their own in place and a first cryptographic inventory done. That gives them 80 days from publication.

Eighty days is the shortest time that any instrument on my Global PQC Migration Timeline, which I rebuilt in October, gives companies to produce a first deliverable. The US government has given its own agencies even less: Executive Order 14412 of 22 June gave each of them 30 days to name a PQC migration lead. Three other instruments published since June set first deadlines within about four months: the Dutch national quantum strategy, the US Office of Management and Budget’s memorandum M-26-15, and a circular from Saudi Arabia’s central bank. The rebuild left me with one clear conclusion. Governments and regulators have published more PQC instruments in 2026 than in any earlier year on my timeline, and they leave less and less time before the first deadline.

The timeline now has 162 entries from 24 jurisdictions, the G7 and NATO, along with international bodies such as the Bank for International Settlements, standards bodies such as the IETF, and the targets that Google, Cloudflare and Microsoft have set for their own migrations. My first version, published in May, had 68 entries from 15 jurisdictions. Between October 2026 and the end of 2030, I count 56 dated PQC milestones from 22 jurisdictions and bodies, 27 of them from instruments published since that first version. Two-thirds of the PQC milestones due before 2031 come from instruments published this year.

What the Timeline Shows

The Dates Before 2031, Year by Year

The end of 2026 is about planning. M-26-15 set 22 October as the date for US federal agencies to send their migration plans to OMB and the Office of the National Cyber Director, and EO 14412 requires a proposed Federal Acquisition Regulation (FAR) rule for federal contractors by 19 December.

On 31 December, institutions licensed by the Saudi Central Bank (SAMA) need procedures to identify and classify all their cryptographic assets. The same day closes Germany’s preparation phase and the EU coordinated roadmap’s first phase, by which every Member State should have started its transition. Dutch central-government organizations are expected to have added quantum risk to their risk management and adopted a cryptography policy of their own by then, and Australia’s ASD expects a refined transition plan.

The year 2027 brings procurement and certification gates. From 1 January, new acquisitions for US national security systems must support CNSA 2.0 unless an exception applies, and France’s ANSSI aims to make PQC a condition for products entering qualification. By 31 March, SAMA expects enterprise quantum risk assessments with action plans. Singapore’s Cyber Security Agency (CSA) set the same deadline for migration plans from critical information infrastructure owners. Japan’s government is due to draft its own migration roadmap within the same fiscal year.

FINMA recommends that Swiss institutions draw up roadmaps by mid-2027, and the main obligations of the EU Cyber Resilience Act, which require secure design and security updates without naming PQC, apply from 11 December. Sixteen dated milestones fall in 2027, more than in any year except 2030.

In 2028 and 2029 the dates move from plans to procurement and first migrations. From 1 January 2028, Singapore expects newly procured critical information infrastructure systems to be quantum-safe or quantum-safe ready. Canada’s federal departments must begin transitioning their systems by April 2028 under the Treasury Board’s policy notice. In its timeline, the UK NCSC set 2028 as the date for discovery and a migration plan. Australia expects migration of critical systems to have started by the end of that year. India’s quantum-safe roadmap asks operators of critical information infrastructure to complete PQC adoption by the end of 2029.

The year 2030 is the convergence point, with 21 milestones. By 2 January, US federal agencies must support TLS 1.3, the protocol version that hybrid PQC key exchange requires, under EO 14144 as amended by EO 14306. CNSA 2.0 requires exclusive use of its algorithms for software and firmware signing and for traditional networking equipment from 2030. On 31 December, EO 14412 requires PQC key establishment for federal high-value assets and high-impact systems. The Department of War’s PQC strategy sets the same deadline for every DoW system to support PQC, and the FAR rule that EO 14412 calls for would require covered contractors to comply by then with NIST’s FIPS, including the PQC standards.

Europe’s date for high-risk use cases, Australia’s recommended end of traditional asymmetric cryptography and the Hong Kong Monetary Authority’s (HKMA) readiness target all fall in 2030. The Monetary Authority of Singapore (MAS) aims for quantum resilience before the end of the decade.

After 2030 the timeline thins out. EO 14412 and the DoW strategy require PQC signatures and PQC use by the end of 2031, and Singapore expects its critical information infrastructure to have completed migration by then. BSI’s TR-02102-1 no longer recommends classical key agreement on its own after 2031.

2035 remains the outer boundary. The UK, Canada, Japan, South Korea, the Netherlands, Sweden and Germany all point to it, the EU expects medium-risk use cases by then, and National Security Memorandum 10 named it as the US federal goal in 2022. NIST’s still-draft IR 8547 proposes to disallow the quantum-vulnerable public-key algorithms in NIST’s standards after 2035.

How the Regions Differ

The regions differ in who sets the dates and how much force the dates have. The United States accounts for 43 of the 162 entries and 11 of the 16 that the timeline marks as hard deadlines. Almost all of the US entries apply to federal systems, national security systems or the companies that sell to the federal government.

Europe works through a coordinated roadmap that each Member State implements on its own terms. Sweden’s NCSC published its recommendations in May, and the Dutch cabinet and the German government followed in October. In the Czech Republic, the national cybersecurity agency NÚKIB suggests the end of 2030 for completing post-quantum key establishment for information that needs critical confidentiality, and entities obliged under the Czech Cybersecurity Act must take its recommendations into account.

Some European regulators address a single sector. Belgium’s telecom regulator, BIPT, set minimum requirements for operators in a communication of 13 January 2026 that runs from a cryptographic inventory in 2027 to the migration of the most critical systems by 2030, with inspections of high-risk systems from 2031 to 2035.

In Asia-Pacific, financial supervisors and critical infrastructure agencies set most of the dates. These supervisors and agencies license or designate the organizations concerned. Their dates are specific, even though most are not legally binding. In the Middle East, SAMA’s circular gives Saudi banks, finance companies and payment firms just over four months to their first binding deadline, the shortest for private institutions anywhere on the timeline.

Most instruments on the timeline are guidance, recommendations or supervisory expectations. Procurement offices and supervisors turn them into obligations well before any legislature does, and I sort them by what happens if you miss them in Who Actually Enforces PQC Deadlines?

How to Use the Timeline

I set the timeline to open on the 60 key milestones, the dates I consider most useful for planning: binding requirements, the main national migration targets and the core standards. A switch at the top changes the view to all 162 entries, which add guidance documents, interim planning dates, corporate targets and the detail of each national roadmap. The switch shows how many entries each view contains for the filters you have set, and readers who scroll to the end of the key list find the same choice there.

Three filters narrow either view. Region covers the Five Eyes, Europe, Asia-Pacific, the Middle East and international bodies. Sector groups instruments by the kind of organization they address: Government, Defense, Financial, Critical Infrastructure or Industry. National rules that apply to everyone are filed under Government, not Financial, so a bank should check both for every jurisdiction where it operates.

The third filter and the colors of the markers distinguish ten milestone types:

• Standard and Guidance mark publications, such as FIPS 203, 204 and 205 in August 2024.
• Planning marks a deliverable such as an inventory, a migration plan or a risk assessment.
• Migration marks a target for part of an estate.
• Full Migration marks a target for the whole estate.
• Deprecation and Disallowance mark the dates after which an algorithm is no longer recommended or may not be used.
• Prefer and Exclusive Use are CNSA 2.0’s own categories.
• Hard Deadline marks a requirement with a direct consequence, such as a procurement gate, a supervisory circular or a law.

Hovering over an entry, or tapping it on a phone, shows what is due, the date, the legal status and the scope. Clicking a marker opens my analysis of the instrument, or the primary source where I have not covered it yet. A red line marks today’s date wherever you read from. Above the filters, three counters show the entries in view, the hard deadlines among them and the next deadline after today.

Finding Your First Deadline

I use the timeline most often to find the date a program has to meet first. My rule is the earliest applicable date in any jurisdiction where the organization operates, sells or holds a license.

For a financial institution, set the Sector filter to Financial and switch to all entries. The first markers after the red line are SAMA’s two deadlines, on 31 December 2026 and 31 March 2027. FINMA’s roadmaps follow in mid-2027, and the foundation phase in Taiwan’s guidelines for financial institutions ends with 2027. The HKMA’s readiness target comes in 2030, MAS aims for resilience before the end of the decade, and the G7 Cyber Expert Group’s roadmap gives 2030 to 2032 as an illustrative horizon for critical financial systems.

Those are only the supervisors’ dates. A bank with operations in Germany also has the national guideline’s 31 December date, filed under Government, and a bank that runs systems for a US federal agency may find itself under the FAR rule once it is final. The timeline cannot tell you which instruments apply to you. It can show you every dated instrument in the places where you operate, so that you can decide.

Regulators Are Setting More PQC Deadlines, Earlier

In May, when I published the first version of the timeline, I also wrote that PQC deadlines were likely about to compress. Five months of new entries show it happening in three ways: more regulators, earlier dates and less time before the first deadline.

More Regulators, and More of Them Sector Supervisors

The timeline has 35 publications dated 2026 so far, against 19 for the whole of 2025. Many of the new ones come from supervisors of a single sector. Between June and August 2026, financial supervisors in five jurisdictions published or announced PQC expectations with dates attached:

• 18 June, Taiwan. The Financial Supervisory Commission announced migration reference guidelines for the financial industry: a foundation phase to the end of 2027, pilots to 2029, and migration of high-risk and critical systems first through 2035, by when the FSC hopes to see the whole migration complete.
• 9 July, Switzerland. FINMA’s Guidance 05/2026 recommends a PQC roadmap by mid-2027 at the latest, based on a strategy adopted by the board.
• 27 July, Hong Kong. The HKMA’s first Quantum Preparedness Index scores put the banking sector at 2.3 out of 10, against a target of 10 by 2030.
• 28 July, Singapore. MAS said it would issue supervisory expectations later in 2026, with the aim of quantum resilience in the financial sector before the end of the decade.
• 27 August, Saudi Arabia. SAMA’s circular set its deadlines of 31 December 2026 and 31 March 2027.

On 7 July, the European Central Bank told about 110 significant banks that a separate letter on quantum risk would follow.

Regulators for telecom, critical infrastructure and defense have moved in the same direction. Belgium’s BIPT published its telecom requirements in February. Singapore’s CSA used its Quantum-Safe Migration Handbook of 16 July to set three milestones for critical information infrastructure: migration plans by 31 March 2027, quantum-safe or quantum-safe-ready procurement from 1 January 2028, and completed migration by the end of 2031. India’s final roadmap of 15 May set the end of 2029 for full adoption in critical information infrastructure. In defense, the Department of War’s strategy of 23 June covers every DoW system, and NATO published its first Quantum Technology Roadmap on 29 September.

I think sector supervisors will matter more to most organizations than national cybersecurity agencies. A national agency usually publishes guidance for everyone. A supervisor licenses and examines the institutions it addresses, and when it names a deliverable and a date, those institutions treat the date as a requirement, whatever the document calls itself. I expect auditors and boards to follow the supervisor’s calendar long before they read a national roadmap.

Earlier Dates for the Most Important Systems

In 2022, NSM-10 set 2035 as the US federal goal for mitigating quantum risk. In June 2026, EO 14412 required PQC key establishment for high-value assets and high-impact systems by the end of 2030 and PQC signatures by the end of 2031, five and four years earlier. The Department of War’s strategy requires every DoW system to support PQC by the end of 2030 and to use it by the end of 2031, unless otherwise noted.

Outside the United States, most of the newer instruments set 2030 for the systems where a compromise would do the most damage:

• EU, Germany and the Netherlands: the EU coordinated roadmap and both national plans expect high-risk use cases to be migrated by the end of 2030.
• Czech Republic: NÚKIB suggests the same date for information that needs critical confidentiality.
• Sweden: the NCSC recommends the end of 2030 for high-risk use cases, such as information that stays sensitive for more than ten years, as I described in my coverage of Sweden’s quantum strategy.
• Australia: ASD recommends ceasing traditional asymmetric cryptography by the end of 2030.
• Hong Kong: the HKMA aims for full readiness in the banking sector by 2030.
• India: a year earlier, with full PQC adoption in critical information infrastructure by the end of 2029.

The largest technology providers have gone further. In March 2026, Google set 2029 as the year to complete its own migration, Cloudflare did the same in April, and in June Microsoft moved its target from 2033 to 2029. Corporate targets are not regulation, and I keep them out of the count of 56. Their effect on most organizations may still be larger than any regulator’s, because these three companies decide when the operating systems, browsers, cloud services and network edges that most organizations depend on will use PQC.

Less Time Before the First Deadline

The time between an instrument’s publication and its first deadline has also shortened, and that is the change I would plan around.

Short first deadlines inside government are not new. OMB’s M-23-02 gave US agencies less than six months for their first inventories in 2022, and Canada’s Treasury Board gave departments less than six months in 2025. In 2026, short first deadlines reached the private sector. SAMA gave licensed institutions just over four months, and the German guideline gives companies and critical infrastructure operators 80 days, although only as a recommendation.

The first deliverables differ in weight. In its strategy, the Dutch cabinet asks central-government organizations to add quantum risk to their risk management and to adopt a cryptography policy in line with the government-wide framework. Both can be written before an organization knows where its cryptography is. The German guideline expects a first cryptographic inventory, which is where most programs stall first.

The US Government Accountability Office’s audit of the federal inventory mandate, completed in September 2025 and made public on 6 October, found that one of 24 agencies had a complete inventory of its priority systems, almost three years after OMB first asked them for one. An organization that starts from nothing when a supervisor’s letter arrives will not have a comprehensive inventory in 80 days. It can have the Minimum Viable CBOM I proposed in my PQC Migration Framework, a bounded first record that starts with the systems and data flows that matter most.

Why the Dates Are Moving

The EU roadmap set the end of 2026 as the date by which every Member State should start its transition, with a national strategy and first steps such as inventories. Member States are issuing national plans this year to meet that date: Sweden’s NCSC published its recommendations in May, the Dutch cabinet sent its strategy to parliament on 5 October, and the German guideline followed a week later. I expect more Member States to publish before the end of the year. The European Commission’s proposal to amend NIS2 would make policies for the PQC transition a required part of every national cybersecurity strategy, although it was still at first reading in the European Parliament in October.

In June, the US government brought the date for its most important civilian systems into line with Europe and Australia. The joint statement of 18 EU Member States in November 2024 and the EU roadmap of June 2025 had already set the end of 2030 for the highest-risk use cases, and Australia’s ASD had recommended ceasing traditional asymmetric cryptography by then. The goal for US federal systems was still NSM-10’s 2035. Once EO 14412 required PQC key establishment for high-value assets and high-impact systems by the end of 2030, I think 2035 became much harder to defend as the planning date for critical systems anywhere.

Financial supervisors now have a shared template to work from. The G7 Cyber Expert Group gave them a common reference with its roadmap in January 2026. In September, the G7 Cybersecurity Working Group warned in its call to action that organizations that delay may be excluded from contracting, including public procurement.

SAMA asks for an inventory, a risk assessment with action plans and reporting to the board. MAS has said its expectations will cover an inventory, a prioritized migration and governance, and FINMA recommends a roadmap based on a board-approved strategy. Once one supervisor has set a date for that sequence, the next one has a precedent to point to.

The threat estimates behind the dates have moved closer as well. Citing BSI’s study on the state of quantum computer development, last updated in 2025, the German guideline says a cryptographically relevant quantum computer is likely to be feasible within 15 years at most, by 2040 or earlier. For its high-security systems, the German federal government already works on the assumption that such machines will be available at the start of the 2030s.

Regulators do not need to agree on Q-Day to set deadlines. They need to believe that the migration will take longer than the time they have left, and the instruments published this year suggest that many of them now do.

What This Means for a PQC Program

For most organizations, 2035 is no longer the planning date. It remains the outer boundary in most jurisdictions, and I still expect large organizations to need most of the time until then to finish. As I have argued before, boards approve PQC budgets to meet dates like these and will never do so for a prediction about quantum computers.

• Plan against the earliest applicable date. A PQC migration program has to meet deadlines much earlier than 2035. A Saudi bank’s first deadline is 31 December 2026. A vendor selling into US national security systems meets the CNSA 2.0 acquisition gate on 1 January 2027. A German company that follows the national guideline has 80 days to name owners, set a binding plan of its own and finish a first inventory.
• Have the first deliverable ready before anyone asks for it. The instruments on the timeline that set near dates ask for some combination of an owner, an inventory and a plan. An organization with a working cryptographic inventory method, a named executive and a draft plan scoped to its priority systems can answer a supervisor within weeks. One that starts when the letter arrives will spend most of the deadline agreeing on scope.
• Check for new instruments every month. An annual review cannot keep up with instruments that give 80 days, and a quarterly one can miss most of such a window. I recommend checking sector supervisors and national cybersecurity agencies at least monthly, and reviewing the program against the dates every quarter. The legal status of each instrument is the first thing to check before planning against its date, and every entry on the timeline states it.

If you want the dates applied to your own organization, the PQC Migration Advisor takes your sector, deployment environment and jurisdictions and lists the deadlines that may apply.

Keeping the Timeline Current

I add instruments to the timeline as governments and regulators publish them. The four articles of the Global PQC Migration Timelines Deep Dive work from the same data:

• The Global PQC Migration Clock compares the jurisdictions.
• The 2026–2030 Squeeze walks through all 56 milestones before 2031.
• Who Actually Enforces PQC Deadlines? sorts the deadlines by consequence.
• The Hybrid Question covers the conflicting positions on hybrid cryptography.

I expect several new entries in the coming weeks. MAS’s supervisory expectations are due later this year, and the ECB has promised its letter on quantum risk. More EU Member States have national strategies to publish before the end of 2026. If you know of an instrument I have missed, contact me.

From the author