The 2026–2030 Squeeze: 54 PQC Milestones in 51 Months

The enterprise PQC migration study, Robert Campbell’s December 2025 paper in Computers, estimates that a full PQC migration takes 5 to 7 years for a small organization, 8 to 12 years for a medium one and 12 to 15+ years for a large one. Those numbers cover cryptographic inventory, vendor assessment, procurement cycles, testing, deployment, validation and the organizational friction that slows any infrastructure-wide change. Discovery alone takes one to three years.

Hold that estimate in one hand. In the other, hold this: between October 2026 and December 2030, governments, regulators, supervisors and one military alliance have set 54 dated PQC milestones across 22 jurisdictions and bodies. In May I counted 14 for the whole 2026–2030 window. The US federal package of June 2026 added eight on its own, and 20 of the 54 fall in calendar year 2030.

For a large organization that starts its cryptographic inventory today, every one of those 54 dates arrives before its migration can finish.

I count a milestone when a published instrument from a government body, regulator, supervisor or alliance attaches a date to a PQC obligation or target, binding or not. Each instrument gets one row per due date. A phase counts at its end date. A year given without a month counts from the start of that year, and an open-ended date such as “after 2030” falls outside the window. Two rows are adjacent to PQC rather than about it: the federal TLS 1.3 requirement and the Cyber Resilience Act. I include them because federal hybrid key exchange requires TLS 1.3 and because the CRA’s update obligations apply to any algorithm change a manufacturer ships. Publications without a dated requirement are not counted, and neither are corporate targets such as Google’s and Microsoft’s 2029; I list those separately below. Most of the instruments are guidance, so the table gives the status of each. Who Actually Enforces PQC Deadlines? sorts them by what happens if you miss them. The Global PQC Migration Timeline maps every one of them, together with the instruments that set them.

All 54 Milestones at a Glance

Deadlines That Already Passed in 2026

Three of the deadlines in my original list are behind us. Each one taught something about what the later ones will look like.

Bank of Israel Directive 202501 (January 2026)

Who it affects: Every banking corporation and licensed payment service provider in Israel.

What it required: A quantum preparedness plan submitted to the Banking Supervision Department’s Head of Technology, Innovation, and Cyber Division within a year of the 7 January 2025 letter. The plan had to map computing and communications infrastructure, identify systems vulnerable to quantum cryptanalysis, assess damage and set out a response. The board of directors and management had to discuss the plan before submission.

Enforcement: A supervisory directive under Proper Conduct of Banking Business Directive 364. A bank that did not submit has a gap in its supervisory record.

What happened: The Bank of Israel has not published what the banks submitted, and I have not been able to establish it.

Canada’s Treasury Board SPIN (April 1, 2026)

Who it affects: Departments and agencies covered by the Policy on Government Security, Shared Services Canada, and vendors signing new contracts with them that have a digital component. The SPIN covers systems up to and including Protected B; for classified and Protected C systems, departments must contact the Cyber Centre.

What it required: A high-level departmental PQC migration plan, the start of annual progress reporting, and PQC-aligned clauses in every new federal contract with a digital component. The Cyber Centre’s ITSM.40.001 roadmap is written as advice (“we recommend”). The Treasury Board’s Security Policy Implementation Notice, published and effective on 9 October 2025, is the instrument that makes it mandatory for those organizations. The ITSM.00.501 contract clauses supply the procurement language.

What happened: The procurement clauses took effect. Treasury Board has published nothing on how many departments filed plans, a gap I covered in Canada’s PQC Framework: Sound Design, Stalled Execution.

FIPS 140-2 Sunset (September 21, 2026)

Who it affects: Every vendor selling cryptographic modules into US federal procurement, and every regulated buyer that specifies FIPS validation.

What it required: On 21 September 2026 the remaining FIPS 140-2 certificates moved to Historical status. CMVP’s operative language is a recommendation: agencies “should not include” Historical modules in new acquisitions, and they can keep using them in existing systems subject to their own risk decisions. In my May version I described this as a hard procurement ban. It is softer than that, and contracting officers will decide how strictly to apply it.

Why it matters for PQC: FIPS 140-3 validation takes much longer than 140-2 did. SafeLogic’s analysis puts the CMVP portion of the queue alone at 542 days on average for FIPS 140-3, against 367 days for FIPS 140-2. Every PQC module that needs validation joins the same queue. EO 14412 orders NIST to revise CMVP processes to speed validation, with a 19 December 2026 due date.

The UAE’s National Encryption Policy, approved on 27 November 2025, also sat in my May list as “~2026”. It binds government entities to officially approved PQC transition plans, automated cryptographic inventory and crypto-agility by design, but no public deadline for the plans has been announced, so I no longer count it as a dated milestone.

The Rest of 2026

OMB M-26-15 Agency Migration Plans (October 22, 2026)

Who it affects: Every US federal civilian department and agency. National Security Systems are excluded.

What it requires: A PQC migration plan to OMB and the Office of the National Cyber Director no later than 120 days after the 24 June 2026 memo. M-26-15 then runs five phases: strategy, planning and discovery (2026–2027); pilots and early migration (2027–2028); prioritized migration of key establishment for high-value assets, high-impact systems and systems with highly sensitive data, with every system made cryptographically agile (2028–2030); signature migration (2031); and full migration of remaining systems (2035).

Enforcement: Binding OMB direction, tracked through federal accountability channels. M-26-15 functionally supersedes M-23-02 without formally rescinding it.

Context: M-23-02 asked agencies for prioritized cryptographic inventories by May 2023. GAO’s October 2026 public report, based on an audit completed in September 2025, found that one of the 24 agencies it audited had a complete inventory, 22 had partial ones and one had none.

EO 14412 Rulemaking and CMVP Revision (December 19, 2026)

Who it affects: Federal contractors, NIST and the NSA.

What it requires: EO 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” signed on 22 June 2026 and published at 91 FR 38483, sets several 180-day clocks that expire on 19 December 2026. The FAR Council must publish a proposed rule requiring covered contractors to comply with NIST FIPS, including the PQC standards, by 31 December 2030. NIST must revise CMVP processes to speed module validation and start a PQC migration pilot on a subset of its own systems. The NSA must send its first report to the President through the Committee on National Security Systems.

Enforcement: These are deadlines for the government itself. The contractor obligation exists only once the FAR rule is final, and the order does not define “covered contractor.” A proposed rule is the first point at which a contractor can read what will be required of it.

SAMA’s Cryptographic Asset Procedures (December 31, 2026)

Who it affects: Banks, finance and payment services companies, credit information companies and financing support entities licensed by the Saudi Central Bank.

What it requires: SAMA Circular 482021280, dated 14/03/1448 AH (27 August 2026), requires each institution to have accurate and comprehensive procedures for identifying and classifying all of its cryptographic assets by the end of the fourth quarter of 2026. At a minimum, institutions must identify the data, systems and services associated with those assets and classify them by sensitivity and by priority for migration. A second deadline follows on 31 March 2027.

Enforcement: A supervisory circular. It sets no separate deadline for submitting anything to SAMA. Quantum risk becomes a standing item for each institution’s Information Security Supervisory Committee and, where one exists, the board’s Risk Committee, and challenges and recommendations go to the board. Supervisors can examine the results. The circular names no algorithm. Algorithm rules sit with the National Cybersecurity Authority, whose draft NCS-2:2025 standard went to consultation in December 2025.

Why it matters beyond Saudi Arabia: SAMA gave institutions four months to put inventory procedures in place, and the procedures have to be accurate and comprehensive. The circular does not prescribe a discovery method. I expect procedures built on interviews and spreadsheets to be hard to defend as comprehensive. A multinational with a Saudi licence inherits the 31 December date.

EU Member States Start Transitioning (End of 2026)

Who it affects: EU Member States and, through national strategies, operators of essential services and critical infrastructure.

What it requires: The NIS Cooperation Group’s coordinated implementation roadmap of June 2025 expects every Member State to start transitioning by the end of 2026: a national PQC strategy and first steps such as risk assessments, awareness work and cryptographic inventories.

Enforcement: Coordinated policy milestones, not statutory deadlines. The Commission’s January 2026 proposal to amend NIS2, COM(2026) 13, would require national cybersecurity strategies to include policies for the PQC transition. It was still at first reading in the European Parliament in October 2026.

Australia’s Refined Transition Plan (End of 2026)

Who it affects: Australian government agencies, critical infrastructure operators and, as ASD frames it, organizations generally.

What it requires: ASD’s guidance expects a refined PQC transition plan by the end of 2026. It is the first of three ASD milestones and the last one that involves only planning.

Enforcement: Guidance. In June 2026 APRA told regulated financial entities that boards should show progress toward ASD’s timeline and that it will step up supervisory engagement over the coming year.

The Netherlands and India (End of 2026)

The Dutch national quantum strategy, sent to parliament on 5 October 2026, asks every central-government organization to include quantum risk in its risk-management process by the end of 2026. India’s final quantum-safe roadmap targets operational Tier-1 and Tier-2 PQC testing and certification labs by December 2026. The roadmap itself notes that no such labs exist yet, and it is non-binding.

The First Hard Gates in 2027

CNSA 2.0 Acquisition Gate (January 1, 2027)

Who it affects: Vendors supplying products and services to new NSS acquisitions, and the technology companies in their supply chains. The gate does not apply to defense contracts that involve no NSS.

What it requires: Under CNSSP 15, all new NSS acquisitions must support CNSA 2.0 algorithms unless an exception is explicitly noted: ML-KEM-1024 for key establishment, ML-DSA-87 for general-purpose signatures, LMS or XMSS for software and firmware signing, AES-256 for encryption and SHA-384 or SHA-512 for hashing. Operating systems reach their CNSA 2.0 “support and prefer” date in the same year.

Enforcement: A procurement gate. Products that do not support CNSA 2.0 cannot be bought for NSS unless an exception applies. NSPM-12, signed on 12 June 2026, re-established the Committee on National Security Systems with binding directive authority over all NSS and named the NSA Director as National Manager, so the governance behind the gate is firmer than it was in May.

Why this is the anchor: A vendor that misses it loses the sale unless it gets an exception, while a missed planning date leads at most to a supervisory finding. How the government handles exceptions in the first half of 2027 will show whether PQC deadlines in the West are enforced or negotiated.

ANSSI’s PQC Requirement for Qualification (2027)

Who it affects: Vendors seeking ANSSI qualification for their security products, and the public bodies and regulated operators that buy qualified products.

What it requires: At France Quantum on 16 June 2026, ANSSI announced a 2027 PQC requirement that press reports described as a certification cutoff. ANSSI’s own post-quantum page is narrower: the agency aims to introduce PQC obligations for entering qualification from 2027. The same page says it will not be reasonable to buy products without PQC after 2030, a date I place just outside this window.

Enforcement: A product without PQC would not enter qualification from 2027, but it could still be sold in France. I have not seen an implementing text, so the start date, the schemes covered and the product scope are still open.

Belgium’s Telecom Inventory (2027)

Belgium’s telecom regulator BIPT issued a communication on 13 January 2026 setting minimum PQC requirements and a roadmap for Belgian telecom operators: cryptographic inventory and quantum-risk analysis in 2027, validated migration plans in 2028, migration of the most critical systems completed by 2030, and the European quantum-resilience objectives met by 2035. BIPT will inspect high-risk systems from 2031 to 2035, after the 2030 date for the most critical systems has passed. The text uses mandatory language and describes itself as the baseline for future audits under telecom law, NIS2 and the CER Directive, though it specifies no sanctions. I have not covered it in a separate article yet.

EO 14412 CBOM Minimum Elements (March 19, 2027)

Within 270 days of EO 14412, DHS through CISA, working with NIST, must publish guidance on the minimum elements of a cryptographic bill of materials. The FAR Council’s second proposed rule, on vulnerability disclosure for covered contractors, has the same due date. The CBOM guidance will decide what a federal cryptographic inventory has to contain, and vendors will meet it in questionnaires long before any rule cites it. I covered the security of the CBOM itself in Guarding the CBOM.

SAMA Risk Assessments, Singapore CII Plans and Japan’s Roadmap (March 31, 2027)

Three deadlines share the last day of March 2027.

SAMA: Each licensed institution must complete an enterprise-level quantum risk assessment, aligned with its enterprise risk management, together with action plans.

Singapore: Owners of Critical Information Infrastructure must submit a quantum-safe migration plan to CSA. The date comes from the Quantum-Safe Migration Handbook v1.0 that CSA published with GovTech and IMDA on 16 July 2026. CSA calls its three CII dates requirements; the handbook itself says it is not mandatory and uses “should.” I have found no published legal instrument that carries the dates.

Japan: The National Cyber Command Office’s interim report says the government will draft a migration roadmap within fiscal year 2026, which ends on 31 March 2027.

Canada’s Phase 2 Plans (April 1, 2027)

Under the SPIN, departments, agencies and Shared Services Canada must update their high-level plans to guide Phase 2 by 1 April 2027.

FINMA Roadmaps (Mid-2027)

FINMA Guidance 05/2026, published on 9 July 2026, reported that 72% of the 60 Swiss institutions surveyed had no quantum-safe measure in place and 8% had a roadmap. FINMA expects institutions to draw up a PQC migration roadmap by mid-2027 at the latest, based on a quantum strategy approved by the board. The guidance is formally non-binding, but it comes from the supervisor that examines the institutions.

NATO’s Quantum Action Plan Update (Q3 2027)

NATO’s first Quantum Technology Roadmap schedules an update of the Action Plan for NATO’s Response to the Quantum Threat to Cryptography in the third quarter of 2027. NATO has published no date for its own PQC migration.

EU Cyber Resilience Act Main Obligations (December 11, 2027)

Who it affects: Manufacturers of products with digital elements that fall within the CRA’s scope and are sold on the EU market.

What it requires: The CRA entered into force on 10 December 2024. Reporting obligations have applied since 11 September 2026, and the main obligations apply from 11 December 2027. Products placed on the market before that date come under the main obligations only if they are substantially modified afterwards, although the reporting obligations cover them too. The regulation does not mention post-quantum cryptography and sets no PQC migration deadline. It requires in-scope products to be secure by design and to receive security updates across their support period. In my analysis, a product with hardcoded RSA and no way to change its algorithms will struggle to meet the update obligation once quantum-vulnerable algorithms are treated as a known vulnerability; I set out the argument in the CRA and crypto-agility.

Enforcement: EU product law. An in-scope product that does not conform cannot carry the CE marking it needs for the EU market.

NIST, the Netherlands, India and Taiwan (End of 2027)

EO 14412 requires NIST to finish its PQC migration pilot by 31 December 2027. Dutch central-government organizations must have a PQC migration plan, at least in draft, with practical trials for high- and medium-risk use cases prepared or under way. India’s roadmap expects CII operators in defense, power, telecom, transport and banking to finish their foundations: governance, inventory, PQC and hybrid pilots, vendor CBOMs and PQC requirements in procurement. The roadmap makes vendor CBOM submissions mandatory from fiscal year 2027–28, although the roadmap itself has no legal force. Taiwan’s Financial Supervisory Commission published reference guidelines for financial institutions in June 2026; their foundation phase, covering governance and the identification of high-risk cryptography, ends with 2027.

Procurement Rules and First Migrations in 2028

Singapore’s CII Procurement Rule (January 1, 2028)

From 1 January 2028, newly procured and implemented CII computers and computer systems with a digital component should either support quantum-safe algorithms or be quantum-safe ready. Procurement rules like this one reach vendors faster than migration deadlines do.

M-26-15 Phase 3 Begins (2028)

The US civilian migration moves from pilots to prioritized migration in 2028. By the end of 2030, agencies must have moved key establishment to PQC for high-value assets, high-impact systems and systems with highly sensitive data, and every system must be cryptographically agile.

Belgium’s Validated Telecom Plans (2028)

BIPT expects telecom operators to have developed and validated their PQC migration plans in 2028, a year after their inventories and two years before their most critical systems must be migrated.

Canada’s Phase 3 (April 1, 2028)

By 1 April 2028, departments must have their systems recorded in the Application Portfolio Management tool, update their plans for Phase 3 and begin transitioning systems.

UK NCSC Discovery and Assessment (By 2028)

The NCSC’s timeline expects organizations to complete discovery and assessment and to have an initial migration plan by 2028. It is guidance, not statute, but UK sector regulators treat NCSC guidance as the benchmark for reasonable practice.

Australia Begins Migrating Critical Systems (End of 2028)

ASD expects organizations to have commenced their transition by the end of 2028, starting with critical systems and data. That leaves two years before ASD’s 2030 completion date.

Dutch Procurement, India’s Migration Phases and Korea’s Pilots (End of 2028)

Dutch central-government organizations must be able to set quantum-safe requirements in procurement and tenders. India’s CII operators reach the high-priority migration phase: no new classical-only systems, PKI, HSM and key-management upgrades, and PQC signatures mandated. India’s regular enterprises are expected to finish the foundations work that CII completes a year earlier. Under South Korea’s PQC master plan, pilot migrations in finance and telecommunications run from 2025 to the end of 2028.

India’s CII Deadline in 2029

India’s roadmap expects full PQC adoption across CII by December 2029, with PQC-only trust chains and quantum-safe signatures throughout. It is the earliest national completion date for critical infrastructure in my dataset, and it comes from a roadmap with no legal force; enforcement depends on India’s sectoral regulators. The Reserve Bank of India set up a Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) committee on 25 May 2026 to recommend a quantum-secure roadmap for the financial sector, so banks may get their own dates.

Taiwan’s financial institutions reach the end of the FSC guidelines’ 2027–2029 pilot migration phase.

2029 is also the year the large technology providers picked. These are corporate targets, so they are not in my count, but they shape what every customer can buy:

• Google set 2029 for completing its PQC migration, with authentication prioritized (March 2026).
• Cloudflare set 2029 for full post-quantum security, including authentication (April 2026).
• Microsoft moved its date for critical products and services from 2033 to 2029 on 30 June 2026 (analysis).
• Google Cloud published a dated roadmap in August 2026: confidentiality protections by the end of 2027, signatures and key-management foundations by the end of 2028 (analysis).

For most organizations, these dates set the pace of the products they depend on more than any regulator does.

The 2030 Convergence Point

Twenty of the 54 milestones fall in 2030, more than in any other year.

TLS 1.3 Across Federal Systems (January 2, 2030)

US agencies must support TLS 1.3 or a successor by 2 January 2030. The requirement comes from EO 14144; EO 14306 amended EO 14144 in June 2025 and kept it, and M-26-15 restates it. TLS 1.3 is the protocol through which hybrid and pure ML-KEM key exchange enter the federal network stack.

CNSA 2.0 Exclusive Use for Signing and Networking (2030)

Software and firmware signing and traditional networking equipment must use CNSA 2.0 algorithms exclusively from 2030. Niche equipment, such as constrained devices and large PKI systems, reaches its “support and prefer” date in the same year.

EO 14412, DoW and CNSSP 15 (December 31, 2030)

Four US deadlines share the last day of 2030:

• EO 14412: every federal high-value asset and high-impact system outside NSS must use PQC for key establishment.
• Federal contractors: covered contractors must comply with NIST FIPS, including the PQC standards, once the FAR rule is final.
• Department of War: all DoW systems must support PQC or be phased out.
• CNSSP 15: NSS equipment and services that cannot support CNSA 2.0 must be phased out.

A year later, on 31 December 2031, EO 14412 requires PQC signatures for the same high-value and high-impact systems, the DoW strategy requires all DoW systems to use PQC “unless otherwise noted,” and CNSA 2.0 algorithms become mandatory across NSS. The DoW’s “unless otherwise noted” points back to CNSA 2.0’s product-specific schedule, which runs to 2033.

High-Risk Use Cases in Europe (End of 2030)

Five European dates converge on the end of 2030:

• EU: the coordinated roadmap expects high-risk use cases to be migrated “as soon as possible, no later than” the end of 2030. The 18-state joint statement of November 2024 set the same year for the most sensitive use cases.
• Netherlands: central government aims to complete migration of high-risk use cases.
• Sweden: the Swedish NCSC’s recommendations of May 2026, summarized in my coverage of Sweden’s quantum strategy, set the end of 2030 for high-risk systems.
• Czech Republic: NÚKIB’s annex on quantum-resistant cryptography suggests the end of 2030 for completing post-quantum key establishment for information that needs critical confidentiality. Obliged entities under the Czech Cybersecurity Act must take its recommendations into account.
• Germany: BSI’s TR-02102-1 version 2026-01 stops recommending classical key agreement used on its own for the most sensitive applications at the end of 2030. For everyone else the date is the end of 2031, and classical signatures used on their own are planned to end by 2035. These replace the “2030 for KRITIS, 2032 for everyone else” dates in my May version, which I can no longer trace to BSI’s text; BSI describes the 2026-01 dates as the first fixed end dates for classical public-key cryptography used on its own.

Australia Ends Traditional Asymmetric Cryptography (End of 2030)

ASD expects organizations to have completed their PQC transition by the end of 2030 and recommends ceasing the use of traditional asymmetric cryptography by then. It is still the earliest date among Five Eyes governments for ending traditional asymmetric cryptography across all systems, five years ahead of the 2035 outer boundary. ASD does not recommend hybrid schemes but does not prohibit them, and it expects organizations to move to purely post-quantum algorithms.

Financial Supervisors Aim at 2030

Two financial supervisors have picked 2030 without publishing a binding instrument:

• Hong Kong: the HKMA’s first Quantum Preparedness Index scored the banking sector at 2.3 out of 10 in July 2026. The HKMA aims for full sectoral readiness, a score of 10, by 2030. The index measures preparedness, so a score of 10 does not by itself mean every bank has replaced its cryptography.
• Singapore: MAS announced in July 2026 that its supervisory expectations, due later in 2026, aim at quantum resilience before the end of the decade.

The G7 Cyber Expert Group’s financial-sector roadmap gives 2030–32 as an illustrative horizon for the most critical systems and notes that existing guidance often points to 2035 as the overall target. That horizon ends in 2032, so I do not count it inside the window.

Other 2030 Dates

• Brunei: Cyber Security Brunei’s PQC Migration Framework, published on 1 July 2026, applies as a requirement to government ministries, statutory bodies and designated CII owners; other organizations get it as best-practice guidance. It describes its phasing as indicative: PQC deployed and RSA and ECC deprecated by 2030, classical algorithms disallowed in 2035.
• Belgium: BIPT expects telecom operators to have completed migration of their most critical systems.
• India: regular enterprises reach the high-priority migration phase in December 2030, two years after CII.
• Malaysia: NACSA’s non-binding roadmap closes its 2025–2030 migration window.

NIST IR 8547 Proposed Deprecation (After 2030)

NIST IR 8547 proposes deprecating quantum-vulnerable algorithms at the 112-bit security level, such as RSA-2048 and P-224, after 2030, and disallowing all quantum-vulnerable public-key algorithms after 2035. P-256 and RSA-3072, at 128 bits, would go straight to disallowed after 2035. The document is still the initial public draft of November 2024, so both dates remain proposals, even though other frameworks, such as Brunei’s, already repeat them. “After 2030” is open-ended, so I do not count it among the 54.

The Arithmetic Problem

Fifty-four milestones in 51 months sounds manageable in the abstract. The problem is that most of them require work that should have started years ago.

The enterprise migration study’s 12 to 15+ years for a large organization covers end-to-end completion, and discovery alone takes one to three years. The US federal government shows what that means in practice: M-23-02 asked agencies for cryptographic inventories by May 2023, and when GAO finished its audit in September 2025, one of 24 agencies had a complete inventory. An organization that starts its inventory in late 2026 and waits for it to finish before planning will miss SAMA’s, Singapore’s and FINMA’s 2027 planning dates. The CNSA 2.0 gate takes effect while it is still taking inventory.

The organizations best placed for the 2030 cluster started their programs in 2024 or 2025. If you are reading this in late 2026 and have not started, two things follow. First, write the plan before the inventory is finished: scope it to priority systems, record what discovery has not reached yet and revise the plan as the inventory grows. Where a date is missed anyway, document why and show regulators measured progress against a catch-up plan. Second, you have to compress the timeline. Automate cryptographic discovery (CISA’s guidance on automated inventory is the reference), use the production PQC that already exists (OpenSSL 3.5 prefers hybrid key exchange by default, and RFC 10024 standardized it in August 2026), and build the crypto-agility program that the next algorithm change will need.

The PQC Migration Framework at pqcframework.org provides the structured methodology. No framework can give back the time that has already passed. Every quarter of delay now puts an organization behind several deadlines at once.

As I’ve argued before, the reason to act now is not a prediction about when a quantum computer will break RSA. Regulators, supervisors, procurement offices and the largest technology providers have already set the dates, and 54 of them arrive before 2031.

From the author