The Post-Quantum Standards Timeline: 2030, 2035 And What Is Still A Draft

Two years appear in almost every conversation about post-quantum migration: 2030 and 2035. Both trace back to US federal policy, mainly a NIST draft and the NSA’s plans for national security systems. Many other governments and regulators have since set their own dates, often aligned with these.

This article covers the standards side of the timeline: what NIST has published, what it proposes, and the dates the NSA has set. For sector rules and national deadlines, see Cryptography Compliance and the Regulatory Deadline Tracker.

What NIST Proposes For 2030 And 2035

NIST’s transition plan is set out in NIST IR 8547, “Transition to Post-Quantum Cryptography Standards”. It was released as an initial public draft on 12 November 2024, comments closed on 10 January 2025, and as of 7 October 2026 NIST has not published a final version.¹

In the draft, NIST proposes two steps for quantum-vulnerable public-key algorithms such as RSA, ECDSA, EdDSA and finite field and elliptic curve Diffie-Hellman.²

• Parameter sets offering 112 bits of security strength would be deprecated after 2030. Deprecated means they may still be used, but the data owner must weigh the added risk.
• All quantum-vulnerable parameter sets, including those at 128 bits of security strength and above, would be disallowed after 2035, meaning they would no longer be allowed for that purpose.

The draft notes that NIST’s earlier guidance had projected disallowing 112-bit public-key schemes from 1 January 2031, and that NIST instead intends to deprecate them so that organisations can keep using them while they migrate.² NIST’s project page summarises the goal as removing quantum-vulnerable algorithms from its standards by 2035, with high-risk systems moving much earlier.³

The same draft lists the replacements. For signatures it names ML-DSA, SLH-DSA and the stateful schemes LMS and XMSS, and for key establishment it names ML-KEM, which was then the only approved post-quantum scheme. It also points out that NIST’s few symmetric algorithms at the 112-bit level face their own cut-off and will be disallowed in 2030.²

What NIST Has Already Finalised

Three post-quantum standards have been final since 13 August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).⁴ SP 800-208, approving the stateful hash-based signatures LMS and XMSS, has been final since October 2020.⁵ SP 800-227, NIST’s recommendations for key encapsulation mechanisms, was finalised in September 2025.⁶

Two standards are pending. FIPS 206 (FN-DSA, from Falcon) was described by NIST in August 2025 as essentially complete and awaiting approval.⁷ In September 2026 NIST proposed reworking it to use fixed-point arithmetic, which means the draft is still to come.⁸ For FIPS 207 (HQC), NIST said in March 2025 that it planned a draft in about a year and a final standard in 2027,⁹ and in August 2026 it said the draft would be released soon.¹⁰ Neither draft appears on NIST’s FIPS list as of 7 October 2026.¹¹

The NSA Dates For National Security Systems

The NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) applies to US national security systems, not to the private sector in general. Its dates are firmer than NIST’s because they are tied to a national security policy, CNSSP 15, which was updated in 2024.¹²

According to the NSA’s CNSA 2.0 FAQ, version 2.1:¹²

• From 1 January 2027, new acquisitions for national security systems must be CNSA 2.0 compliant unless noted otherwise.
• By 31 December 2030, equipment and services that cannot support CNSA 2.0 must be phased out unless noted otherwise.
• By 31 December 2031, CNSA 2.0 algorithms are mandated for use unless noted otherwise.
• By 2035, all national security systems should be quantum-resistant, in line with National Security Memorandum 10.

The NSA also asks for software and firmware signing to move early, using LMS or XMSS, because firmware roots of trust are hard to change later.¹²

Reading The Dates Correctly

The status of each date matters when you plan or report against it. The table below summarises them.

A common mistake is to treat 2035 as the date to start. NIST’s own framing is that 2035 is the end point, and that high-risk systems should move much earlier.³ The NSA dates show what “earlier” looks like in practice: new purchases from 2027 and most equipment replaced by the end of 2030. Anything with a long service life, such as firmware, embedded devices or archives encrypted under keys agreed with RSA, needs a plan well before the final cut-off.

Even where these dates do not bind your organisation directly, they shape the market. Suppliers to US government customers will build to them, and many regulators have adopted similar horizons. The Regulatory Deadline Tracker lists binding and supervisory deadlines by region.