What Governments Have Told Organisations To Do, And By When

The earlier articles in this group explain why public-key cryptography needs replacing. Governments have turned that into dates. This article gives a short orientation to the milestones most organisations hear about first, and the status of each one, as of October 2026.

It is deliberately brief. For sector rules such as PCI DSS and DORA, and for jurisdictions beyond the US and UK, see Cryptography Compliance and the Regulatory Deadline Tracker, which is kept up to date with live countdowns.

The Common Shape Of Most Roadmaps

National roadmaps differ in detail but mostly follow the same sequence. The joint 2023 factsheet from CISA, the NSA and NIST set it out early: build a quantum readiness roadmap, create a cryptographic inventory, assess dependencies in your technology supply chain, and talk to vendors about their post-quantum plans.¹ Later national guidance attaches dates to those steps.

The milestones below come from documents with very different legal force, so read the status labels carefully.

United States

NIST published its first three post-quantum standards, FIPS 203, FIPS 204 and FIPS 205, in August 2024.² NIST IR 8547 is NIST’s plan for moving to them. It proposes deprecating RSA, elliptic curve and Diffie-Hellman algorithms at the 112-bit security level after 2030 and disallowing all quantum-vulnerable public-key algorithms after 2035.³ As of October 2026 it remains an initial public draft, so these dates are proposals; the comment period closed in January 2025.

National Security Memorandum 10, quoted in the NIST draft, sets 2035 as the primary target for mitigating as much quantum risk as is feasible.³

Executive Order 14412, signed on 22 June 2026, goes further for federal systems. It directs the Office of Management and Budget to issue guidance requiring agencies to move their high-value assets and high impact systems, other than national security systems, to post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. It also directs a proposed procurement rule requiring covered federal contractors to comply with NIST’s post-quantum FIPS by 31 December 2030.⁴ The order binds federal agencies; for contractors, the requirement depends on that rule being made.

CNSA 2.0 is the NSA’s algorithm suite setting future requirements for national security systems.⁵ It specifies ML-KEM-1024, ML-DSA-87, AES-256 and SHA-384 or SHA-512, plus the stateful hash-based signatures LMS and XMSS, according to a TLS profile by NSA authors that is still an Internet-Draft rather than an IETF standard.⁶ Suppliers to national security systems should read the NSA’s own CNSA 2.0 documents for the full transition schedule.

United Kingdom

The National Cyber Security Centre published its migration timelines on 20 March 2025. By 2028, organisations should define migration goals, carry out full discovery and build an initial plan. By 2031 they should complete their highest-priority migrations and refine the roadmap. By 2035 they should complete migration of all systems, services and products.⁷ This is guidance rather than law. The NCSC accepts that a small number of rarely used technologies may be harder to move by 2035, but it asks all organisations to work towards these dates.

Europe And Quantum Key Distribution

European agencies have also stated which technology to back. In January 2024 France’s ANSSI, Germany’s BSI, the Netherlands’ NLNCSA and Sweden’s National Communications Security Authority jointly concluded that post-quantum cryptography should take priority over quantum key distribution, which they judged suitable only for niche uses.⁸ EU-level roadmaps and financial sector rules are covered in Cryptography Compliance.