Post-Quantum And Cyber Regulation In 2026: Who Requires What, And By When

Post-quantum dates now appear in documents from regulators, cyber agencies and governments on every continent. Read quickly, they suggest that the whole world has ordered companies to replace their cryptography by 2030 or 2035. Read carefully, the picture is narrower and more useful: a few binding rules go beyond general encryption duties, and they mostly ask private organisations for an inventory and a plan, while the later migration dates sit mostly in guidance or in rules for government systems.

This article is the starting point for the Regulations Across Regions group. It sets out the main instruments as of October 2026, labels each one by legal force, and shows the dates that are closest. The articles that follow go region by region. For the detailed wording of PCI DSS, DORA and the US federal timeline, see Cryptography Compliance. This is general information, not legal advice.

How To Read A Regulatory Date

The same year can mean very different things depending on who wrote it. A date in a binding regulation is something a supervisor can enforce. A date in national guidance is advice, however strongly worded. A date in a government strategy may bind only government departments. Every instrument in this group carries one of these labels.

The Master Table

The table below lists the instruments that matter most for cryptography and quantum readiness, as of October 2026. Dates are those stated in the source. Where nothing was found, the table says so rather than guessing.

Sources for the rows above: PCI DSS,¹ the DORA technical standard,² NIS2,³ the Cyber Resilience Act,⁴ the EU roadmap,⁵ SAMA,⁶ the NCA controls and standards,⁷ the UAE policy,⁸ the UAE IA Standard,⁹ the ADGM notice,¹⁰ the UK NCSC,¹¹ FINMA,¹² the US executive order and OMB memorandum,¹³ Canada’s roadmap and OSFI bulletin,¹⁴ the Singapore handbook,¹⁵ MAS,¹⁶ the HKMA,¹⁷ India’s roadmap,¹⁸ Japan’s FSA and Cabinet Secretariat,¹⁹ South Korea’s ministry and KISA,²⁰ ASD²¹ and the G7 roadmap.²² Rows saying nothing was found rest on the searches described in the Gulf article.

What The Binding Rules Actually Ask For

Several binding rules already require private organisations to have cryptography policies or to use encryption. NIS2, the Cyber Resilience Act, the Saudi NCA controls and a range of sector rules all fall into this group. Four instruments go further and require an inventory, a register or quantum planning. India’s securities regulator also lists a cryptographic inventory, as an indicative measure in its binding cyber framework, which the inventory article explains.

PCI DSS requirement 12.3.3 expects a current list of the cipher suites and protocols in use, an active watch on whether each stays safe and a written plan for reacting to cryptographic weaknesses that can be seen coming, all revisited at least every 12 months.¹ The DORA technical standard requires EU financial entities under its full ICT risk framework to keep an encryption policy that allows cryptography to be updated as cryptanalysis develops, and to keep a register of certificates for at least the assets that support critical functions.²

SAMA’s August 2026 circular is the only binding instrument found that sets a near, dated post-quantum task for a whole financial sector. Saudi financial institutions must have procedures to identify and classify all cryptographic assets by the end of 2026, then complete an enterprise quantum risk assessment with action plans by the end of March 2027.⁶ The UAE National Encryption Policy, within its scope, requires federal and emirate government entities and non-government critical infrastructure operators to keep an inventory of public key cryptography and prepare a transition plan, but its text sets no deadline.⁸

None of these rules orders a full migration by a fixed date. The common demand is visibility: know where cryptography is used, judge the risk, and have a plan.

Where The 2030 And 2035 Dates Come From

The well-known later dates come mostly from national cyber agencies and government programmes. The UK NCSC advises discovery and an initial plan by 2028, the highest-priority migration by 2031 and completion by 2035.¹¹ The EU roadmap asks Member States to take first steps and set national roadmaps by the end of 2026 and finish high-risk use cases by the end of 2030.⁵ Both are guidance.

The US executive order signed on 22 June 2026 is binding, but on federal agencies. It directs OMB to issue guidance requiring agencies to move high value assets and high impact systems to post-quantum key establishment by 31 December 2030 and to post-quantum signatures by 31 December 2031, and national security systems sit outside these provisions. The order also directs the FAR Council to propose, by 19 December 2026, a rule that would require covered contractors to comply with NIST’s FIPS standards, including the post-quantum ones, by 31 December 2030.¹³ Until such a rule is adopted, these dates bind agencies only.

Singapore sits in between. CSA’s handbook sets dated milestones for critical information infrastructure owners, including a migration plan by 31 March 2027 and completion by 31 December 2031.¹⁵ The G7 Cyber Expert Group suggests critical financial systems move in 2030 to 2032, while saying plainly that its roadmap does not set regulatory expectations.²²

The Nearest Deadlines

The countdowns below show the closest dated items across the regions. The full list, including AI rules, is in the Regulatory Deadline Tracker.

Reading The Regions

The rest of this group follows the map. The Gulf comes first, because Saudi Arabia has the hardest financial-sector date and the UAE has the most detailed planning text in the region: see the UAE, Saudi Arabia and rest of the GCC articles. Europe, North America and Asia Pacific follow. Two cross-cutting pieces explain which regulators require a cryptographic inventory and give AI regulation at a glance.