Think Earlier.
The quantum problem starts before the quantum computer arrives.
PQC Migration Timeline: Every Regulatory Deadline, 2022–2035
DORA and NIS2 obligations are already live, CNSA 2.0 applies to new national-security acquisitions, and NIST deprecates RSA-2048 and ECC-256 in 2030. Every enacted rule, supervisory signal, and hard deadline shaping post-quantum migration, plotted chronologically across jurisdictions and mapped to the governance clauses you will be asked to cite.
For the full narrative of each reference, see the Regulatory Radar. For a phased plan aligned to NIST's draft timeline, see the NIST PQC transition planning.
PQC deadlines at a glance
The dates most often asked about, with what each one actually obligates. Full detail for every entry sits in the interactive timeline below.
| Date | Milestone | What it requires |
|---|---|---|
| Aug 2024 | NIST FIPS 203/204/205 published | ML-KEM, ML-DSA and SLH-DSA become the approved PQC algorithms to migrate toward. |
| Jan 2025 | DORA applies (EU financial entities) | ICT risk management and cryptographic key controls, including documented crypto-agility, are supervisable now. |
| 2025 onward | NIS2 national transpositions in force | Essential and important entities must evidence cryptography policy and management-body accountability. |
| 2028 | UK NCSC: high-priority migration complete | Discovery and a costed migration plan by 2028, with highest-risk systems moved first. |
| 2030 | NIST deprecates RSA-2048 and ECC-256; CNSA 2.0 exclusive use | Classical 112-bit-strength public-key crypto is no longer approved for new protection. |
| 2035 | Full PQC transition target (NIST, EU roadmap, UK NCSC) | Legacy public-key algorithms disallowed; migration of all systems expected to be finished. |
Not sure where your organization sits against these dates? Measure it with the Q-Risk Score assessment.
NSM-10 issued
White House directs federal agencies to begin multi-year PQC migration with a 2035 mitigation horizon.
OMB M-23-02: Migrating to PQC
OMB mandates prioritized cryptographic inventories from federal agencies; the sequencing template the private sector will inherit.
Quantum Computing Cybersecurity Preparedness Act (PL 117-260)
US statute binds federal agencies to prepare for PQC migration and complete cryptographic inventories via OMB.
CISA/NSA/NIST Quantum-Readiness factsheet
Joint tri-agency guidance: build a roadmap, inventory cryptography, engage vendors, now.
MAS Advisory on quantum readiness
Monetary Authority of Singapore's Circular MAS/TCRS/2024/01, among the first regulator-to-institution quantum letters worldwide.
NIST finalizes FIPS 203, 204, 205
ML-KEM, ML-DSA, and SLH-DSA published as final standards. Deploy-now algorithms; procurement can cite them.
G7 Cyber Expert Group statement on quantum
G7 supervisors urge financial institutions to inventory, plan, and start migration.
MiCA fully applicable in EU
Crypto-asset service providers now bound by Article 70 operational resilience and Article 73 custody, every wallet key is ECC-vulnerable.
DORA applies to EU financial entities
ICT risk management, third-party oversight, resilience testing, the perimeter cryptographic risk lands inside.
Europol Quantum Safe Financial Forum call to action
Europol convenes banks and policymakers on the quantum transition, law enforcement now in the room.
NIST selects HQC as fifth PQC algorithm
Backup KEM to ML-KEM; final standardization expected 2027. Reinforces the case for crypto agility.
UK NCSC PQC migration timelines
Discovery and planning by 2028; highest-priority migration by 2031; completion by 2035. Guidance, not law, the clearest national timeline published.
NSA CNSA 2.0 reissued
Binding suite for National Security Systems; new NSS acquisitions must support CNSA 2.0 from Jan 1, 2027.
EU NIS Cooperation Group PQC roadmap
Three-date ladder: begin transitioning by end of 2026, critical infrastructure migrated by end of 2030, full transition by 2035.
Federal Reserve FEDS 2025-093 on HNDL
Fed research documents the irreversibility of harvest-now-decrypt-later exposure on distributed-ledger data.
BIS Project Leap Phase 2 completed
Bank of Italy, Banque de France, Bundesbank, Nexi-Colt, and Swift run PQC signatures on live liquidity transfers.
NCUA 2026 supervisory priorities
Risk-based compliance, payment systems, cybersecurity, vendor oversight, the foundations quantum readiness depends on.
Citi Institute quantum threat analysis
$2.0–3.3T Fedwire GDP-at-risk from a one-day disruption; 60–82% probability of a CRQC by 2044.
G7 CEG coordinated PQC financial-sector roadmap
Non-binding operational roadmap aligned to mid-2030s horizon, critical systems earlier, signed across seven economies.
COM(2026) 13, proposed NIS2 amendment
Would embed PQC migration planning into national cybersecurity strategies and bring EUDI Wallet providers into NIS2 scope.
NIST HQC final standard expected
Backup KEM diversification lands as a finalized FIPS.
NIST deprecates RSA-2048 and ECC-256
NIST IR 8547 (IPD): classical asymmetric algorithms move to deprecated status. Auditors begin flagging.
UK NCSC, highest-priority systems migrated
Second NCSC milestone: identity, high-value customer-facing, and machine-credential surfaces on PQC.
EU, full PQC transition
Roadmap horizon: full transition for as many systems as practically feasible.
UK NCSC, migration complete
Third and final NCSC milestone: PQC migration complete across UK organizations.
Where does your posture sit on this calendar?
Score your migration readiness against the deadlines above and generate a board-ready briefing aligned to QCI-QS1.
Turn Timeline Awareness Into Action
Regulatory Radar
Track live regulatory movement across 12+ frameworks
Critical Infrastructure Sector
CISA and sector-specific PQC obligations
Financial Services Sector
PCI DSS 4.0 and NYDFS quantum deadlines
Quantum Readiness Checklist
30-item actionable readiness self-audit
Credit Union PQC Guide
NCUA-aligned migration playbook