Skip to content
Get in touch

The global shift to Post-Quantum Cryptography (PQC): Regional initiatives

Post-quantum cryptography (PQC) migration will likely be the largest cryptographic transition in history. As a response, governments and cybersecurity authorities worldwide are setting aggressive migration timelines and establishing standards, migration roadmaps, and requirements to prepare for quantum-era threats.

Timelines vary by country and sector, with some high-priority migration targets set for 2030 and others extending to 2035. The first PQC standards were set in 2024 by NIST, and NSM-10 recommended that companies start inventorying their algorithms already in 2022.

The EU required member states to create their national roadmaps by 2025 and implement at least the first steps of their PQC transition by the end of 2026. APAC-based authorities are not behind, with various initiatives and recommendations published as early as 2023.

What are the main post-quantum cryptography migration timelines?

PQC migration timelines differ by region and sector. The EU roadmap targets high-risk use cases by 2030, the UK aims to complete migration by 2035, and Australia recommends transitioning away from traditional asymmetric cryptography by 2030. Organizations should check applicable national guidance and begin with a cryptographic inventory.

The common first step is cryptographic visibility. Organizations need to identify where vulnerable cryptography is used, understand their dependencies, and prioritize migration according to business risk.

Start your quantum-safe journey with an SSH crypto inventory >>>

EMEA

European Union (EU)

In 2024, the European Commission published an official Recommendation on Post-Quantum Cryptography for EU member states – the document addresses the need for a unified transition to PQC to ensure a quantum-safe future.

Exact timelines may vary by member state. However, the EU PQC migration roadmap sets out recommended milestones for all member states.

  • 2024: European Commission Recommendation (EU) 2024/1101 called for a coordinated PQC transition

  • 06/2025: All EU member states adopted a Coordinated Implementation Roadmap

  • By the end of 2026: Member states should start transitioning to PQC by implementing at least the first steps

  • By the end of 2030: Complete PQC transition of high-risk use cases, meaning that quantum-vulnerable public-key mechanisms can't be used stand-alone

  • By the end of 2035: Complete PQC transition of medium-risk use cases. For low-risk use cases, the transition processes should be as complete as feasible

This roadmap is a recommendation. It doesn’t mandate every business to transition to PQC by 2030 – it offers coordinated guidance to EU member states. Businesses should follow national implementation programs and sector-specific obligations as they may set additional requirements.

United Kingdom (U.K.)

In the U.K., the National Cyber Security Centre (NCSC) sets similar recommendations as in the EU, but the timeline differs.

  • By 2028: Complete cryptographic discovery and algorithm inventory, define migration goals, and develop an initial migration roadmap

  • By 2031: Complete highest-priority migration activities and refine the full roadmap

  • By 2035: Aim for exclusive PQC – complete migration across systems, services, and products

Germany

The Federal Office for Information Security (BSI) has published guidance on quantum-safe cryptography, migration planning, and hybrid cryptographic approaches. Their recommendations highlight preparation of PQC inventories, understanding risks and dependencies, and early planning.

Other EMEA countries

All EU member states have their own national cybersecurity centers (or a similar authority) that collaborate with the European Cybersecurity Competence Centre (ECCC). These authorities are developing recommendations and guidance in line with the EU PQC Migration Roadmap.

In other EMEA regions and countries such as Middle East, Africa, UAE, or Saudi Arabia, similar PQC recommendations are emerging.

APAC

Australia

In September 2026, the Australian Cyber Security Centre (ACSC) published the Information Security Manual (ISM), outlining requirements on PQC transition (within their national security framework) and specific cryptographic controls.

The Australian Signals Directorate (ASD) has set a firm mandate: all organizations must cease using traditional asymmetric cryptography, including RSA, Diffie-Hellman, and ECDSA, by the end of 2030. ASD has set three concrete milestones:

  • By the end of 2026: A refined migration plan
  • By the end of 2028: Active transition of critical systems

By the end of 2030: Full completion

Singapore

The Cyber Security Agency of Singapore has published sector-specific guidance and set a 2031 migration target for critical information infrastructure. CII owners must submit migration plans to CSA by 31 March 2027 and complete migration by 31 December 2031.

They also encourage other quantum-exposed organizations to establish a PQC strategy or at least an initial plan by the end of 2027 and complete migration by 2035. To accelerate migration efforts, CSA has also launched the Quantum-Safe Kickstarter Grant to support organizations’ migration efforts.

For the finance industry, the Monetary Authority of Singapore published an official Advisory on Addressing the Cybersecurity Risks Associated with Quantum (in 2024), in which they outline several areas that financial institutions need to consider when transitioning to PQC. These include:

  • Monitoring of the latest developments in quantum computing and raising awareness about the related cybersecurity risks

  • Creating and maintaining an inventory of cryptographic and critical assets that need to be migrated to PQC based on a prioritization plan

  • Developing, reviewing, and updating strategies in line with the upcoming PQC migration and building capabilities and competencies to address the migration and associated risks

Japan

Japan has set a clear deadline for moving government systems to PQC, and its technical standards and financial-sector guidance are already in place.

  • 2035 government migration target: In late 2025, Japan’s National Cyber Command Office (NCO, formerly NISC) published an interim report concluding that all government agencies must complete their transition to PQC by 2035. This puts Japan in line with the 2035 horizon used by the US and EU

  • CRYPTREC technical guidance: CRYPTREC, which maintains Japan’s approved cipher lists, published its PQC guidelines in April 2025. The NCO report gives CRYPTREC the role of defining the technical basis for government cryptographic standards, including the timeline for retiring from classical ciphers

  • Detailed roadmap expected by March 2027: The government will draft a migration roadmap within fiscal year 2026, which ends on 31 March 2027. The roadmap will set out the concrete steps toward the 2035 target

Other APAC countries

Other regional authorities (e.g. in Hong Kong, India, or Malaysia) are introducing various recommendations and assessments and developing national policies and standards. However, generally, no PQC completion deadlines are set yet.

AMER

Canada

Canada is among the most advanced countries when it comes to PQC transition planning on a national level. The Treasury Board of Canada Secretariat and Canadian Centre for Cyber Security established a binding federal policy, setting out milestones for organizations subject to the federal government security framework (as of October 2025).

  • April 1, 2026: Initial departmental PQC migration plans and annual progress reporting; applicable procurement clauses

  • April 1, 2027: Cryptographic identification and inventory milestones

  • April 1, 2028: Updated migration plans and start of system transitions

  • By the end of 2031: Complete migration of high-priority systems

  • By the end of 2035: Complete migration of remaining systems

United States

Following recommendations and advisories have been published by authorities in the US:

Other AMER countries

Other regional authorities in the Americas don't have national deadlines or PQC migration mandates established just yet. However, certain countries have started establishing their national frameworks and initial recommendations, including Brazil or Uruguay.

Brazil's Federal Digital Government Strategy includes an initiative to define a post-quantum cryptographic standard by 2027, and Uruguay’s National Cybersecurity Strategy 2024–2030 establishes a formalized framework for transitioning critical infrastructure to quantum-resistant public key infrastructure.

Frequently asked questions about PQC migration

What is post-quantum cryptography migration?

Post-quantum cryptography migration is the process of identifying and replacing quantum-vulnerable cryptographic mechanisms with alternatives designed to resist attacks from future quantum computers.

When do organizations need to complete PQC migration?

There is no single global deadline. Some authorities target high-risk systems by 2030 or 2031, while other roadmaps aim for broader completion by 2035. Applicable dates depend on the country, sector, and system.

What is the first step in a PQC migration plan?

Start with a cryptographic inventory to identify where vulnerable cryptography is used, understand dependencies, and prioritize migration according to business risk.

Is PQC migration mandatory in the EU?

The EU coordinated implementation roadmap provides recommendations to member states rather than a universal 2030 mandate for every business. Organizations should review their national programs and sector-specific obligations.

How do PQC migration timelines differ across regions?

The EU, UK, Australia, Singapore, Canada, Japan, and the United States have issued different roadmaps, recommendations, or sector-specific requirements. The regional sections above outline their principal milestones.