Five jurisdictions have now put post-quantum deadlines in writing. Almost none of the earliest ones ask you to migrate anything. They ask you to discover what cryptography you run, inventory it, and produce a plan. The first of those dates falls on 22 October 2026, and it is a plan-submission deadline, not a migration deadline.
That distinction matters more than it sounds. A migration deadline can be phased, negotiated and re-scoped. An inventory deadline is closer to binary: either you can produce the document, or you cannot. And the work that produces it cannot be compressed at the end, because it is discovery work, not deployment work.
The algorithm question closed two years ago
NIST finalised its first three post-quantum standards on 13 August 2024: ML-KEM (FIPS 203) for key establishment, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures. Whatever else remains unsettled, the question of which algorithms to move to has had a published answer for two years.
Regulators have spent the time since then writing dates rather than algorithms. It is worth reading those dates carefully, in the order they land, because what they ask for first is remarkably consistent.
United States: 22 October 2026
Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, was signed on 22 June 2026. It requires agencies to transition high-value assets and high-impact systems to post-quantum key establishment by 31 December 2030, and to post-quantum digital signatures by 31 December 2031. National security systems are outside its scope.
Two days later, the Office of Management and Budget published Memorandum M-26-15, “Execution of the Migration to Post-Quantum Cryptography”, which turns the order into an operational schedule. Its central near-term instruction is short: “Agencies must develop and submit a PQC Migration Plan to OMB and the Office of the National Cyber Director (ONCD), no later than 120 days from the date of this memorandum.” That is 22 October 2026.
The memo names its own first phase “Strategy, Planning, and Discovery”, running 2026 to 2027. The United States government’s opening move on post-quantum cryptography is a discovery phase, and the deadline attached to it is a deadline to hand in a plan.
European Union: end of 2026
The NIS Cooperation Group’s “Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography” asks that “all Member States should start transitioning to post-quantum cryptography by the end of 2026”, with the protection of critical infrastructures transitioned “as soon as possible, no later than by the end of 2030”.
What “start transitioning” means in practice is set out as national roadmaps, cryptographic asset management, dependency mapping and risk analysis. Again: the first tranche of work is finding and recording what exists, not replacing it.
Singapore: 31 March 2027
The Cyber Security Agency of Singapore published version 1.0 of its Quantum-Safe Handbook on 16 July 2026, developed with GovTech and IMDA. It sets out three dated milestones for critical information infrastructure owners:
- By 31 March 2027: submission of the CII owner’s quantum-safe migration plan to CSA.
- From 1 January 2028: newly procured CII systems with a digital component should either support quantum-safe algorithms or be quantum-safe ready.
- By 31 December 2031: migration across CII systems complete, with vulnerable cryptography no longer in use.
One nuance is worth flagging, because it is inside CSA’s own document. The handbook introduces these as “requirements for Critical Information Infrastructure (CII) owners”, but its opening disclaimer states that the document “is intended for informational purposes only and is not mandatory, prescriptive or exhaustive”. Read the two together and the sensible interpretation is a supervisory expectation with a date on it rather than a statutory obligation. That is still a date your regulator will remember.
India: 31 December 2027
India’s Department of Science and Technology published the report of its task force on post-quantum migration, “Implementation of Quantum Safe Ecosystem in India”, on 4 February 2026. The report recommends what it calls “mandatory actions in a phased manner”.
Its first milestone, “Building the Foundations”, is dated 31 December 2027 for critical information infrastructure and no later than 31 December 2028 for other enterprises. The actions under it include, verbatim, “complete discovery and inventory of cryptographic artefacts”.
It goes further than any of the others on supply chain. From financial year 2026-27 organisations are to start requesting a Cryptography Bill of Materials and a quantum resiliency roadmap from vendors through procurement, and from financial year 2027-28 the report recommends mandating CBOM submission from vendors through procurement policy. A national task force putting a dated CBOM procurement requirement in writing is a significant marker for how cryptographic transparency is likely to be governed.
United Kingdom: 2028
The NCSC’s migration timelines set 2028, 2031 and 2035 as the three checkpoints. The 2028 milestone asks organisations to define their migration goals, to “carry out a full discovery exercise (assessing your estate to understand which services and infrastructure that depend on cryptography need to be upgraded to PQC)”, and to build an initial migration plan. Highest-priority migration activities follow by 2031, with migration complete across all systems, services and products by 2035.
The pattern is the point
Five jurisdictions, five different legal instruments, drafted independently by agencies with different mandates and different legal traditions. Not one of the earliest deadlines says “complete your migration”. They say: discover, inventory, map dependencies, produce a plan.
Qatar arrives at the same place from the opposite direction. Its National Information Assurance Standard v2.1 removed the approved-algorithm appendix that earlier versions carried and pointed instead at a separately versioned national cryptographic standard. That is sound crypto-agility design at the regulatory layer, but it means the approved baseline can change without the assurance standard changing, and only an organisation that already knows what it runs can tell whether a revision affects it.
Read together, these are not really cryptography deadlines. They are visibility deadlines with a cryptography label on them.
Why the inventory is the harder half
Choosing ML-KEM over RSA is a decision. It can be made in a meeting, written into a standard, and communicated in a memo. Establishing which of your systems, certificates, protocols, libraries and third-party dependencies actually negotiate RSA today is not a decision. It is instrumentation, and it takes time that cannot be recovered later.
In practice the gap between the architecture diagram and what is genuinely negotiated on the wire is the most consistent finding in this work. Typical examples:
- TLS terminations that no current team owns, still serving traffic.
- Certificates issued through a process that left with the person who set it up.
- Service-to-service authentication that was never in scope for any inventory.
- Embedded and appliance cryptography that no scanner reports because nothing asks it to.
- Vendor products whose cryptographic behaviour is undocumented, which is exactly what a CBOM requirement is designed to fix.
None of that is a cryptography problem. It is a visibility problem, and it is what every one of these first deadlines is actually testing.
Where the ECEM lifecycle fits
Enterprise Cryptographic Exposure Management is a six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. Transition is the visible stage, the one that appears in the headlines and the vendor decks. But the first four stages are what the 2026 and 2027 dates are actually asking for, and Monitor is what keeps the answer true once a national algorithm list can be revised independently of the standard that references it.
An organisation that has completed Discover, Inventory, Assess and Prioritise can produce a credible migration plan in weeks, because the plan is a reading of evidence it already holds. An organisation that has not will spend most of its remaining runway assembling the evidence, and will submit a plan built on assumptions.
A practical test before the first date
If your organisation falls under any of these regimes, there is a useful question to answer this quarter, and it is not “have we started migrating”. It is: how long would it take us, starting today, to produce a defensible inventory of the cryptography we run?
Not to build it. Just to find out how long it would take. That number is usually the point at which the deadline stops being abstract, and it is the number every one of these five regulators has, in effect, decided to start asking for.
Further reading: what Enterprise Cryptographic Exposure Management is, how Qatar’s NIA standard externalised its algorithm list, and our approach to cryptographic discovery and CBOM.