Post-Quantum Rules Around the World

In 2026, post-quantum migration moved from guidance to dated requirements in several jurisdictions. The United States set December 31, 2030 for key establishment in its high-value and high-impact federal systems. Singapore asked owners of critical information infrastructure for migration plans by March 31, 2027. The Saudi Central Bank gave financial institutions until December 31, 2026 to put cryptographic inventory procedures in place.

Regulators differ on who they bind and when. They ask for the same evidence: a named owner, a cryptographic inventory, risk-based priorities, a dated roadmap, supplier commitments and regular progress reports. In this course, we map the rules in each jurisdiction. We also show you how to build one set of evidence that answers several regulators at once.

Course Outline

Module 1. Who the Rules Bind (40 minutes)

Organizations face post-quantum requirements through five routes. Government agencies work to national mandates such as US Executive Order 14412 and the UAE National Encryption Policy. Suppliers take on requirements through procurement, from CNSA 2.0 acquisitions in the United States to the post-quantum clauses in Canadian federal contracts. Critical infrastructure owners take their requirements from their national cyber agency, and supervised firms from their regulator. Everyone else meets the dates through customers, insurers and auditors. We also cover the standards the rules refer to, including NIST’s FIPS 203, 204 and 205, NIST’s draft transition timeline, and national positions on hybrid cryptography.

Module 2. The Dates, Region by Region (45 minutes)

We cover the United States and Canada, the EU and its member states, the United Kingdom and Switzerland, the UAE and Saudi Arabia, Singapore, Australia, Japan and Hong Kong. Most jurisdictions set 2035 for full migration and 2030 or 2031 for their most important systems. Australia’s cyber agency recommends retiring traditional public-key cryptography by the end of 2030. We show where national agencies disagree, on hybrid schemes and on algorithm choice. We also track the instruments still pending, including the US federal contractor rule and the EU’s proposed amendment to NIS2.

Module 3. One Set of Evidence for Several Regulators (35 minutes)

You build one evidence pack that answers several regulators. It covers the accountable owner and board reporting, the cryptographic inventory, risk-based priorities, the dated roadmap, supplier commitments and progress reports. We map the pack to frameworks you already report against, including ISO/IEC 27001, the NIST Cybersecurity Framework, DORA and PCI DSS. We also show you how to watch for new rules and update the pack when a regulator issues one.

Prerequisites

None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.

Who this course is for

Compliance officers, GRC and risk leads, CISOs, legal counsel, internal auditors and migration program managers at organizations operating in several countries. Also useful for consultants advising clients across jurisdictions, and for anyone deciding which national course to take.

What you’ll be able to do afterward

• Identify the post-quantum requirements that apply to your organization in each country where you operate, and how each one applies to you
• Compare national migration dates and explain where they converge and where they differ
• Describe the evidence regulators expect, from the accountable owner to progress reports
• Build one evidence pack that answers several regulators
• Track pending rules and keep horizon scanning as a standing task
• Brief your board on regulatory exposure without overstating the threat timeline

What you leave with

When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the rules covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.

Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

Where this course fits

You can take this course on its own. Take it before or after the national course for your main jurisdiction, such as PQC Compliance: United States or PQC Compliance: European Union. In PQC for GRC Professionals, you map the requirements into control frameworks and audit evidence. If you will run the migration program, take PQCM Manager Training.

Why we teach this

We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each post-quantum rule as regulators issue it. We revise the course when a regulator issues or changes a rule.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.