From January 2027, vendors selling new equipment into US national security systems must support the NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). Saudi banks must complete a quantum risk assessment and action plan by March 2027, under a circular from their central bank. The Australian Signals Directorate recommends ending the use of classical public-key cryptography by the end of 2030. The UK’s National Cyber Security Centre gives organizations until 2035 to finish migrating.
You’ll find all four on the timeline below, with more than 150 other milestones from governments, regulators, and industry. Look up every jurisdiction where you operate, sell, or hold contracts, and check which dates apply to your sector.
(We reproduce the timeline with permission from Marin Ivezic and PostQuantum.com, where he publishes and maintains the original Global PQC Migration Timeline.)
Using the timeline
Each row is one milestone, grouped by jurisdiction, with the issuing body and the document named on the left. Markers are placed at their dates on a scale from 2022 to 2036 and colored by milestone type. The legend under the chart explains each color. A red vertical line marks today’s date.
- Switch between “Key milestones” and “All entries” to show or hide the guidance documents, standards, and interim dates.
- Filter by region, sector, or milestone type.
- Check the figures above the chart for the entries on screen, the binding entries and hard deadlines among them, and the next binding date.
- Hover over a row, or tap it on a phone, for the milestone’s description, scope, and legal status.
- Click a marker to open the analysis on PostQuantum.com or, where there isn’t one yet, the primary source.
- On a phone, scroll the chart sideways to see every year.
Planning against the dates
Start with the earliest binding date in any jurisdiction where you operate, sell, or hold a contract. Make it your first milestone and plan backwards from there, not from 2035.
Check the legal status before you treat a date as binding. Most entries are guidance, recommendations, drafts, or corporate targets with no legal force of their own. Customers can still write those dates into contracts, which makes them binding on you.
Our field guide to global PQC deadlines explains where the national rules conflict and how to build one plan that meets all of them.
Where the data comes from
Marin Ivezic checks each deadline against its primary source and updates the original on PostQuantum.com as governments and regulators publish new rules. Where the two versions differ, the one on PostQuantum.com is current.
Authorities finalize drafts, add implementing rules, and revise dates. Confirm a date against its primary source before you use it in a board pack, a contract, or a supplier questionnaire.
PQC compliance training
In PQC Compliance: Global Overview, a two-hour course, we cover who each post-quantum rule binds, which dates apply, and the evidence regulators expect to see.
We also teach national courses for the United States, the United Kingdom, the European Union, Canada, Australia, Singapore, Switzerland, the United Arab Emirates, and Saudi Arabia. Governance, risk, and compliance teams can continue with PQC for GRC Professionals.
The timeline is educational and informational only. It is not legal, compliance, or engineering advice. Confirm your obligations against the primary sources and with your own counsel.