Key takeaways
- 12035 is the common finish line: NIST's draft transition plan, the US NSM-10 goal, the UK NCSC and the EU roadmap all converge on it.
- 2The US moved first on hard dates: Executive Order 14412 requires post-quantum key establishment on high-value federal systems by the end of 2030 and signatures by the end of 2031.
- 3For banks, the G7 Cyber Expert Group's January 2026 roadmap points critical systems to 2030–2032. Supervisors expect plans, inventories and progress well before then.
United States
National Security Memorandum 10 (May 2022) set the goal of mitigating quantum risk across federal systems by 2035, and the Quantum Computing Cybersecurity Preparedness Act (December 2022) made agency inventories and migration planning law.
- Executive Order 14412, signed 22 June 2026: agencies must move high-value assets and high-impact systems to post-quantum key establishment by 31 December 2030 and to post-quantum signatures by 31 December 2031. National security systems are covered separately, by CNSA 2.0.
- OMB memorandum M-26-15 followed two days later, asking agencies for post-quantum migration plans within 120 days.
- Federal contractors: the order directs a FAR rule requiring covered contractors to meet NIST FIPS standards, post-quantum algorithms included, by the end of 2030.
- NSA CNSA 2.0 for national security systems: software and firmware signing and traditional networking equipment exclusively post-quantum by 2030; web browsers, servers, cloud services and operating systems by 2033; all systems by 2035. New national security system acquisitions are expected to be CNSA 2.0 compliant from January 2027.
United Kingdom
The NCSC published three milestones in March 2025 for organisations to plan against.
- By 2028: define migration goals, complete discovery of your cryptography and build an initial plan.
- By 2031: complete the highest-priority migrations and refine the plan.
- By 2035: complete migration of all systems, services and products.
European Union
Following a 2024 Commission Recommendation, member states agreed a coordinated implementation roadmap in June 2025.
- By the end of 2026: every member state starts transitioning, with national plans, inventories and awareness under way.
- By the end of 2030: high-risk use cases and critical infrastructure migrated.
- By 2035: as many systems as feasibly possible migrated.
- For financial entities, DORA's technical standards already require cryptographic controls to be kept up to date with developments in cryptanalysis.
Financial sector: the G7 roadmap
The G7 Cyber Expert Group, co-chaired by the US Treasury and the Bank of England, published a coordinated post-quantum roadmap for the financial sector in January 2026, building on its September 2024 statement on quantum risk. It is explicitly non-binding and risk-based, but it is the clearest signal of what banking supervisors will expect.
- Critical systems and assets migrated within roughly 2030–2032; the remainder by around 2035.
- Heavy emphasis on third parties: most banks' cryptography sits inside vendors' products.
- Inventory, prioritisation and crypto-agility first, then migration.
Elsewhere
- Australia: the Information Security Manual plans for traditional asymmetric cryptography to stop being used by the end of 2030.
- Canada: the federal roadmap (June 2025) targets high-priority systems by the end of 2031 and the rest by the end of 2035.
What this means if you are not a government
Most of these dates bind governments and their suppliers, not private firms directly. They still set the pace: your vendors are re-engineering to meet them, auditors and supervisors borrow them, and customers in the public sector will put them into contracts. A credible position for 2027 is a complete cryptographic inventory, a Mosca analysis by data class, a funded plan, and hybrid post-quantum key exchange on your most exposed links.
Sources
- Federal Register: executive orders, including EO 14412, Securing the Nation Against Advanced Cryptographic Attacks (opens in a new tab)
- NSA: CNSA 2.0 FAQ and timelines (opens in a new tab)
- NCSC: Timelines for migration to post-quantum cryptography (opens in a new tab)
- European Commission: Coordinated implementation roadmap for the transition to PQC (opens in a new tab)
- G7 Cyber Expert Group: Quantum roadmap for the financial sector (US Treasury) (opens in a new tab)
General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.