A date is shown only when the tracked source publishes one.
PQC REQUIREMENTS BY REGION
PQC deadlines are taking shape.Readiness starts with knowing what applies.
Governments, regulators and standards bodies are moving post-quantum cryptography from long-range guidance into dated transition plans. Explore the requirements that may be relevant to your organisation, then establish the evidence needed to act.
2027–2028Inventory, planning and procurement
2030–2031Priority systems and high-risk use cases
2033–2035Broader migration targets
WHAT MAY APPLY
Requirements by region
Open a country to review its authority, audience, readiness action and primary source.
STRONGEST PUBLISHED SIGNAL
Select a highlighted country to review its requirement details and source material.
MandatoryOfficial guidanceSecondary report
SELECT A JURISDICTION
COMPARE THE REQUIREMENTS
Compare deadlines and readiness requirements.
Compare when transition milestones fall due, or see the readiness actions that recur even when no date is attached.
DATED MILESTONES
Plan, priority-system and broader transition dates drawn from the tracked source material.
| Jurisdiction or scope | Status | Plan by | Priority systems by | Broader transition by |
|---|---|---|---|---|
| Canada, federal departmentsNorth America | Mandatory requirement | 1 Apr 2026 | End 2031 | End 2035 |
| United States, Department of DefenseNorth America | Secondary report | No date | End 2030 | No date |
| United States, federal civilian agenciesNorth America | Mandatory requirement | 22 Oct 2026 | End 2030 | End 2035 |
| United States, national security systemsNorth America | Mandatory requirement | No date | End 2030 | End 2033 |
| United States, NIST reference standardsNorth America | Official guidance | No date | End 2030 | End 2035 |
| CzechiaEurope | Official guidance | No date | End 2030 | No date |
| European Union member statesEurope | Official guidance | End 2026 | End 2030 | End 2035 |
| GermanyEurope | Secondary report | No date | End 2030 | No date |
| SwedenEurope | Secondary report | No date | End 2030 | End 2035 |
| United KingdomEurope | Official guidance | End 2028 | End 2031 | End 2035 |
| AustraliaAsia-Pacific | Official guidance | End 2026 | End 2028 | End 2030 |
| Hong KongAsia-Pacific | Official guidance | No date | No date | End 2030 |
| IndiaAsia-Pacific | Official guidance | End 2027 | End 2029 | End 2033 |
| JapanAsia-Pacific | Official guidance | No date | No date | End 2035 |
| SingaporeAsia-Pacific | Official guidance | 31 Mar 2027 | 1 Jan 2028 | 31 Dec 2031 |
| South KoreaAsia-Pacific | Secondary report | No date | End 2030 | End 2035 |
| TaiwanAsia-Pacific | Official guidance | End 2027 | End 2029 | End 2035 |
| ThailandAsia-Pacific | Secondary report | No date | No date | End 2030 |
| IsraelMiddle East | Mandatory requirement | 7 Jan 2026 | No date | No date |
| Saudi ArabiaMiddle East | Mandatory requirement | Q4 2026 | No date | No date |
| G7 Cyber Expert GroupInternational and vendors | Official guidance | No date | No date | End 2035 |
| Vendor targets for their own productsInternational and vendors | Official guidance | No date | No date | End 2029 |
Research coverage and boundariesLast reviewed September 2026
Quelea separates mandatory requirements, official guidance and secondary reports, and links to the issuing source wherever available. A secondary report is a date or requirement we found in a news article or other secondary source rather than in the issuing body's own text, so it is shown but never counted as binding.
Inventory, planning and governance requirements remain relevant without a calendar deadline.
Euro-area banks under ECB supervision · China · Indonesia · Philippines · Vietnam · Egypt · Kuwait · Qatar · Saudi Arabia (National Cybersecurity Authority) · Turkey · PCI Security Standards Council · Basel Committee on Banking Supervision, Financial Stability Board and IOSCO · SWIFT
Not checked: Oman's Cyber Defence Centre · the UAE Cyber Security Council · Abu Dhabi's government information security standard could not be reached, and Austria and Ireland were not searched document by document. Silence from these is not evidence of no deadline.
This page supports readiness conversations. It is not legal advice, and inclusion does not establish that a requirement applies to a particular organisation.
THE COMMON STARTING POINT
Readiness follows a common path.
Across the published material, readiness repeatedly begins with knowing the cryptographic estate, understanding exposure and turning that evidence into an owned migration plan.
Discover
Find externally exposed cryptography and establish the initial scope.
Inventory
Record algorithms, certificates, protocols, systems and dependencies.
Assess
Relate cryptographic exposure to data lifetime, criticality and regulatory risk.
Prioritise
Identify high-risk use cases, legacy blockers and supplier dependencies.
Plan and monitor
Assign ownership, sequence migration and preserve evidence of progress.
FOR ADVISORY AND MANAGED SECURITY PARTNERS
Guide clients through regional PQC requirements and deadlines.
Quelea gives partners a consistent evidence layer for discovery, assessment, prioritisation and ongoing validation across client portfolios.