Post-Quantum Cryptography Deadlines Tracker: Every Official PQC Date in One Place

Post-quantum cryptography deadlines are now set by at least five official bodies, and they do not line up neatly, so most migration plans quote the wrong date for the wrong audience. This tracker collects the dates that governments and standards bodies have actually published for moving from RSA and elliptic curve cryptography to post-quantum algorithms, with the source for each and its current status. It covers the United States (NIST, NSA and the White House), the United Kingdom (NCSC), the European Union and Canada. It is written for CISOs, cryptography and PKI owners, and the people who must turn deadlines into budgets and supplier requirements. It is a living page reviewed monthly; the detail of the NIST timeline is in the NIST IR 8547 PQC Transition Timeline Guide, which we do not repeat here.

Status as of 28 October 2026: every date below was checked against the official source on 28 October 2026. NIST IR 8547 and SP 800-131A Rev. 3 were still Initial Public Drafts. Items marked Draft can still change.

Key takeaways

• 2035 is the common end point. The US (NSM-10), NSA for national security systems, the UK NCSC and Canada all point to 2035 for completing migration, and NIST's draft disallows quantum-vulnerable public key algorithms after 2035.
• The real pressure comes earlier. NSA requires new national security system acquisitions to be CNSA 2.0 compliant from 1 January 2027, the EU wants critical infrastructure moved by the end of 2030, and US agencies must support TLS 1.3 or a successor by 2 January 2030.
• Discovery and planning deadlines are already here. The EU asks Member States to start transitioning by the end of 2026, Canada required departmental plans from April 2026, and the NCSC expects full discovery and an initial plan by 2028.
• Two key NIST documents are still drafts. IR 8547 (2030 deprecation, 2035 disallowance) and SP 800-131A Rev. 3 were Initial Public Drafts when checked, so treat their dates as stated intent and watch for final versions.
• Machine identities carry most of the work. Certificates, TLS endpoints, code signing keys, SSH keys and VPN tunnels are where the dates bite, which makes PQC a non-human identity programme as much as a cryptography one.

All deadlines at a glance

Dates are listed in time order. "Applies to" is the legal or policy scope; organisations outside that scope often adopt the same dates through regulators, auditors or supplier contracts.

United States: NIST, NSA and the White House

Policy layer

• NSM-10 (4 May 2022): sets the federal goal of "mitigating as much of the quantum risk as is feasible by 2035" and requires federal civilian agencies to deliver annual inventories of quantum-vulnerable systems to CISA and the National Cyber Director.
• Executive Order 14306 (6 June 2025): replaced the PQC section of EO 14144. It asked CISA, with NSA, to publish by 1 December 2025 a regularly updated list of product categories in which PQC-capable products are widely available, and asked NSA (for national security systems) and OMB (for everything else) to issue requirements by the same date for agencies to support TLS 1.3 or a successor no later than 2 January 2030. We could not confirm the CISA list on cisa.gov when we checked; if you rely on it for procurement, check the CISA site directly.

Standards layer (NIST)

• Algorithms: the post-quantum standards FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) were published as final in August 2024. See the ML-KEM Guide and the ML-DSA and SLH-DSA Post-Quantum Signatures Guide.
• NIST IR 8547: Initial Public Draft of 12 November 2024; comments closed on 10 January 2025 and the comments received were posted on 21 January 2025. The CSRC page showed no final or revised version on 28 October 2026. In the draft, 112-bit quantum-vulnerable algorithms are deprecated after 2030 and all quantum-vulnerable public key algorithms are disallowed after 2035.
• SP 800-131A Rev. 3: Initial Public Draft of 21 October 2024, comments closed 4 December 2024. This is the document that will give algorithm transitions force for federal systems, so its final text matters more than IR 8547 for compliance teams.

National security systems (NSA CNSA 2.0)

NSA announced the Commercial National Security Algorithm Suite 2.0 on 7 September 2022. Its FAQ sets the CNSSP 15 dates in the table above and names the algorithms below. CNSA 2.0 is stricter than NIST: it picks the highest parameter sets only.

NSA also published per-category dates (software signing, browsers and cloud services, networking equipment, operating systems and others) in its CNSA 2.0 advisory. We could not retrieve that document from the official site when checking, so those category dates are not listed here; read them in the NSA advisory before using them.

United Kingdom: NCSC

The NCSC published its PQC migration timelines on 20 March 2025. They apply to all organisations, with large organisations, critical national infrastructure operators and companies with bespoke IT as the main audience. SMEs that use custom or specialised software are asked to follow the same timetable.

• By 2028: define migration goals, carry out a full discovery exercise and build an initial plan, including supplier dependencies, investment needs and long-lived hardware roots of trust. Tell suppliers what you need.
• By 2031: complete early, highest-priority migration of the most critical assets and refine the plan into a full roadmap.
• By 2035: complete migration of all systems, services and products. The NCSC accepts that a small set of rarely used technologies may be harder to move by then.

The NCSC dates are guidance, not law, but UK regulators and auditors increasingly use them as the reference. The 2028 milestone is effectively an inventory deadline; see the Cryptographic Inventory and CBOM Guide.

European Union

EU Member States, supported by the European Commission, published the coordinated implementation roadmap for the transition to post-quantum cryptography on 23 June 2025. It is the first deliverable of the PQC work stream set up with the NIS Cooperation Group following the Commission's earlier recommendation.

• End of 2026: all Member States should start transitioning to PQC.
• End of 2030: critical infrastructure protection should move to PQC as soon as possible and no later than the end of 2030.
• Later milestones: the roadmap document itself contains further detail. Its PDF could not be read when we checked, so no later EU date is listed here; read the roadmap and its FAQ directly before quoting one.

The roadmap is addressed to Member States. For operators it arrives through national authorities and sector rules such as NIS2 implementation. Operators of essential and important entities should expect national authorities to ask for inventories and plans in line with the 2026 and 2030 dates.

Canada

The Canadian Centre for Cyber Security published the roadmap for migrating Government of Canada systems (ITSM.40.001) in June 2025, effective 23 June 2025. Departments had to produce an initial PQC migration plan by April 2026 and report progress annually from then. High priority systems must complete migration by the end of 2031 and remaining systems by the end of 2035. The structure matches the NCSC closely, which makes Canada a useful second reference for organisations operating in both markets.

Turning the dates into a plan

Most organisations are bound by none of these documents directly and by all of them indirectly. Use the earliest date that applies to any customer, regulator or supplier relationship you have, then plan backwards.

Phased approach

1. Now to 2026: discover. Build the cryptographic inventory, including certificates, keys, protocols, libraries and hardware security modules. Rank by data lifetime: anything that must stay confidential past 2035 is exposed to harvest now, decrypt later collection today. See the Harvest Now Decrypt Later Risk Assessment Template.
2. 2026 to 2027: prepare and pilot. Move to TLS 1.3, enable hybrid key exchange where your stack supports it, test certificate and handshake size impacts in a pilot ring, and put PQC requirements into procurement. See the Hybrid Post-Quantum TLS Key Exchange Guide.
3. 2028 to 2030: migrate key establishment first. NIST's draft prioritises key establishment in interactive protocols such as TLS and IKE because of stored traffic. Keep classical fallback configurable so you can roll back a failing endpoint without disabling PQC elsewhere.
4. 2030 to 2035: migrate signatures and long-lived trust. PKI hierarchies, code signing and device roots of trust take longest because they depend on hardware and partners. See the Post-Quantum Cryptography Migration Guide.

Small versus large organisations: a small organisation using mainstream cloud and SaaS will get most of its migration from suppliers, so its main jobs are inventory, supplier questions and keeping software current. A large organisation with its own PKI, HSMs, bespoke protocols or OT must run a funded programme now, because the 2031 milestones for high-priority systems leave little time for hardware refresh cycles.

Where machine identities fit

Almost every quantum-vulnerable key in an enterprise belongs to a non-human identity: TLS server and client certificates, workload mTLS identities, SSH host and user keys, code signing keys, SAML and OIDC token signing keys, VPN and IKEv2 credentials and device certificates. That has three practical consequences. First, the certificate and key inventory you need for machine identity governance is the same inventory the NCSC 2028 milestone asks for. Second, shorter certificate lifetimes and automated issuance make the switch to ML-DSA certificates far easier. Third, token signing keys for identity providers need their own plan, because relying parties must accept new algorithms before issuers can switch. See the Post-Quantum Migration for NHIs Guide and the Machine Identity, PKI and Certificate Lifecycle Guide.

Common failure patterns

• Quoting 2035 as the only date. Plans that aim at 2035 miss the 2027 CNSA 2.0 acquisition rule, the 2030 EU and TLS dates and the 2028 and 2031 NCSC milestones, and then run out of hardware refresh cycles.
• Treating draft NIST dates as final. IR 8547 and SP 800-131A Rev. 3 were still drafts on 28 October 2026. Write policy that references "the current NIST transition schedule" and review it when the final versions appear.
• Using commercial parameter sets for NSS work. ML-KEM-768 hybrids are common in browsers, but CNSA 2.0 requires ML-KEM-1024 and ML-DSA-87.
• Inventory that misses machine identities. Scanning only public TLS endpoints leaves out internal mTLS, SSH keys, code signing and HSM-held keys, which are the hardest to move.
• Relying on secondary summaries. Vendor blogs often attach dates to the wrong body or invent per-sector deadlines. Every date on this page links to its official source; check that source before citing a date in a board paper.
• No supplier evidence. The NCSC explicitly asks organisations to tell suppliers their needs. Without contract clauses and roadmaps, you cannot show progress against 2031.

Measuring progress

• Percentage of cryptographic assets inventoried, split by certificates, keys, protocols and libraries.
• Percentage of external and internal TLS endpoints on TLS 1.3, and the share negotiating hybrid key exchange.
• Number of high-priority systems (long data lifetime, critical service) with a funded migration date before 2031.
• Percentage of strategic suppliers with a published PQC roadmap or contractual commitment.
• Months between a deadline in this tracker and your planned completion date for the systems it covers (negative means late).

Framework mapping

How to use this tracker

• Review cadence: this page is reviewed monthly. The status line at the top shows the last check date.
• What triggers an update: a final IR 8547 or SP 800-131A Rev. 3, the CISA product categories list, a revised NSA CNSA 2.0 advisory, an updated NCSC timeline, or a new EU or national roadmap.
• How to cite: cite the official source in the references below, not this page, in contracts and policy.

Practitioner checklist

• Identify which of the bodies above bind you directly, and which reach you through customers or regulators.
• Record the earliest applicable date for each business unit and plan backwards from it.
• Complete a cryptographic inventory that includes machine identities, HSMs and code signing.
• Rank systems by data lifetime and treat anything confidential past 2035 as high priority now.
• Move to TLS 1.3 and pilot hybrid key exchange with a tested rollback path.
• Add PQC and crypto-agility clauses to procurement, using CNSA 2.0 parameter sets where NSS work is involved.
• Track the NIST drafts and update policy references when final versions appear.
• Report the progress metrics above to the risk committee at least twice a year.

Standards and references

• NIST: IR 8547 Transition to Post-Quantum Cryptography Standards (Initial Public Draft)
• NIST: SP 800-131A Rev. 3 Transitioning the Use of Cryptographic Algorithms and Key Lengths (Initial Public Draft)
• NSA: The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ
• NCSC: Timelines for migration to post-quantum cryptography
• European Commission: A coordinated implementation roadmap for the transition to post-quantum cryptography
• The White House: Executive Order 14306
• The White House: National Security Memorandum 10
• Canadian Centre for Cyber Security: Roadmap for the migration to post-quantum cryptography (ITSM.40.001)

Related NHI Mgmt Group resources: NIST IR 8547 PQC Transition Timeline Guide · Q-Day Planning Guide · Crypto-Agility Guide · Cryptographic Discovery and PQC Readiness Tools Buyer's Guide · Post-Quantum Migration for NHIs Guide. This guide summarises published government and standards body timelines and is not legal advice.