PQC Mandates

Post-Quantum Cryptography Mandates & Migration Tracker

A source-backed guide to national and regional PQC policies: who is covered, what is required, and when milestones apply.

Coverage: official national and supranational policies and guidance. Status is assessed for each instrument and covered entity—not as a blanket statement that an entire country is legally mandated.

Request a PQC AssessmentRequest 47-Day TLS ReadinessJurisdiction tracker

Mandates, strategies and guidance are not interchangeable

A statute, binding government directive, agency policy, national strategy, standards publication and regulator recommendation have different force and scope. Each entry identifies the issuing authority, covered organizations, instrument type and source so you can assess what applies to your organization. Dates are reported as stated by the source; indicative guidance milestones are not represented as legal deadlines.

Source review current as of October 25, 2026 · 2026-10-25

Binding federal policyGovernment policy / directiveRegional recommendation / roadmapOfficial guidanceStandards

Jurisdiction tracker

Source review current as of October 25, 2026

United States

Federal policy directs agencies to inventory vulnerable cryptography and prepare migration plans. Separate requirements apply to National Security Systems under CNSA guidance; these instruments do not impose one universal mandate on every US business.

Binding federal policy
Who is covered
Federal civilian agencies under the relevant OMB memoranda; National Security Systems are governed separately by national-security policy. Contractors may be affected through agency contracts and applicable procurement requirements.
What it says
OMB M-23-02 directs agencies to inventory cryptographic systems, report vulnerable instances, and prioritize migration. NSM-10 established federal coordination and risk-mitigation policy. Follow-on guidance and procurement rules determine specific agency obligations.
Timeline and milestones
NSM-10 set a 2035 risk-mitigation objective for federal systems. OMB inventory and reporting milestones are agency-directed and have separate schedules. CNSA 2.0 has its own national-security product transition dates; verify the applicable current NSA profile for each system.
Applicability
Federal agencies; NSS separately. Private entities only where other rules, contracts, or sector requirements apply.

Official source

European Union

The Commission has issued a coordinated transition recommendation and roadmap. These coordinate Member State planning; they are not, by themselves, a directly applicable EU-wide company migration regulation.

Regional recommendation / roadmap
Who is covered
EU Member States and public-sector / critical infrastructure planning through national implementation. Specific obligations depend on Member State measures, sector regulation, procurement and supervisory requirements.
What it says
The Commission recommends national PQC transition roadmaps, coordination, cryptographic inventories, prioritization of sensitive and long-lived data, and gradual migration to quantum-resistant cryptography.
Timeline and milestones
2024 Commission Recommendation; coordinated roadmap published in 2025. The roadmap calls for Member State planning and phased transition; check national roadmaps for binding implementation milestones.
Applicability
EU-level coordination; implementation and binding duties are determined nationally and by sector.

Official source

United Kingdom

NCSC publishes a staged migration timeline for organizations. It is official cybersecurity guidance rather than a single general statute compelling every UK organization to migrate on the same dates.

Official guidance
Who is covered
Organizations are encouraged to assess and plan; public-sector bodies and regulated or contracted entities may have additional duties through other policy or sector rules.
What it says
Discover cryptographic dependencies, prioritize high-risk and long-lived systems, plan procurement and migration, and establish governance and ownership for PQC transition.
Timeline and milestones
NCSC indicative milestones: discovery and initial planning by 2028; prioritize and progress migration and refine plans by 2031; complete migration by 2035. Treat these as guidance milestones unless another instrument makes them binding.
Applicability
UK organizations as guidance; additional requirements may apply to government, regulated sectors or suppliers.

Official source

International standards baseline (NIST, United States)

NIST finalized the first principal PQC standards. Standards provide implementable algorithms; publication alone does not create a country-wide legal migration deadline.

Standards
Who is covered
Standards users, vendors, procurement bodies and organizations selecting cryptographic profiles. Government requirements arise from separate policy and procurement instruments.
What it says
FIPS 203 specifies ML-KEM; FIPS 204 specifies ML-DSA; FIPS 205 specifies SLH-DSA. Organizations should plan algorithm agility and use approved profiles appropriate to their requirements.
Timeline and milestones
Finalized August 13, 2024. NIST encourages migration planning and continues standards work; adoption schedules are set by agencies, regulators, sectors and organizations.
Applicability
Standards and product ecosystem; compliance obligation depends on adopting authority or contract.

Official source

Turn policy into an actionable transition plan

Get help understanding your PQC exposure and the operational impact of shorter TLS certificate lifetimes.

Request a PQC AssessmentRequest 47-Day TLS Readiness
Request a PQC Assessment · Request 47-Day TLS Readiness

Turn policy into an actionable transition plan

Get help understanding your PQC exposure and the operational impact of shorter TLS certificate lifetimes.

Coverage: official national and supranational policies and guidance. Status is assessed for each instrument and covered entity—not as a blanket statement that an entire country is legally mandated.

This tracker is informational, not legal advice. Policies change. Confirm the original instrument and consult qualified legal and security advisors before making compliance decisions.

Request a PQC Assessment or 47-Day TLS Readiness review

Tell us what you are planning. Our team will follow up to discuss scope, cryptographic inventory and next steps.

Your details are sent to Securetron for follow-up and are not stored in the website database.

This tracker is informational, not legal advice. Policies change. Confirm the original instrument and consult qualified legal and security advisors before making compliance decisions.