PQC deadlines
The deadlines are set.
Last checked: Nov 2026 Every date links to its source. Check each source for scope and wording.
| Body | Date | Requirement | Source |
|---|---|---|---|
| NIST (US) | 13 Aug 2024 | FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) finalized | NIST |
| NIST IR 8547 (US) | After 2030 / after 2035 | Quantum-vulnerable algorithms (e.g. RSA, ECDSA at 112-bit) deprecated after 2030; disallowed after 2035. First proposed in the 2024 draft; NIST published the final report in Oct 2026. | 2024 draft · Final (Oct 2026) |
| NSA CNSA 2.0 (US NSS) | 2025–2035 | Software/firmware signing: exclusive by 2030. Networking equipment (VPNs, routers): prefer by 2026, exclusive by 2030. Browsers/servers/cloud: exclusive by 2033. Operating systems: prefer by 2027, exclusive by 2033. Niche equipment, custom and legacy apps: by 2033. All NSS quantum-resistant by 2035. | NSA |
| US OMB M-26-15 | 24 Jun 2026 (issued) | Agency PQC migration plans within 120 days; support TLS 1.3 or a successor by 2 Jan 2030; mitigate as much quantum risk as feasible by 31 Dec 2030. | OMB |
| EU coordinated roadmap | 31 Dec 2026 / 2030 / 2035 | Start: national roadmaps, inventories and first steps by end of 2026. High-risk use cases (incl. finance) migrated by end of 2030. Medium-risk by end of 2035. | European Commission |
| UK NCSC | 2028 / 2031 / 2035 | Discovery and initial migration plan by 2028; highest-priority migration by 2031; full migration by 2035. | NCSC |
| Australia ASD | End 2026 / 2028 / 2030 | Refined transition plan by end of 2026; transition started (critical systems first) by end of 2028; stop using traditional asymmetric crypto (RSA, DH, ECDH, ECDSA) by end of 2030. | ASD |
Timeline
Aug 2024 NIST finalizes FIPS 203/204/205
Jun 2026 OMB M-26-15 issued
31 Dec 2026 EU: start migration · ASD: refined plan
2028 UK: discovery and plan complete · ASD: transition under way
2 Jan 2030 US federal: TLS 1.3 support
End 2030 EU high-risk migrated · ASD transition complete · OMB risk-mitigation objective · CNSA 2.0 signing and networking exclusive · NIST deprecation
2031 UK highest-priority migration complete
2033 CNSA 2.0 browsers, cloud and OS exclusive
2035 NIST disallows vulnerable algorithms · EU medium-risk · UK complete · NSS quantum-resistant
Informational only, not legal advice. Spot an update? Email hello@liriq.io.
Map the deadlines to your systems.
We align your migration roadmap to the regulator timelines that apply to you.