EU PQC Migration guidance
A coordinated European transition to PQC
EU Member States, supported by the European Commission, have agreed a roadmap to coordinate the transition to post-quantum cryptography.
- Guidance issuer
- NIS Cooperation Group and European Commission
- Type
- Coordinated roadmap with recommended migration targets
Primary audience
National authorities and organisations responsible for:
- Public administrations and essential services
- Critical infrastructure and other high-risk applications
- Technology supply chains and systems holding long-lived sensitive data
The roadmap sits alongside NIS2 and sector rules. National implementation and the risk of each application determine the applicable requirements.
EU PQC Migration milestones
European PQC migration milestones
The EU roadmap coordinates national preparation and prioritises applications according to risk.
- By end 2026
Start the transition
Member States establish national roadmaps and coordinate stakeholders.
- By end 2030
Protect high-risk uses
Migrate high-risk applications, including critical infrastructure. Plan the remaining transition.
- By end 2035
Complete the broader transition
Migrate normal-risk applications and as many low-risk uses as possible.
Roadmap targets. These dates do not create one blanket statutory PQC deadline for every company.
EU PQC Algorithm usage
PQC algorithms in the European transition
Use standardised algorithms in suitable protocols, with parameters chosen for the application and the relevant national guidance.
Algorithm selection
The roadmap does not prescribe one universal parameter set. Consult national security guidance and the standards relevant to your sector.
Hybrid schemes
The EU roadmap recommends standardised and tested combinations of PQC and traditional cryptography wherever feasible and suitable.
Protocol and supplier readiness
Test interoperability and cryptographic agility. Stateful signature schemes require specialist controls for signing state.
US PQC Migration guidance
NIST standards and the federal PQC transition
NIST provides the algorithm standards. Updated federal direction sets priorities for US agency migration, supported by NCCoE discovery and interoperability work.
- Guidance issuer
- NIST, OMB and the Office of the National Cyber Director
- Type
- Technical standards and federal agency requirements
Primary audience
Technical leaders and risk owners in:
- Federal agencies and suppliers supporting their systems
- Critical infrastructure operators developing migration plans
- Organisations using NIST standards as their technical baseline
OMB M-26-15 covers federal systems outside national security systems. National security systems follow separate requirements, including CNSA guidance.
US PQC Migration milestones
US federal PQC migration milestones
The 2026 federal programme separates planning, priority key establishment and signature migration.
- 2026–2027
Strategy and discovery
Agency inventory, assessment and migration planning. OMB plans are due within 120 days of its 24 June 2026 memorandum.
- 2027–2028
Pilots and early migration
Test deployments and refine the plan using experience from priority systems.
- By end 2030
Priority key establishment
Migrate key establishment for federal high-value assets and high-impact systems. OMB also prioritises highly sensitive and particularly vulnerable systems.
- By end 2031
Priority digital signatures
Migrate digital signatures for the priority federal systems.
- 2035
Remaining systems
Complete the remaining migration with consideration of risk and commercial availability.
Federal scope. These dates are not a universal legal deadline for all US businesses. NIST IR 8547 remains an initial public draft, rather than a final standalone mandate.
US PQC Algorithm usage
US PQC algorithm standards
The published FIPS standards distinguish key establishment from digital signatures. Select algorithms for the protocol and security requirements of the system.
Replacement approach
ML-KEM replaces vulnerable key establishment through suitable protocols. ML-DSA and SLH-DSA address digital signatures. Stateful signing requires strict state management.
Implementation and validation
Algorithm standardisation does not validate a product by itself. Assess implementation assurance, interoperability and the applicable federal profile.
UK PQC Migration guidance
Guidance from the National Cyber Security Centre (NCSC)
The NCSC has issued guidance with recommended migration targets to help organisations prepare for and transition to post-quantum cryptography.
- Guidance issuer
- National Cyber Security Centre (NCSC)
- Type
- Guidance with recommended migration targets
Primary audience
Technical decision-makers and risk owners in:
- Large organisations
- Operators of critical national infrastructure, including industrial control systems
- Companies with bespoke IT, such as proprietary communications systems
The core timelines are relevant to all organisations. SMEs using mainly commodity IT can typically migrate through vendor updates.
UK PQC Migration milestones
UK PQC migration milestones
NCSC target dates describe when each stage should be complete. Preparation starts now.
- By 2028
Discovery and initial plan
Complete discovery and assessment. Plan priorities, supplier dependencies, investment and long-lived hardware roots of trust. Communicate needs to suppliers.
- By 2031
Priority migration
Complete the highest-priority activities, prepare supporting infrastructure and refine the plan for full migration.
- By 2035
Full migration
Complete migration across systems, services and products. Use the transition to strengthen wider cyber resilience.
Recommended completion targets. Sector constraints and rare technologies may require additional planning.
UK PQC Algorithm usage
UK PQC algorithm usage
NCSC recommends NIST-standardised algorithms and robust implementations, with protocol changes and supplier testing built into the migration.
Replacement approach
Replace RSA / DH / ECDH key establishment with ML-KEM through suitable protocols. Replace vulnerable signatures with ML-DSA, evaluating hash-based schemes for specialised signing.
Hybrid schemes
NCSC treats PQC with traditional cryptography as an interim option with a route to PQC-only. For PKI, it favours a single transition to fully PQC authentication.
Deployment
Use final-standard implementations and appropriate RFC-based protocols. Test interoperability and check for fallback to vulnerable algorithms.
Sweden PQC Migration guidance
Sweden’s national PQC migration guidance
Swedish NCSC guidance sets a national transition timetable, with early action on ownership, cryptographic inventory and sensitive information.
- Guidance issuer
- NCSC at FRA; sector supervisors include PTS and FI
- Type
- Guidance and policy alongside binding risk-management duties
Primary audience
Leadership and technical teams in:
- Companies and public authorities covered by the Cybersecurity Act (NIS2)
- Financial entities subject to DORA
- Other organisations protecting sensitive or long-lived information
The 2030 and 2035 dates are guidance targets. Legal frameworks impose duties within their own scope and do not set one universal PQC deadline for every company. Classified information follows separate rules.
Sweden PQC Migration milestones
Sweden PQC migration milestones
The national recommendations prioritise high-risk information, within the wider European transition.
- Now
Ownership and inventory
Assign executive responsibility and budget. Inventory cryptography and classify information.
- By end 2030
High-risk uses
Complete high-risk migrations. Prioritise information that must remain sensitive for more than ten years.
- By end 2035
All uses
Complete the transition, including lower-risk uses, final evaluation and fine-tuning.
- By end 2026
Start the transition
Member States establish national roadmaps and coordinate stakeholders.
- By end 2030
Protect high-risk uses
Migrate high-risk applications, including critical infrastructure. Plan the remaining transition.
- By end 2035
Complete the broader transition
Migrate normal-risk applications and as many low-risk uses as possible.
Guidance targets. Useful evidence includes approved plans, named owners, supplier actions, migration tests and a final review; these are practical suggestions for evidencing progress.
Sweden PQC Algorithm usage
Sweden PQC algorithm usage
NCSC identifies replacements for vulnerable public-key cryptography. Much existing symmetric cryptography can remain.
Replacement approach
Use ML-KEM for key establishment, ML-DSA or SLH-DSA for signatures, and LMS / XMSS where reliable signing-state management is possible.
Protocols and hybrid schemes
Use standardised, tested protocols and implementations. Where appropriate, combine PQC with traditional cryptography using established constructions.
Official position on QKD
The joint security-agency paper favours PQC for broad migration. QKD has limited niche uses and needs further security assurance. QKD still requires authentication.
Netherlands PQC Migration guidance
Dutch policy and guidance for PQC migration
The Dutch central-government strategy sets a migration timetable. NCSC-NL and AIVD guidance help organisations assess exposure and choose a migration approach.
- Guidance issuer
- BZK and QvC NL; NCSC-NL and AIVD/NBV
- Type
- Government policy and security guidance with sector risk duties
Primary audience
Decision-makers responsible for:
- Central-government systems under the Dutch quantum strategy
- Essential and important entities under applicable NIS2 implementation rules
- Financial institutions under DORA and organisations holding sensitive data
The 2030 / 2035 dates are roadmap and policy targets, rather than a blanket statutory deadline for every company. Check the scope of Cbw/Cbb, BIO2, DORA and applicable EU implementing rules.
Netherlands PQC Migration milestones
Netherlands PQC migration milestones
Dutch central-government policy adds preparation and procurement milestones to the European roadmap.
- By end 2026
Risk and policy
Include quantum risk in risk management and establish cryptography policy.
- By end 2027
Plans and pilots
Address harvested-data risk, prepare migration plans and pilots, maintain cryptographic asset management, and allocate resources.
- By end 2028
Procurement
Set PQC procurement requirements and develop guidance for essential companies.
- By end 2030
High-risk migration
Complete high-risk uses, adopt PQC by default in software and firmware, and support testing and standards.
- By end 2035
Broader migration
Complete medium-risk uses and low-risk uses as far as possible.
- By end 2026
Start the transition
Member States establish national roadmaps and coordinate stakeholders.
- By end 2030
Protect high-risk uses
Migrate high-risk applications, including critical infrastructure. Plan the remaining transition.
- By end 2035
Complete the broader transition
Migrate normal-risk applications and as many low-risk uses as possible.
End-year policy targets for central government and EU roadmap targets. Risk may require faster action.
Netherlands PQC Algorithm usage
Netherlands PQC algorithm usage
Dutch guidance combines application-specific parameters with tested hybrid constructions and supplier readiness.
Replacement approach
AIVD advises ML-KEM or FrodoKEM for key establishment, preferring FrodoKEM when greater confidence in the construction is needed. Use suitable PQC signatures and AES-256.
Hybrid schemes
Combine lattice-based PQC with established traditional cryptography using tested implementations. NCSC TLS guidance recommends considering X25519MLKEM768.
Official position on QKD
AIVD and partner agencies favour PQC. QKD needs dedicated infrastructure and authentication and has limited security maturity. It does not replace PQC migration.
Canada PQC Migration guidance
Canada’s federal PQC migration roadmap
The Canadian Centre for Cyber Security describes how federal departments should prepare, identify vulnerable cryptography and manage the transition.
- Guidance issuer
- Canadian Centre for Cyber Security, with TBS and SSC
- Type
- Federal roadmap and cryptographic recommendations
Primary audience
Accountable decision-makers and technical teams in:
- Federal departments and agencies managing non-classified IT
- Shared-service and cloud providers supporting federal systems
- Other organisations using Cyber Centre guidance to plan migration
The roadmap’s milestone dates address Government of Canada systems. ITSP.40.111 gives algorithm recommendations for UNCLASSIFIED, PROTECTED A and PROTECTED B information.
Canada PQC Migration milestones
Canada PQC migration milestones
The federal roadmap combines departmental planning with staged system migration.
- April 2026
Initial plans and reporting
Develop departmental migration plans. Begin progress reporting and continue it annually.
- By end 2031
High-priority systems
Complete PQC migration for high-priority federal systems.
- By end 2035
Remaining systems
Complete migration for the remaining government systems.
Federal roadmap targets. Completion requires vulnerable algorithms to be disabled, isolated or tunnelled, as described in the source.
Canada PQC Algorithm usage
Canada PQC algorithm usage
ITSP.40.111 recommends post-quantum algorithms for UNCLASSIFIED, PROTECTED A and PROTECTED B information.
Replacement approach
Use ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures. Follow the publication’s phase-out advice for existing algorithms.
Implementation assurance
LMS and XMSS require reliable state management. Track Cyber Centre protocol guidance as post-quantum configurations become available.
Australia PQC Migration guidance
ASD guidance for the Australian PQC transition
The Australian Signals Directorate recommends a planned transition to PQC, with completion by the end of 2030 and continuing validation afterwards.
- Guidance issuer
- Australian Signals Directorate (ASD)
- Type
- Security guidance and Information Security Manual controls
Primary audience
Risk owners and technical leaders responsible for:
- Government and organisations applying the Information Security Manual
- Critical systems and data with long confidentiality requirements
- Procurement, suppliers and technology that will remain in use beyond 2030
Apply ISM controls according to the organisation’s obligations and information classification. The planning publication sets recommended transition milestones.
Australia PQC Migration milestones
Australia PQC migration milestones
ASD recommends ceasing traditional asymmetric cryptography by the end of 2030.
- By end 2026
Refined transition plan
Account for security goals, risk tolerance, dependencies and the value of data.
- By end 2028
Migration underway
Start with critical systems, sensitive or long-lived data, and systems that are difficult to update.
- By end 2030
Transition complete
Complete the PQC transition, allowing contingency for delays and technology changes.
- After 2030
Ongoing assurance
Monitor and validate implementations and respond to vulnerabilities and evolving threats.
ASD recommendations. The applicability of ISM controls depends on the organisation and the information being protected.
Australia PQC Algorithm usage
Australia PQC algorithm usage
The ISM gives specific procurement requirements for systems intended to remain in use beyond 2030.
Supporting cryptography
New equipment, applications and libraries should also support SHA-384, SHA-512 and AES-256 for use beyond 2030.
Hybrid schemes
ASD does not recommend PQC / traditional hybrid schemes, but does not prohibit them. If used, at least one component must be an ASD-approved cryptographic algorithm.
Implementation
Maintain a transition plan and validate the actual algorithms in use against the applicable ISM profile.
International PQC Migration guidance
The international PQC standards ecosystem
Algorithm standards, migration guidance and protocol specifications serve different roles. A deployment needs the relevant combination for its products and markets.
- Guidance issuer
- NIST, ETSI, IETF and other standards bodies
- Type
- Technical standards, protocol specifications and migration guidance
Primary audience
Teams responsible for:
- Products and infrastructure used across jurisdictions
- Protocol implementation and interoperability
- Security architecture, procurement and migration planning
There is no single global regulatory PQC deadline. Track national policy, sector obligations and the status of each specification used in your deployment.
International PQC Migration milestones
International PQC standards milestones
These are published standards milestones, rather than a global migration deadline.
- August 2024
First NIST PQC FIPS
FIPS 203, 204 and 205 establish ML-KEM, ML-DSA and SLH-DSA.
- July 2026
TLS hybrid framework
RFC 9954 describes hybrid key exchange in TLS 1.3. It is an Informational RFC.
- August 2026
SSH hybrid methods
RFC 10042 defines ML-KEM with traditional key exchange for SSH. It is an Informational RFC.
Migration schedules remain specific to the jurisdiction, sector and application. An RFC’s publication alone does not establish product support or certification.
International PQC Algorithm usage
International PQC algorithm usage
A common technical baseline distinguishes key establishment, stateless signatures and specialised stateful signatures.
Standards and profiles
Use the standardised algorithm names rather than treating older candidate versions as interchangeable. Select parameters through the relevant application and national profile.
Protocols and hybrid schemes
A protocol specification defines how algorithms work together. Confirm its status, supported implementations and interoperability before deployment.
Sources reviewed 11 October 2026. Select a region and topic to explore its guidance.