A date is shown only when the tracked source publishes one.
PQC REQUIREMENTS BY REGION
PQC deadlines are taking shape.Readiness starts with knowing what applies.
Governments, regulators and standards bodies are moving post-quantum cryptography from long-range guidance into dated transition plans. Explore the requirements that may be relevant to your organisation, then establish the evidence needed to act.
2027–2028Inventory, planning and procurement
2030–2031Priority systems and high-risk use cases
2033–2035Broader migration targets
WHAT MAY APPLY
Requirements by region
Open a country to review its authority, audience, readiness action and primary source.
STRONGEST PUBLISHED SIGNAL
Select a highlighted country to review its requirement details and source material.
MandatoryOfficial guidanceAnnounced target
SELECT A JURISDICTION
COMPARE THE REQUIREMENTS
Compare deadlines and readiness requirements.
Compare when transition milestones fall due, or see the readiness actions that recur even when no date is attached.
DATED MILESTONES
Plan, priority-system and broader transition dates drawn from the tracked source material.
| Jurisdiction or scope | Status | Plan by | Priority systems by | Broader transition by |
|---|---|---|---|---|
| Canada — federal departmentsNorth America | Mandatory requirement | 1 Apr 2026 | End 2031 | End 2035 |
| United States — Department of DefenseNorth America | Announced target | — | End 2030 | End 2031 |
| United States — federal civilian agenciesNorth America | Mandatory requirement | 22 Oct 2026 | End 2030–31 | End 2035 |
| United States — national security systemsNorth America | Mandatory requirement | — | End 2030 | End 2033 |
| United States — NIST reference standardsNorth America | Official guidance | — | End 2030 | End 2035 |
| CzechiaEurope | Official guidance | — | End 2030 | — |
| European Union member statesEurope | Official guidance | End 2026 | End 2030 | End 2035 |
| FranceEurope | Official guidance | End 2027 | — | — |
| GermanyEurope | Announced target | — | End 2030 | End 2031 |
| SwedenEurope | Announced target | — | End 2030 | End 2035 |
| United KingdomEurope | Official guidance | End 2028 | End 2031 | End 2035 |
| AustraliaAsia Pacific | Official guidance | End 2026 | End 2028 | End 2030 |
| Hong Kong banking sectorAsia Pacific | Official guidance | — | End 2030 | — |
| IndiaAsia Pacific | Official guidance | End 2027 | End 2029 | End 2033 |
| Japan government systemsAsia Pacific | Official guidance | — | — | End 2035 |
| Singapore critical infrastructureAsia Pacific | Official guidance | 31 Mar 2027 | 1 Jan 2028 | 31 Dec 2031 |
| South KoreaAsia Pacific | Announced target | — | End 2030 | End 2035 |
| Taiwan financial sectorAsia Pacific | Official guidance | End 2027 | End 2029 | End 2035 |
| ThailandAsia Pacific | Announced target | — | End 2030 | — |
| Israel banking sectorMiddle East | Mandatory requirement | 7 Jan 2026 | — | — |
| Saudi Arabia financial institutionsMiddle East | Mandatory requirement | Q4 2026 | Q1 2027 | — |
| G7 financial sectorInternational | Official guidance | — | — | End 2035 |
| Public TLS certificatesInternational | Mandatory requirement | 15 Mar 2026 | 15 Mar 2027 | 15 Mar 2029 |
| Major technology vendorsInternational | Official guidance | — | — | End 2029 |
Research coverage and boundariesLast reviewed September 2026
Quelea separates mandatory requirements, official guidance and announced targets, and links to the issuing source wherever available.
Inventory, planning and governance requirements remain relevant without a calendar deadline.
China · Indonesia · Philippines · Vietnam · Egypt · Kuwait · Oman · Qatar · Turkey · PCI Security Standards Council · Basel Committee / FSB / IOSCO · SWIFT
This page supports readiness conversations. It is not legal advice, and inclusion does not establish that a requirement applies to a particular organisation.
THE COMMON STARTING POINT
Readiness follows a common path.
Across the published material, readiness repeatedly begins with knowing the cryptographic estate, understanding exposure and turning that evidence into an owned migration plan.
Discover
Find externally exposed cryptography and establish the initial scope.
Inventory
Record algorithms, certificates, protocols, systems and dependencies.
Assess
Relate cryptographic exposure to data lifetime, criticality and regulatory risk.
Prioritise
Identify high-risk use cases, legacy blockers and supplier dependencies.
Plan and monitor
Assign ownership, sequence migration and preserve evidence of progress.
FOR ADVISORY AND MANAGED SECURITY PARTNERS
Guide clients through regional PQC requirements and deadlines.
Quelea gives partners a consistent evidence layer for discovery, assessment, prioritisation and ongoing validation across client portfolios.