Policy & Security

Every Post-Quantum Deadline in One Table

Key exchange carries a 2030 deadline in the US; the EU recommends transitioning high-risk use cases to PQC by the end of 2030; signatures get 2031; 2035 is the outer fence. Each date quoted from the issuer, with what harvest now, decrypt la

Gabriele Masetti · 2026-10-22

Two Clocks Instead of One Date

Most summaries of the post-quantum calendar quote a single year, 2035. The issuers' own texts say something different. Key exchange, the part of cryptography that protects data against recording, carries a 2030 deadline in the United States, the European Union and a 21-state European statement. Digital signatures carry 2031 in Washington, and London and Singapore also put a broader migration milestone in 2031.

The calendar runs on two clocks. The first is set by how long encrypted data must stay secret, and it is already running because of "harvest now, decrypt later". The second is set by how long it takes to replace certificates, firmware and signing keys, and 2035 is the outer fence for everything left over, though for low-risk use cases the EU roadmap asks only for completion "as much as feasible". Reading any deadline correctly means asking which clock it measures and who, if anyone, is bound by it.

Every Deadline in One Table

Each row uses the issuer's own wording or its closest paraphrase. "Binds" means the text creates an obligation for its addressees. A recommendation, a draft or a goal is marked as such.

The rows fall into three families: standards that carry no calendar, government schedules, and a company that chose its own date.

What NIST Standardised and What It Only Drafted

NIST finalised three standards on 13 August 2024: FIPS 203 for key encapsulation, FIPS 204 for signatures and FIPS 205 for hash-based signatures. The algorithms are known as ML-KEM, ML-DSA and SLH-DSA. The standards set no deadline. NIST's own announcement quoted the head of its post-quantum project, Dustin Moody, saying "We encourage system administrators to start integrating them into their systems immediately, because full integration will take time."

The calendar comes from a separate document, NIST IR 8547, published in draft on 12 November 2024. Its tables mark RSA and elliptic-curve schemes at 112 bits of security strength "Deprecated after 2030" and every quantum-vulnerable scheme "Disallowed after 2035". The page still lists IR 8547 as an initial public draft, and it gives no date for a final version.

The 2030 date therefore applies only to the weakest parameter sets in the draft, while 2035 applies to all of them. Agencies that cite the draft as if it were final are treating a proposal as a rule. A final IR 8547 could still change either year.

Where the Number 2035 Came From

Almost every national schedule traces back to a single sentence in a 2022 White House memorandum. The memorandum, NSM-10, was signed on 4 May 2022.

the United States must prioritize the timely and equitable transition of cryptographic systems to quantum-resistant cryptography, with the goal of mitigating as much of the quantum risk as is feasible by 2035.

— The White House, National Security Memorandum 10 (4 May 2022)

The EU roadmap says so openly. Its text justifies the 2035 milestone by pointing to the NIST draft ("traditional public-key cryptographic mechanisms will be disallowed after 2035"), to NSM-10's goal, and to the UK NCSC timeline. Japan's interim report of November 2025 gives the same reasoning in Japanese: most countries, including the United States, the EU, the United Kingdom and Canada, have set 2035 as the limit, so Japan too should aim for 2035.

Later texts cite earlier ones, so 2035 works as a coordination point that was chosen once and then borrowed. The UK's own reasoning is more mechanical: the NCSC argues that 10 years is a sufficient period for standards to appear, products to be built and uptake to become widespread. The EU roadmap does, however, factor the estimated time until a cryptographically relevant quantum computer will be available into its transition dates.

Why Harvest Now, Decrypt Later Pulls Key Exchange Forward

"Harvest now, decrypt later" means an adversary records encrypted traffic today and waits for a machine that can open it. The recording is within reach of well-resourced actors and the attack happens later, so the damage is done before any quantum computer exists. The White House order states the policy plainly: it warns of "adversaries collecting United States information now, and decrypting it later once large-scale quantum computers are operational."

That changes how a deadline should be computed. Take a record that must stay confidential until 2045 and a network that needs six years to migrate. The relevant date is the moment the record was captured under quantum-vulnerable key exchange, since a later arrival of the quantum computer cannot undo the capture. Every year of delay adds recordings that no later migration can protect. The 2045 and six-year figures are an illustration of the logic and come from no issuer.

NIST's draft makes the same point for its own schedule, calling the threat "one of the main reasons why the transition to post-quantum cryptography is urgent". Singapore's handbook calls it "the immediate threat", and adds a caution: it notes "skepticism over the extent of HNDL attacks", since storing traffic at scale takes resources that sit "primarily within reach of motivated, well-resourced actors". The deadline logic holds for sensitive, long-lived data and weakens for everything else.

The 2030 Cluster for Key Exchange

Three texts land on the end of 2030 for the data that most needs protection from recording. They were written between November 2024 and June 2026. A joint statement first published in November 2024 by the BSI and partners from 17 other European states, and reissued on 27 June 2025 with partners from 21 European states, recommends that the most sensitive use cases "should be protected against ‘store now, decrypt later’ attacks as soon as possible, latest by the end of 2030."

The EU roadmap adopts the same date and goes further on method. For high-risk use cases it says quantum-vulnerable public-key mechanisms "shall not be used stand-alone after the end of 2030", which in practice means hybrid constructions that combine a classical and a post-quantum algorithm. The roadmap's first milestone is earlier: by 31 December 2026, every Member State has implemented the first steps and drawn up an initial national roadmap.

The United States reaches 2030 by a different route. Executive Order 14412, signed on 22 June 2026, orders OMB to require agencies to transition all high-value assets and high-impact systems to post-quantum key establishment by 31 December 2030. A proposed amendment to the Federal Acquisition Regulation is to require covered contractors to comply with NIST's post-quantum standards by the same day.

The 2031 Cluster for Signatures

A forged signature cannot be applied retroactively to a connection that is already over. ANSSI made this argument in January 2022: unlike the retroactive attack on encryption, the signature threat applies only to signatures generated once a cryptographically relevant quantum computer exists. Signatures verified on the fly, as in an authenticated channel, therefore cannot be hit before such a machine appears. Signatures with long validity, such as signed documents, are the exception ANSSI names.

Google's March 2026 post draws the same line: "The threat to encryption is relevant today with store-now-decrypt-later attacks, while digital signatures are a future threat that require the transition to PQC prior to a Cryptographically Relevant Quantum Computer (CRQC)." The order follows that split. Key establishment falls due on 31 December 2030 and digital signatures a year later.

(ii) transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030; (iii) transition all HVAs and high impact systems to use PQC for digital signatures by December 31, 2031; and

— The White House, Executive Order 14412 (22 June 2026)

OMB's implementing memorandum M-26-15, dated 24 June 2026, turns the two dates into phases. It sets "the objective of mitigating as much quantum risk as feasible by December 31, 2030", labels 2031 a "Signature Migration" phase, and places "Full Migration" in 2035. Agencies must submit a migration plan within 120 days of the memorandum, and the memorandum states that it "does not apply to national security systems."

The UK schedule has a different shape but a similar centre of gravity. The NCSC asks organisations to define migration goals and finish discovery by 2028, carry out the highest-priority migration by 2031, and complete everything by 2035. Singapore's handbook, dated 16 July 2026, asks owners of critical information infrastructure to submit a plan by 31 March 2027 and to finish by 31 December 2031, so that "vulnerable cryptography should no longer be used."

What Binds and What Only Recommends

Who is bound matters more than the dates. Executive Order 14412 and M-26-15 bind federal agencies, and the order reaches contractors through a rulemaking. The CNSA 2.0 requirements, as reported, bind owners and vendors of national security systems. The order excludes those systems from the OMB guidance and instead has the NSA director report to the President on their migration within 180 days.

Everything else in the table recommends. The EU roadmap is a set of recommendations to Member States, the NCSC timeline is guidance, and the 21-state joint statement uses "recommend". Japan's text is an interim report and NIST's IR 8547 is a draft. Singapore's handbook is the closest to a mandate, because it frames the 2027, 2028 and 2031 steps as requirements for the owners of critical information infrastructure.

An organisation in several jurisdictions can treat the strictest date as its working deadline. For a US federal agency that is 31 December 2030 for key establishment. For a European operator of critical infrastructure it is the end of 2030 for high-risk use cases, which the roadmap recommends and national law may later harden.

Company Dates Run Ahead of Governments

On 25 March 2026, Google announced: "We're setting a timeline for post-quantum cryptography migration to 2029." It gave three reasons for moving in light of progress in quantum hardware, in error correction and in estimates of the resources needed to factor large numbers. It also said it had adjusted its threat model to prioritise migration of authentication services, and that Android 17 integrates ML-DSA signatures.

Google's date is two years ahead of the 2031 signature deadlines and one year ahead of the 2030 key-exchange date. It is a commitment about Google's own systems and carries no obligation for anyone else. The post sets a migration timeline for the company, and it names hardware, error correction and factoring estimates as the reasons. What it adds to the table is a signal that a large operator, with control of its own browsers, servers and operating system, expects to finish before regulators require it.

Smaller organisations do not control that much of their stack. They depend on vendors, certificate authorities and standards bodies. The NCSC concedes the point by noting that a small set of rarely used technologies may find migration by 2035 more difficult.

How to Read the Table for Your Own Systems

Begin with the data. For each system, ask how long the information it protects must stay secret and whether its key exchange can be recorded by a third party. If the answer is more than a few years and yes, the 2030 clock applies, and the practical work is to turn on hybrid key exchange wherever the software supports it. The UK and US texts both pair the target date with an inventory step, since nobody can plan the migration of cryptography they have not found.

For signatures, the question is how long a key or certificate must be trusted. Firmware signing keys, root certificates and signed archives live for a decade or more, so they belong on the 2031 clock even though a forged signature is a future problem. Short-lived session signatures can wait for the platform vendors.

The dates will move. IR 8547 is still a draft, the EU roadmap expects later versions, and M-26-15 asks agencies to align with IR 8547 "or successor document". An organisation that holds a complete cryptographic inventory and a hybrid-capable stack can absorb a change of year; one without them has to start with the inventory.