The deadlines: who requires what, and when

Nobody knows when a cryptographically relevant quantum computer (CRQC) will arrive. Public estimates of the resources needed keep falling: Gidney and Ekerå estimated in 2019 that RSA-2048 could be factored in about eight hours with about 20 million noisy qubits, and Gidney's May 2025 estimate cut that to fewer than one million noisy qubits, in under a week. Those are resource estimates, not predictions of a date.

Regulators can't wait for certainty, so they set dates instead. This lesson collects the ones practitioners get asked about, says who they apply to, and flags which are firm and which are proposals.

First, some vocabulary

• Support and prefer (CNSA 2.0's phrase): products must offer the new algorithms and choose them when the other side can.
• Exclusive use: only the new algorithms. Classical ones are switched off.
• Deprecated (NIST usage): still allowed, but you are accepting risk and should be moving away.
• Disallowed: no longer approved for that purpose.

United States

NSM-10 (May 2022): the 2035 goal

National Security Memorandum 10 set the overall US goal: mitigate quantum risk "to the maximum extent feasible by 2035". Most later US documents hang off this date.

OMB M-23-02 (November 2022): inventories

The Office of Management and Budget directed federal civilian agencies to submit, by 4 May 2023 and every year after until 2035, a prioritized inventory of systems containing quantum-vulnerable cryptography to the Office of the National Cyber Director and CISA. It's the model for the inventory work in lesson 10.

Quantum Computing Cybersecurity Preparedness Act (December 2022)

Signed on 21 December 2022, this law directs OMB to guide federal agencies' migration to post-quantum cryptography. It applies to federal civilian IT, not national security systems.

NSA CNSA 2.0 (September 2022): the strictest clock

The National Security Agency's Commercial National Security Algorithm Suite 2.0 governs US national security systems: classified and mission-critical defense and intelligence systems, and the vendors who sell into them. It names the algorithms (ML-KEM-1024, ML-DSA-87, LMS or XMSS for software and firmware signing, AES-256, SHA-384 or SHA-512) and sets dates by product category:

Notice which categories come first. Software and firmware signing leads because signed code lives a long time in the field, and a device that can't verify a new signature can't be fixed by a later update. Networking equipment reaches exclusive use by 2030 too, which fits the fact that it protects traffic that can be harvested.

Even if you never sell to the US government, CNSA 2.0 matters: vendors of browsers, operating systems, VPNs and network gear tend to build one product for everyone, so its dates set the pace of what you can buy.

NIST IR 8547 (draft, November 2024): end dates for the old algorithms

NIST's Internal Report 8547, released as an initial public draft, proposes when the quantum-vulnerable algorithms leave the approved list:

• Quantum-vulnerable algorithms at the 112-bit security level, such as RSA-2048, would be deprecated after 2030.
• All quantum-vulnerable public-key algorithms (RSA, elliptic-curve and finite-field Diffie-Hellman and DSA, and so on) would be disallowed after 2035.

It is still a draft, and dates in drafts can move. But because FIPS-validated products and US federal procurement follow NIST's approved-algorithm lists, these dates are the ones many compliance teams plan against.

United Kingdom: NCSC (March 2025)

The UK National Cyber Security Centre published three milestones, aimed mainly at large organizations and critical national infrastructure:

• By 2028: define migration goals, carry out a full discovery exercise, and build an initial migration plan.
• By 2031: complete the early, highest-priority migrations and refine the plan into a full roadmap.
• By 2035: complete migration of all systems, services and products.

The NCSC also notes that for many smaller organizations, much of the migration will arrive through suppliers' normal upgrades.

European Union: coordinated roadmap (June 2025)

EU Member States, working with the European Commission, published a coordinated implementation roadmap. Its headline dates:

• All Member States should start transitioning to post-quantum cryptography by the end of 2026.
• High-risk use cases should be migrated as soon as possible and no later than the end of 2030.
• As many systems as feasible should be migrated by 2035.

All of it on one map

Filter by the authorities that apply to you. Everything below the "today" line is still ahead.

Binding, proposed or guidance?

Compliance teams need to know what kind of document they are holding:

If you're a private company outside these scopes, the dates still reach you through customers, auditors, cyber-insurance questionnaires and your own vendors' product cycles. "Not legally required yet" rarely means "nobody will ask".

What the dates mean for your role

Compliance and risk

Map which documents actually apply to you, directly or through customers. Track the status of drafts such as NIST IR 8547, because a final version may change dates. Auditors will increasingly ask for evidence of progress, and the natural evidence is the same everywhere: an inventory, a prioritized plan and a record of what has already moved.

Product and engineering

If your product will still be sold or supported in the 2030s, its cryptography is on a regulatory clock. Customers in government, defense, finance and critical infrastructure will ask about CNSA 2.0 or their national equivalent. Hardware designed now must be able to run the new algorithms later; software needs a release plan that adds them and, eventually, removes the old ones.

IT and security operations

Most of your migration arrives as upgrades: TLS libraries, operating systems, VPN firmware, browsers. Your job is to make sure upgrades happen, that new algorithms are switched on where they're optional, and that purchases made today won't be stranded by a 2030 or 2035 cut-off.

Three common misreadings

• "2035 is a long way off." It's the date the work must be finished. Equipment bought in the next few years will still be running then.
• "We're not a government agency, so none of this applies." Your suppliers' products follow these dates, and your customers' questionnaires will too.
• "We'll switch when a quantum computer is announced." Data recorded before that announcement is already exposed, and a migration of this size can't be done in a hurry.

Working backward from the deadline

Deadlines are the end of the work. Mosca's inequality (from lesson 6) says you're already late if the time your data must stay secret (X) plus the time your migration takes (Y) exceeds the time until a CRQC (Z). A deadline is a regulator's way of fixing Z for you.

How long does Y take? Cryptographic transitions are historically slow. The first public SHA-1 collision was demonstrated in February 2017, and NIST formally announced SHA-1's retirement in December 2022, with a phase-out deadline of 31 December 2030. The new transition touches far more systems.

A practical way to plan:

1. Pick the deadline that applies to you (2030 for the earliest CNSA 2.0 categories and EU high-risk uses; 2035 for most others).
2. Subtract hardware refresh cycles. A network appliance bought in 2027 may still be in service in 2035; it needs to support the new algorithms when you buy it.
3. Subtract procurement lead time. Contracts signed now should ask vendors for a post-quantum roadmap.
4. Subtract discovery. You can't plan what you haven't found, which is why the UK puts discovery first, by 2028.

For most organizations the arithmetic lands on the same answer: start the inventory now.

Questions

Get five of six right to mark the lesson complete. They also feed the final exam.

Sources

• NSM-10: Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems (May 2022)
• OMB M-23-02: Migrating to Post-Quantum Cryptography (November 2022)
• Quantum Computing Cybersecurity Preparedness Act, Public Law 117-260
• NSA: The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ
• NIST IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards
• UK NCSC: Timelines for migration to post-quantum cryptography
• European Commission: A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
• European Commission: Post-quantum cryptography policy page
• NIST: NIST Retires SHA-1 Cryptographic Algorithm (December 2022)
• Gidney: How to factor 2048 bit RSA integers with less than a million noisy qubits (2025)

Drawn byKyeson Blake Utley

CourseQuantum Defense

Sheet9 of 18

PartII · Practitioner

Rev.18 Oct 2026

Sources10 cited

Found an error?Send a correction