Remember the Y2K bug?
For all the dire predictions of planes falling out of the sky, banking systems collapsing and widespread disruption, the millennium arrived with relatively little drama.
Some subsequently dismissed the whole thing as an expensive damp squib. Of course, that rather overlooks the years of work and substantial investment that went into preventing those problems.
Post-quantum cryptography (PQC) has some similarities. We know there's a problem to address, even if we don't know precisely when the threat will become critical. And resolving it will require years of work across technology, suppliers and organisations.
But there's an important difference.
Y2K had a fixed deadline and a reasonably well-defined technical problem. With PQC, we have neither the certainty of when sufficiently powerful quantum computers will arrive nor a simple, universally applicable technical fix.
If Y2K was a damp squib, I'd suggest PQC is rather more of a blue whale. And unlike Y2K, there won't be a convenient New Year's Day when we can declare the problem over.
There's also a familiar problem with long-term security risks.
We acknowledge them, add them to the risk register, perhaps commission a paper, and then return to the considerably more immediate problems demanding our attention.
Post-quantum cryptography has been particularly susceptible to this treatment.
For years, the discussion has revolved around when sufficiently powerful quantum computers might arrive, whether they could break existing encryption and which replacement technologies would eventually become available.
Interesting questions, certainly. But for many organisations, it's remained a problem for the next decade. Something for the researchers and cryptographers to worry about.
Those uncertainties have also provided convenient reasons for postponing difficult decisions.
But something has changed.
We now have internationally recognised standards, published migration roadmaps and dates against which organisations can begin planning.
And those dates are considerably closer than some people might think.
What's the actual risk?
Much of the public-key cryptography we rely on today depends on mathematical problems that conventional computers would take an impractically long time to solve.
A sufficiently powerful quantum computer could solve some of those problems much more efficiently, potentially undermining the cryptography used to secure internet connections, authenticate systems and verify digital signatures.
For example, an attacker might eventually decrypt sensitive communications captured years earlier, impersonate a trusted system or forge digital signatures used to verify software updates.
That doesn't mean all encryption suddenly becomes useless. But some of the mechanisms we rely on to establish trust and protect information will need replacing, often in systems designed to operate for decades.
The question is no longer simply whether this might happen. It's whether we'll have completed the necessary changes before it matters.
The countdown has already started
In August 2024, the US National Institute of Standards and Technology (NIST) finalised its first three post-quantum cryptographic standards.
They provide new approaches to establishing secure communications and creating digital signatures, designed to resist attacks from future quantum computers.
The algorithms have rather boring names — ML-KEM, ML-DSA and SLH-DSA — but that's largely a matter for the cryptographers and engineers implementing them.
For the rest of us, the important point is that the standards exist.
Waiting for the standards to be published is no longer a particularly convincing reason for doing nothing.
Then, in June 2025, EU Member States adopted a coordinated roadmap for moving towards post-quantum cryptography.
The roadmap calls for Member States to begin transitioning by the end of 2026, with high-risk use cases, including critical infrastructure, protected as soon as possible and no later than the end of 2030.
An important distinction: this is a coordinated policy roadmap, not a universal legal deadline requiring every European business to replace all its cryptography by 2030. Nevertheless, it's a clear indication of direction and an important consideration for organisations operating critical services or supplying those that do.
The UK has published its own timetable through the National Cyber Security Centre (NCSC).
The UK milestones are straightforward:
• 2028: Understand your cryptographic estate, identify the important dependencies and establish an initial migration plan.
• 2031: Complete the highest-priority migrations and develop a detailed plan for the rest.
• 2035: Complete the migration across systems, services and products. These are planning targets, rather than blanket statutory deadlines.
But they give us something useful: a timetable against which to assess whether we're doing enough.
This is becoming an international programme
And it isn't just Europe and the UK.
In June 2026, the United States issued new federal post-quantum migration requirements. High-value and high-impact federal systems have important milestones in 2030 and 2031, with wider migration targeted for completion by 2035.
Canada has established a similar timetable for its federal systems.
Australia has gone further in one respect, recommending that organisations cease using traditional vulnerable asymmetric cryptography by the end of 2030.
Singapore issued updated guidance in October 2026, setting a 2031 target for critical information infrastructure and encouraging other organisations exposed to quantum risk to complete migration by 2035.
Meanwhile, the G7 countries have begun coordinating their approach.
In January 2026, the G7 Cyber Expert Group published a roadmap intended to support the financial sector's migration. This was followed in June by joint guidance from the national cybersecurity authorities of all seven G7 countries, developed in collaboration with the European Commission.
That second publication is particularly interesting because it moves beyond discussing the quantum threat and addresses the practical work involved: governance, identifying cryptography, prioritising systems, budgeting, testing and managing the transition.
It reads rather like the foundations of a substantial enterprise technology programme.
Which, of course, is exactly what this is.
How are the major countries approaching it?
The following summarises the publicly documented positions as of October 2026. The dates aren't directly comparable: some are government requirements, others are technical recommendations or national planning targets.
The G7 countries
🇺🇸 United States — 2030 / 2031 / 2035 Federal requirements target post-quantum key establishment for designated high- priority systems by 2030, digital signatures by 2031 and wider migration by 2035. These aren't universal requirements for American businesses.
🇬🇧 United Kingdom — 2028 / 2031 / 2035 NCSC guidance targets discovery and planning by 2028, the highest-priority migrations by 2031 and overall completion by 2035.
🇨🇦 Canada — 2026 / 2031 / 2035 The federal roadmap requires initial departmental planning in 2026, high-priority migrations by 2031 and remaining federal migration by 2035.
🇩🇪 Germany — 2030 Germany's BSI recommends post-quantum protection by 2030 for systems with particularly high protection requirements. Germany also participates in the EU roadmap.
🇫🇷 France — EU 2030 target ANSSI has published technical guidance on post-quantum cryptography since 2022, emphasising controlled migration and hybrid approaches. France participates in the EU's 2030 high-risk transition programme.
🇮🇹 Italy — EU 2030 target
Italy participates in the EU roadmap and the G7's joint migration initiatives. Its cybersecurity authority, ACN, supports the G7 guidance. No separate universal national completion deadline has been established here.
🇯🇵 Japan — 2035 planning horizon Japan is developing government migration plans and participates in the G7 programme. A 2035 government migration horizon has been reported, but it shouldn't be mistaken for a universal private-sector deadline.
Other major jurisdictions 🇪🇺 European Union — 2026 / 2030 The coordinated roadmap calls for transition activities to begin by the end of 2026 and high-risk use cases, including critical infrastructure, to be protected by the end of 2030. This is not a blanket legal deadline for every business.
🇦🇺 Australia — 2030 ASD recommends transitioning away from quantum-vulnerable traditional asymmetric cryptography by 2030, with specific government security and procurement requirements.
🇸🇬 Singapore — 2027 / 2031 / 2035 Migration planning is encouraged by 2027, with critical information infrastructure targeted for 2031 and other quantum-exposed organisations encouraged to complete migration by 2035.
🇨🇳 China — No verified national deadline China is investing in post-quantum algorithms, domestic cryptographic research, evaluation and migration technology. However, no comparable publicly applicable national migration deadline has been verified.
The important point isn't that everybody has adopted identical deadlines. They haven't. It's that 2030–2031 is increasingly appearing as a target for critical or high-priority systems, while 2035 is emerging as a broader migration horizon.
For multinational organisations, this is becoming a global technology transition rather than a collection of unrelated national initiatives.
These are not equivalent legal requirements. Some apply to federal government systems, some are technical recommendations, and others are national or regional planning targets.
China also deserves a distinction. Its State Cryptography Administration has funded work on post-quantum algorithms, cryptographic evaluation and tools for identifying vulnerable implementations. That includes mechanisms for migrating existing Chinese and international public-key algorithms.
But a research programme, however substantial, isn't the same thing as a published migration timetable.
The most interesting pattern isn't that everybody has adopted identical rules.
It's that 2030–2031 is increasingly appearing as the horizon for important systems, while 2035 is emerging as a broader planning target.
For multinational organisations, particularly those supplying governments, financial institutions and critical infrastructure, these different national initiatives will increasingly influence product roadmaps, procurement and customer expectations.
The G7 is worth paying attention to
There's another reason I think the G7 work matters.
The financial-sector roadmap explicitly recognises that institutions depend on interconnected technology providers and other third parties.
It also acknowledges that migration activities won't necessarily happen in a neat sequence. Discovery, testing, procurement, redesign and supplier engagement may need to run in parallel.
The roadmap itself doesn't establish new regulatory obligations. Neither does the G7's joint technical guidance override national requirements.
But they provide a useful shared framework for organisations operating across multiple jurisdictions.
For a multinational technology supplier, a more coordinated approach may eventually be considerably easier to manage than seven substantially different national requirements.
For customers, it also provides something against which to assess a supplier's preparedness.
Five years isn't very long
The NCSC estimates that large organisations may need two to three years just for discovery, assessment and initial planning.
That's before much of the actual migration has taken place.
Consider what that means in practice.
An organisation beginning its discovery work in late 2026 might still be developing its initial migration plan in 2028 or 2029.
Its highest-priority systems may need to be addressed by 2030 or 2031, depending on which guidance and requirements apply.
That doesn't leave a great deal of time for procurement, architectural changes, testing, supplier negotiations or the inevitable complications that emerge once implementation begins.
And anyone who has delivered a substantial enterprise technology programme will recognise the problem.
Projects that look straightforward at the outset have a habit of discovering dependencies nobody knew existed.
There's also some recent evidence that government agencies themselves aren't finding this particularly easy.
In October 2026, the US Government Accountability Office published an assessment of 24 major federal agencies' preparation for post-quantum migration.
None had fully addressed all three preparatory practices examined by the GAO: maintaining appropriate cryptographic inventories, identifying the funding required and testing post-quantum technologies.
The underlying report resulted in 89 recommendations to 23 agencies.
It's a useful reminder that publishing a deadline doesn't automatically create the people, resources, inventories or technical capabilities necessary to meet it.
This isn't simply a matter of updating a few encryption settings.
First, find out what you've actually got
Cryptography is embedded throughout an organisation's technology.
It protects communications, authenticates systems and users, supports digital signatures, verifies software and helps establish trust between services.
Some of it is easy to identify.
Some is buried in applications, network appliances, operating systems, hardware, industrial equipment and third-party services. And some may have been implemented years ago by people who have long since moved on.
Before deciding what to replace, we need to know what's actually being used. That sounds obvious.
But I've worked in enough established technology environments to be cautious about assuming that an accurate inventory exists simply because there's an asset management system.
An inventory of servers and applications isn't necessarily an inventory of cryptography.
We need to understand which systems depend on potentially vulnerable public-key algorithms, which business services they support and what would be involved in changing them.
We also need to distinguish between systems that handle information requiring long-term protection and those with much shorter confidentiality requirements.
Not everything presents the same risk, and not everything needs replacing immediately.
That's where a sensible migration programme starts.
The suppliers may be the difficult part
Much of the cryptography used by an organisation isn't directly under its control.
It comes from operating systems, cloud services, SaaS products, network equipment, security appliances, payment platforms and countless other technologies.
A supplier may have excellent security credentials and a mature information security management system.
But does it have a credible plan for supporting post-quantum cryptography?
Will the existing product support the new algorithms? Will it need a firmware update, a major software upgrade or entirely new hardware?
Will support arrive before the organisation's migration deadline? And what happens if the product is approaching the end of its supported life?
These are reasonable questions to ask now, especially when entering into new technology contracts or planning major replacements.
There's little sense in investing in equipment with a seven- or ten-year operating life without understanding whether it can support the cryptography we'll need during that period.
And that introduces a question for investment decisions being made today.
Are we about to purchase systems that will still be operating in 2035, but cannot support the cryptography we'll need by then?
We don't necessarily have to replace those systems now. But we should know whether they'll be upgradeable before we commit to buying them.
Of course, not every supplier will have all the answers today. Standards and implementations are still developing.
But there's a difference between not having a final release date and not having considered the issue at all.
For a critical supplier, I'd want to understand its direction, its dependencies and how it intends to support customers through the transition.
And then there's the familiar problem of suppliers depending on other suppliers.
A service might be quantum-ready in principle, but what about the underlying infrastructure, identity service, hardware security module or certificate authority?
The more complex the service, the more important those dependencies become.
A supplier's assurances may be entirely sincere. That doesn't necessarily mean every component of the service is ready.
But quantum computers haven't broken RSA yet
We don't currently have a publicly demonstrated quantum computer capable of breaking widely deployed RSA or elliptic-curve cryptography at the scale required.
Yet. And predicting when one might become available remains difficult.
I don't think it helps to present speculative dates as certainties.
But the argument that we should wait until such a machine exists overlooks two problems.
The first is harvest now, decrypt later. An attacker may collect encrypted information today in the hope of decrypting it when sufficiently powerful technology becomes available.
That matters particularly where information needs to remain confidential for many years. By the time the attacker can decrypt it, changing the encryption on our systems won't protect the information they've already collected.
The second problem is migration time.
Even if we knew precisely when a capable quantum computer would arrive, that wouldn't necessarily give us enough time to replace the cryptography embedded across a large organisation.
The question isn't simply when the threat becomes technically possible.
It's whether we can complete the necessary changes before it becomes relevant to the information and services we're responsible for protecting.
That's a rather different question.
What should the CISO actually do?
I don't think every CISO needs to become a cryptographer, or establish a large standalone quantum security programme tomorrow.
For many smaller organisations, much of the transition will arrive through normal software and service upgrades.
But larger organisations, particularly those with bespoke applications, long-lived hardware, critical infrastructure or complex supplier relationships, need a more deliberate approach.
I'd concentrate on five things.
Understand the exposure. Establish where vulnerable public-key cryptography is being used and which business services depend on it. Prioritise what matters. Identify critical services and information requiring long- term confidentiality. The business needs to help determine those priorities. Engage suppliers. Understand their migration plans, likely upgrade requirements, dependencies and commercial implications. Build cryptographic agility. Where possible, design systems so that algorithms and implementations can be changed without rebuilding everything around them. Establish ownership and funding. Make this part of the technology and security roadmap, with accountable owners and realistic investment decisions. None of these is particularly exotic.
Indeed, most are things we should already be doing as part of good technology governance.
Post-quantum migration simply makes the consequences of not doing them rather more obvious.
And I wouldn't advocate buying expensive products merely because a vendor has attached quantum-safe to its marketing material. Understand what the product actually supports, whether its implementation is based on established standards, and how it fits into the wider architecture.
There will be plenty of opportunities to spend money on this transition.
That doesn't mean every opportunity will be worthwhile.
The deadline isn't when we start
What interests me most about post-quantum cryptography isn't the mathematics.
It's the scale of the organisational change required. We need to understand technologies and dependencies that may not have been examined for years, coordinate with suppliers, make investment decisions and replace components without disrupting the business.
And we need to do it across a technology landscape that continues to change while we're working on it.
The EU's 2030 target for high-risk use cases is significant. So are the UK, US and Canadian milestones, Australia's earlier technical recommendations and Singapore's recently published timetable.
Not every country has the same obligations. China illustrates a different approach, with substantial research and standardisation work but no comparable published national migration deadline.
Nevertheless, the international direction is becoming clear.
None of this means every organisation must replace everything immediately.
But equally, a 2035 completion target shouldn't be interpreted as permission to begin planning in 2034.
For many organisations, the sensible first step isn't to buy new technology.
It's to understand what they have, what matters and who they're dependent upon.
The quantum computer may not have arrived yet.
The migration programme has.
Further reading and technical references
I've kept the main article accessible to readers without a cryptography background. The following sources provide the detailed national positions, standards and practical guidance.
International and G7
1. G7 Cybersecurity Working Group — Preparing for a Post-Quantum Cryptography Migration (June 2026) Particularly useful for CISOs, technology leaders and programme managers. A joint publication from the national cybersecurity authorities of Canada, France, Germany, Italy, Japan, the UK and US, developed with the European Commission.
Covers governance, budgeting, cryptographic inventories, prioritisation, cryptographic agility, testing and implementation.
4. UK NCSC — Timelines for Migration to Post-Quantum Cryptography (2025) The best starting point for a UK CISO. Sets out the 2028, 2031 and 2035 milestones and explains why the transition requires several years of discovery, planning and implementation.
https://www.ncsc.gov.uk/whitepaper/next-steps-preparing-for-post-quantum-cryptographyEuropeanUnion
6. European Commission / NIS Cooperation Group — Coordinated Implementation Roadmap (June 2025) For European operations and critical infrastructure. Sets out the coordinated EU migration approach, including its 2026 commencement and 2030 high-risk milestones.
7. NIST — First Three Finalised Post-Quantum Cryptography Standards (August 2024) For security engineers, product teams and those evaluating implementations. Introduces FIPS 203, 204 and 205: ML-KEM, ML-DSA and SLH-DSA.
https://pages.nist.gov/nccoe-migration-post-quantum-cryptography/Canada
12. Canadian Centre for Cyber Security — Government of Canada PQC Migration Roadmap (2025) One of the clearest national implementation plans. Includes departmental planning, progress reporting, procurement considerations and milestones for 2031 and 2035.
13. BSI — Technical Guideline TR-02102-1: Cryptographic Mechanisms For technical standards and algorithm selection. Germany's cryptographic recommendations, including quantum-resistant mechanisms, suitable security parameters and periods of recommended use.
14. ANSSI — Cryptographie Post-Quantique For France's national approach and current technical position. Provides an overview of ANSSI's programme, migration approach, standards considerations and supporting publications.
16. Banca d'Italia — G7 Financial-Sector PQC Roadmap (January 2026) For Italy's participation in the international financial-sector programme.
Describes the G7 initiative and its development through work involving the Italian G7 Presidency and Banca d'Italia.
18. G7 Cybersecurity Working Group — Joint Migration Statement (June 2026) Japan's National Cybersecurity Office participated in the joint publication, providing a government-backed reference for preparing migration programmes.
20. Australian Signals Directorate — Guidelines for Cryptography, Information Security Manual (2026) For technical teams and government suppliers. Sets out ASD-approved cryptographic mechanisms, post-quantum transition requirements and controls relevant to procurement and migration planning.
Includes practical planning milestones, prioritisation and implementation considerations.
https://www.cyber.gov.au/publication/planning-for-post-quantum-cryptographySingapore
22. Cyber Security Agency of Singapore — Quantum-Safe Migration Advisory (14 October 2026) An especially useful recent source. Establishes preparation guidance and the 2031 target for critical information infrastructure, with 2035 encouraged for other organisations exposed to quantum risk.
24. State Cryptography Administration — National Cryptography Science Fund, Second Round (January 2026) For China's publicly documented research priorities. Includes post-quantum algorithms, migration agility, evaluation techniques and tools for identifying quantum-vulnerable cryptographic implementations.
Official Chinese-language source:
Official Chinese-language source:
Official Chinese-language source:
Personal commentary. Views are the author’s own.