Post-Quantum Deadlines: What NIST, the NSA, the UK and the EU Expect

Replacing encryption across an organisation takes years, and data stolen today can be decrypted later. So governments work backwards: they set target dates that make sure systems are upgraded well before the risk becomes real.

In November 2024, NIST published a draft transition plan, NIST IR 8547. It proposes that widely used quantum-vulnerable algorithms offering 112-bit security, such as RSA-2048, be deprecated after 2030, and that all quantum-vulnerable public-key algorithms be disallowed after 2035. Deprecated means allowed but discouraged; disallowed means no longer acceptable for US federal use.

For national security systems, the NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), announced in 2022, sets faster targets:

The overall US goal, set in National Security Memorandum 10 (2022), is to protect national security systems against quantum attack by 2035.

In March 2025, the UK National Cyber Security Centre published three milestones:

• ◆By 2028: define migration goals, complete discovery of where cryptography is used, and build an initial plan.
• ◆By 2031: complete the highest-priority migrations and refine the plan.
• ◆By 2035: complete migration to post-quantum cryptography across all systems.

In April 2024, the European Commission recommended that EU member states coordinate a common post-quantum roadmap. The resulting roadmap, published in June 2025, asks member states to start transitioning by the end of 2026, protect high-risk systems by 2030, and migrate as many systems as feasible by 2035.

Most of these rules apply directly to government systems. But suppliers to government, banks, telecoms firms and anyone whose customers ask about quantum risk will feel them too.