Cryptographic expectations are evolving. Explore official post-quantum guidance and relevant obligations—by jurisdiction, with the context that matters.
Select a highlighted country. Distinguish guidance from obligations. Understand what applies to you.
AVAILABLE JURISDICTIONSSELECTEDNATURAL EARTH / INDICATIVE GEOGRAPHY
YOUR JURISDICTION
United Kingdom
The UK has a national post-quantum migration roadmap, with recommended milestones for discovery by 2028, priority migration by 2031 and completion by 2035. These are not universal legal deadlines. The Cyber Assessment Framework supports risk-based cryptographic discovery and protection for essential services and government systems.
LAST REVIEWED9 NOVEMBER 2026
National roadmap established; discovery and planning phase. Migration targets are guidance, not statutory deadlines.
01 / OFFICIAL SOURCENon-binding national guidance
NCSC post-quantum migration roadmap
Define migration goals, discover cryptographic dependencies and build a plan; then migrate highest-priority systems and refine the roadmap before completing migration. These are indicative NCSC targets, not a legal mandate applying to every enterprise.
Who does this apply to?
Primarily technical decision-makers and risk owners in large organisations, critical national infrastructure operators including industrial control systems, and companies with bespoke IT. Core timelines are relevant to all organisations; commodity-IT SMEs generally migrate through vendor updates.
TIMING & APPLICABILITY
Recommended targets: discovery and initial plan by 2028; highest-priority migration and refined roadmap by 2031; completion by 2035. NCSC acknowledges some rarely used technologies may be harder to migrate by 2035.
02 / OFFICIAL SOURCEAssessment framework; not legislation
Cyber Assessment Framework: data security
Principle B3 calls for understanding essential-function data and protecting it in transit and storage, with justified confidence in cryptographic protection. It supports discovery and assurance evidence but does not itself create a statutory PQC migration obligation.
Who does this apply to?
Organisations supporting essential services or critical to UK security and prosperity. Used by operators of essential services under NIS regulations and by government through GovAssure; applicable assessment profiles depend on the sector or programme.
TIMING & APPLICABILITY
No PQC migration deadline specified in B3; sector and government assurance expectations must be checked separately.
Map cryptographic dependencies across services, products and suppliers, including certificates, protocols and long-lived sensitive data.
Prioritise valuable or long-lived data and difficult-to-upgrade IT/OT; fund a migration plan aligned with the NCSC's recommended milestones.
Obtain supplier PQC roadmaps and test interoperability and cryptographic agility before deployment.
Where CAF applies, retain evidence of data flows and cryptographic protection; confirm the relevant regulator or GovAssure profile separately.
Informational summaries, not legal advice. Guidance milestones are not universal legal deadlines. Applicability depends on your sector, systems and contracts. Confirm effective requirements with official sources and qualified advisers. Coverage is limited to the six jurisdictions shown; this is not a live legal-monitoring service.
03 /FROM POLICY TO POSTURE
The requirement is local. The evidence is connected.
A maintained cryptographic inventory helps you connect technical exposure to the obligations that actually apply to your organisation.
