Deadlines guide · updated 2 November 2026

Post-quantum migration deadlines

NIST will deprecate RSA and elliptic-curve cryptography after 2030 and disallow them after 2035. The final report came out on 27 October 2026. US government and EU high-risk systems must move sooner, and the UK wants discovery finished by 2028.

Read the guide Run Quantum Core

Post-quantum clockt = live

2030

NIST deprecates2035 disallowedharvest nowX + Y > Z

The dates side by side

Authority	Date	What has to happen
US NSS (CNSS, NSA)	1 Jan 2027	CNSA 2.0 algorithms required in new national security system acquisitions
UK NCSC	2028	Goals set, full discovery done, initial migration plan built
EU roadmap	End of 2026	All Member States should start transitioning
US federal (OMB M-26-15)	2 Jan 2030	Support TLS 1.3
NIST IR 8547	After 2030	Quantum-vulnerable public-key cryptography deprecated
US federal, high value and high impact	31 Dec 2030	Post-quantum key establishment
US NSS	31 Dec 2030	Equipment that cannot support CNSA 2.0 phased out, unless granted an exception
EU roadmap	End of 2030	High-risk use cases moved to post-quantum cryptography
UK NCSC	2031	Highest-priority migration done, roadmap refined
US federal, high value and high impact	31 Dec 2031	Post-quantum digital signatures
US NSS	31 Dec 2031	CNSA 2.0 mandated for full quantum resistance
NIST IR 8547, UK NCSC	After 2035, by 2035	Disallowed under NIST standards; UK migration complete

These bind different people. NIST's dates govern NIST standards and US federal use, and CNSA 2.0 covers US national security systems. The UK dates are guidance. In practice they reach suppliers first, through procurement. Summaries of the EU roadmap add 2035 for medium-risk use cases, though the Commission's own page names only the 2026 and 2030 milestones.

What changed in the final NIST report

NIST states it will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035. It says the window between those dates exists for lower-risk systems with legacy constraints, and it does not relax the earlier federal deadlines. Reports on the final text note that the 2024 draft applied the 2030 date only to 112-bit parameter sets, so RSA-3072 and P-256 now move earlier than the draft implied.

Why the order matters

NIST's report separates two risks, and many migration plans blur them.

Encryption and key establishment come first. Adversaries can record traffic now and decrypt it once a large quantum computer exists. NIST calls this harvest now, decrypt later. Anything that must stay secret for years is already exposed to it.

Signatures carry a different risk. NIST says signatures are not vulnerable to harvest now, decrypt later, and an authentication system stays secure as long as the algorithm is secure when it is used. They are still urgent, because the change takes longer and needs more parties to coordinate. Firmware needs particular care: a device that cannot update its verifier must ship with quantum-resistant signatures from the start.

Mosca's rule, which NIST cites, gives a quick test. If data must stay secure for X years and migration takes Y years, you need to start before X + Y exceeds Z, the time until a cryptographically relevant quantum computer exists. With 10-year data and a 5-year migration, you are already late if Z is under 15 years.

Are hybrids allowed?

Yes. NIST will accommodate hybrid key establishment and dual signatures in FIPS 140 validation when suitably combined with an approved scheme, and its generic composite technique is allowed even if one input comes from a disallowed algorithm. NIST also warns that hybrids add complexity and are usually a temporary step to a second transition.

What to do first

NIST tells organisations to begin with cryptographic inventories, and the NCSC's first milestone is full discovery. You cannot plan around cryptography you have not found. A cryptography bill of materials is the usual format for that record. Quantum Core scans a repository locally and produces one, with the exposure counted by file.

When does RSA stop being allowed?

Under NIST standards and guidelines it is deprecated after 2030 and disallowed after 2035, regardless of key size according to reports on the final text. Stricter dates apply to some US government systems.

Do these deadlines apply to private companies?

Not directly in most cases, but suppliers to government and regulated sectors can expect them in contracts.

Is a quantum computer able to break RSA today?

No. NIST says no cryptanalytically relevant quantum computer exists yet. The deadlines reflect how long migrations take and the harvest now, decrypt later risk.