PQC Regulatory Deadlines (Probably) Don’t Apply To You

Most discussions of quantum migration lay out 2030/2031 as the deadline for migration. These dates show up in multiple regulations as various jurisdictions largely agree on when organizations should swap out vulnerable classical public-key cryptography for quantum resistant variants.

While the dates are useful for creating a sense of urgency, most companies aren't legally bound by them. And, in many cases, they're likely creating a false sense of security.

Who the Regulations Actually Affect

Several countries have enacted regulations stating that organizations must migrate to post-quantum cryptography (PQC), but their scopes are very narrow. These regulations and their affected parties include:

• US EO 14412: In the US federal agencies and contractors are required to abide by the 2030 deadline for encryption and 2031 for digital signatures. Critical infrastructure organizations get assistance from CISA for planning migration but aren't similarly bound.
• EU Coordinated Roadmap: EU member states are explicitly called out to migrate by the deadline, and NIS2 extends this to critical infrastructure and their supply chains. Other EU businesses are not covered by the law.
• UK NCSC: The guidance issued by the UK NCSC covers all UK organizations. However, this is guidance on timelines but not a binding order.

In reality, a small subset of organizations are directly bound by these laws; however, the requirements can cascade down their supply chains. If their procurement contracts include language about PQC migration, other organizations providing products or services to them also must comply if they want to compete for those contracts.

Where the Real Deadline Comes From

The 2030/2031 deadline provides a useful reference number for organizations wondering when they should complete their quantum migration. However, it's not universally applicable and likely overstates how long organizations really have to manage their quantum risk exposure.

The real reason for organizations to migrate to PQC is harvest now, decrypt later (HNDL) attacks, where data collected today is decrypted when cryptographically-relevant quantum computers (CRQCs) become available. To manage HNDL risk, organizations need to migrate before the point where data lifetimes fall on/after Q-Day.

Currently, we don't know when Q-Day will fall, but it's getting closer quickly. For a growing number of organizations, it's already too late to eliminate HNDL risk exposure. For healthcare organizations with a 20-year data retention requirement and data that never expires, it's probably already too late.

When planning and prioritizing quantum migration, regulatory deadlines are one consideration, but not the only one or even the most pressing. To map out when your organization should be planning to migrate to PQC, check out the Building a CBOM for Quantum Migration report.

Educational content, not legal, financial, investment, or professional security advice. Terms