Regional Mandates

Standards become obligations through national authorities — and they do not all say the same thing. The US mandates specific algorithms outright (chiefly for federal and national-security systems, with critical-infrastructure operators being directed to migrate rather than every industry being mandated today); Germany and France insist on hybrid deployment; the UK and EU set roadmaps. The recurring deadlines to plan around are roughly 2030 (deprecate RSA/ECC) and 2035 (disallow them).

The headline deadlines

Across jurisdictions, two dates dominate planning. Around 2030, classical RSA/ECC begins to be deprecated; by 2035, it is to be disallowed for protected systems. These come most explicitly from US guidance (NIST IR 8547) and are echoed in the UK roadmap and EU recommendation. See Timeline.

By jurisdiction

USA — mandate-driven

The US is the most prescriptive. The NSA's CNSA 2.0 advisory (updated 30 May 2025) names exact algorithms and parameter sets — ML-KEM-1024, ML-DSA-87, the stateful hash-based LMS/XMSS (per SP 800-208), plus AES-256 and SHA-384/512. Its CNSA 2.0 FAQ sets staged milestones: software and firmware signing exclusive by 2030; networking equipment preferred by 2026 and exclusive by 2030; web browsers, servers and cloud services supporting CNSA 2.0 by 2025 and exclusive by 2033. NSM-10 (4 May 2022) set the national direction, OMB M-23-02 (18 Nov 2022) drove inventories, the joint CISA/NSA/NIST "Quantum-Readiness: Migration to PQC" factsheet (21 Aug 2023) and NCCoE SP 1800-38 give practical guidance, and NIST IR 8547 (initial public draft Nov 2024) defines the deprecate-then-disallow timeline for RSA/ECC. In June 2025, Executive Order 14306 amended the earlier EO 14144: it dropped the near-term mandatory PQC procurement triggers but retained the requirement that CISA publish a list of PQC product categories by 1 December 2025 — which CISA subsequently published and maintains — and the goal of TLS 1.3 (or a successor) by 2030.

On 22 June 2026, the US issued Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks", which further establishes as national policy the migration of federal information systems to NIST-approved FIPS PQC and directs support for critical-infrastructure owners and operators in their migration. It sets deadlines: encryption migration for the most sensitive federal systems by the end of 2030, authentication migration by the end of 2031, and federal contractors to comply with PQC FIPS by the end of 2030. It should be read alongside NSM-10, OMB M-23-02, CNSA 2.0, NIST IR 8547 and EO 14306.

Germany and France — hybrid first

European regulators are notably more cautious and both center on hybrid. Germany's BSI (TR-02102-1, current version 2026-01) is conservative: it recommends ML-KEM but also keeps FrodoKEM, Classic McEliece and HQC in view, recommends ML-DSA, SLH-DSA, LMS-HSS and XMSS for signatures, and strongly recommends pairing PQC with classical cryptography. France's ANSSI (position paper of 4 Jan 2022, with an 11 Oct 2023 follow-up) takes a phased, hybrid-first / defense-in-depth line — requiring hybrid for both KEMs and signatures — and regards PQC-only deployment as premature; its published roadmap is Phase 1 hybrid now, Phase 2 from around 2025, and optional PQC-only from around 2030. In June 2026, ANSSI sent a further procurement and certification signal: from 2027 it will no longer certify security products that lack quantum-safe encryption, and it is pushing enterprises to procure quantum-safe products by 2030. This is a recent regulatory-enforcement development and should be understood together with ANSSI's existing technical line of hybrid-first, with PQC-only possible only after 2030. If you operate in the EU, plan for hybrid as the baseline, not an option.

UK and EU — roadmaps

The UK's NCSC published "Timelines for migration to post-quantum cryptography" (Mar 2025), setting three checkpoints: by 2028, discovery and a migration plan; by 2031, highest-priority migrations complete; by 2035, migration complete. At the EU level, Recommendation (EU) 2024/1101 (11 Apr 2024) establishes a Coordinated Implementation Roadmap, followed by the NIS Cooperation Group PQC roadmap (Jun 2025) — which calls for national strategies by end-2026, high-risk critical infrastructure migrated by 2030, and medium-risk systems by 2035 — and ENISA PQC studies, harmonizing direction without dictating a single algorithm set.

China

China runs its commercial cryptography regime under the regulatory framework of the State Cryptography Administration (SCA / 商密). In 2025, domestic bodies launched a next-generation, quantum-resistant cryptographic algorithm call; as of now there is no formal commercial-cryptography PQC standard equivalent to NIST FIPS 203/204/205. (The CACR ran an earlier national post-quantum competition, 2018–2020.) This track is covered separately in China Overview.

Standards & references

• UK NCSC — Timelines for migration to post-quantum cryptography (Mar 2025)
• USA — NSA CNSA 2.0 algorithms advisory and FAQ (updated 30 May 2025); White House NSM-10 (4 May 2022); OMB M-23-02 (18 Nov 2022); CISA/NSA/NIST "Quantum-Readiness: Migration to PQC" factsheet (21 Aug 2023); NCCoE SP 1800-38; EO 14306 (Jun 2025); EO 14412 "Securing the Nation Against Advanced Cryptographic Attacks" (22 Jun 2026); NIST IR 8547
• Germany — BSI TR-02102-1 (current version 2026-01)
• France — ANSSI position paper on the migration to PQC (4 Jan 2022) and follow-up (11 Oct 2023)
• EU — Recommendation (EU) 2024/1101 (11 Apr 2024); NIS Cooperation Group PQC roadmap (Jun 2025: end-2026 / 2030 / 2035); ENISA PQC studies