The standards are set, and now the deadlines are arriving. A look at PQC roadmaps across Korea, the U.S., the EU, and Japan, and at how far global tech companies have gotten
"PQC mandate" has become a familiar phrase in South Korea's security news lately. In May, the government approved an amendment to the country's Quantum Technology Industry Act that requires the public sector to build quantum-safe security systems, and the law takes effect on November 20. Then in September, Korea's National Intelligence Service (NIS) unveiled a comprehensive plan for transitioning to post-quantum cryptography (PQC), naming 2029 as the year certain PQC algorithms become mandatory. PQC is no longer a research-lab topic in Korea. It's now something public institutions and their suppliers have to plan around, on a real schedule.
A few years ago, almost every conversation about PQC ended up at the same question: "So when are quantum computers actually going to show up?" That's no longer the question governments and major tech companies are asking. Instead of waiting to find out when a quantum computer might break today's encryption, they're asking when, and in what order, they should move the cryptography they already rely on over to PQC.
Korea isn't alone in this. Since NIST finalized the first PQC standards in 2024, the U.S., the EU, the U.K., Canada, and Japan have each published migration roadmaps, and companies like Google, Microsoft, AWS, Cloudflare, and Apple are already shipping PQC in production services. So where does the global PQC transition actually stand today?
If you'd like a quick primer on what PQC is and why it matters, start with Quantum Security Explained: Beginner's 11 FAQs on PQC.
At a glance ― Global PQC Migration Roadmap
It Started in August 2024 with NIST's PQC Standards
Any timeline of the global PQC transition starts on August 13, 2024. That's the day the U.S. National Institute of Standards and Technology (NIST) finalized its first three PQC standards.
- FIPS 203 — ML-KEM: Key establishment
- FIPS 204 — ML-DSA: Digital signatures
- FIPS 205 — SLH-DSA: Digital signatures
NIST said the standards were "ready for immediate use" and encouraged system administrators to begin transitioning as soon as possible. In March 2025, it selected HQC as a backup key encapsulation algorithm to complement ML-KEM, and FN-DSA (FIPS 206), based on Falcon, is currently in draft.
Before the standards existed, the PQC conversation was mostly about which algorithms to use. Once they were finalized, the question became how to actually deploy them in real systems. That's a much harder problem. Legacy cryptography is embedded in servers, network gear, applications, certificates, and security appliances, and none of it can be swapped out overnight. That's why the word that now defines PQC is migration.
United States: "Someday" Now Has a Date
In 2026, the U.S. introduced a policy that changed the weight of the conversation. On June 22, 2026, the President signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks."
The order makes it official U.S. policy to transition federal information systems to NIST-approved PQC standards. The direction itself wasn't new. What was new were the deadlines.
- Within 30 days: Each federal agency head designates a PQC Migration Lead
- Within 90 days: The Office of Management and Budget (OMB) issues migration guidance to agencies
- Launched within 180 days, completed by December 31, 2027: A PQC migration pilot on NIST's own systems
- By December 31, 2030: High Value Assets (HVAs) and high impact systems move to PQC for key establishment
- By December 31, 2031: The same systems move to PQC for digital signatures
One point is easy to misread. This does not mean every U.S. system has to be on PQC by 2030. The 2030 and 2031 deadlines apply to federal HVAs and high impact systems, and national security systems are excluded. Even so, it's a meaningful shift. PQC migration went from "something to prepare for eventually" to "this, by this date."
The order also reaches into procurement. It directs a rulemaking process, to begin within 180 days, to add PQC requirements to the Federal Acquisition Regulation (FAR), with federal contractors expected to meet FIPS requirements, including PQC, by the end of 2030. So PQC is no longer just an internal IT project for government agencies. It now shapes the product roadmaps and compliance plans of every company that sells to the federal government.
So Where Do You Start?
Say an organization has decided to migrate. Can it just drop in ML-KEM or ML-DSA and call it done? Not really.
Cryptography shows up in far more places than most organizations realize. It's in servers and network equipment, but also in applications, certificates, crypto libraries, communication protocols, security appliances, and all kinds of hardware. If you don't know where you're using RSA and where you're using ECC, it's hard to decide what to replace first.
That's why the U.S. executive order also addresses the cryptographic bill of materials (CBOM). It directs CISA, working with NIST, to publish public guidance within 270 days that defines the minimum elements of a CBOM. The goal is a common framework for identifying and assessing the cryptographic assets used across hardware and software.
In the end, the first question of any PQC migration is surprisingly simple: "Where, exactly, is our organization using cryptography today, and what kind?" It's the same reason nearly every national roadmap lists cryptographic discovery and inventory as step one.
European Union: Start Together, Fix the Riskiest Systems First
The EU's approach centers on coordination. In April 2024, the European Commission adopted a recommendation on the transition to PQC. Building on it, the member states and the Commission published the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography in June 2025.
The roadmap sets out three milestones. By the end of 2026, every member state should begin work on a national PQC transition strategy. By the end of 2030 at the latest, high-risk use cases should be migrated. And by 2035, the transition should be complete for as many systems as practically feasible. Rather than trying to move everything at once, the EU is prioritizing the areas with the most at stake.
The EU puts particular emphasis on moving together. Europe's digital infrastructure is tightly interconnected across borders, so one country migrating on its own doesn't solve much. The EU has repeatedly stressed that the transition needs to be "coordinated and synchronised" across member states.
United Kingdom: The Number to Watch Is 2028, Not 2035
The timeline published by the U.K.'s National Cyber Security Centre (NCSC) in March 2025 is refreshingly clear.
- By 2028: Define migration goals, complete discovery and assessment across all systems, and build an initial migration plan.
- By 2031: Complete the highest-priority migration activities and refine the plan into a detailed roadmap.
- By 2035: Complete migration of all systems, services, and products to PQC.
The year that deserves the most attention here isn't 2035. It's 2028. The job between now and then isn't replacing every algorithm. It's figuring out what cryptography is in use and where. The NCSC expects large organizations, and those running their own IT infrastructure, to need two to three years just to complete discovery and assessment, define a migration strategy, and build an initial plan. That's why 2035 isn't a reason to wait.
Canada: Supporting PQC Isn't the Same as Migrating to It
The Government of Canada has laid out a phased schedule of its own.
- April 2026: Each department submits an initial PQC migration plan
- From April 2026: Annual progress reporting on the migration
- End of 2031: High-priority systems fully migrated
- End of 2035: All remaining systems migrated
What stands out in Canada's roadmap is that it defines what "done" actually means. Adding a PQC algorithm to a system doesn't make the risk from legacy cryptography disappear. Canada considers a system migrated only when its quantum-vulnerable algorithms have been disabled, isolated, or tunnelled. In other words, being able to use PQC and having migrated to PQC are not the same thing.
Japan: Government Agencies Are Aiming for 2035
Japan's Cybersecurity Strategy, released in December 2025, sets a goal for government agencies and related bodies to migrate to PQC by 2035, in principle. Relevant ministries will work together on a detailed roadmap in fiscal 2026 and will also look at ways to support a smooth transition for critical infrastructure operators and private companies. For information that's especially sensitive or needs protection over a very long period, an earlier transition is also on the table.
The technical groundwork is moving forward too. In March 2026, CRYPTREC, Japan's cryptographic evaluation program, revised its e-Government Recommended Ciphers List to include a new PQC section, adding ML-KEM (ML-KEM-768 and ML-KEM-1024) under key establishment. The digital signature category is still empty. So rather than reading this as Japan adopting NIST's full PQC suite, it's more accurate to see it as a phased rollout starting with key establishment.
South Korea: A Law and a Timeline, Side by Side
Korea's PQC transition has picked up noticeably this year. The reason is simple: the country now has both a legal basis and a concrete schedule in place.
A National Roadmap Built on a 2035 Target
The starting point was July 2023, when the NIS and the Ministry of Science and ICT (MSIT) announced a national PQC master plan with the goal of completing the transition of Korea's national cryptographic systems by 2035. Alongside it, Korea ran the KpqC competition to develop homegrown algorithms, and the final results were announced in January 2025. AIMer and HAETAE were selected for digital signatures, and NTRU+ and SMAUG-T for public-key encryption and key establishment.
The NIS Unveils a Comprehensive PQC Transition Plan
On September 17, 2026, the NIS presented its Comprehensive Plan for the Transition to Post-Quantum Cryptography at Cyber Security Summit Korea (CSK 2026). The plan is organized around two strategies, six core tasks, and 59 detailed action items, and it matters because it turns the 2023 master plan into an actual execution schedule.
The key milestones:
- Starting in 2027: PQC transition becomes part of the NIS's cybersecurity posture assessment for public institutions
- January 2027: Key encapsulation (KEM) algorithms selected for cryptographic module validation
- January 2028: Validation begins for KEM
- January 2029: Deployment of certain PQC algorithms becomes mandatory
- Digital signatures (DSA): Candidates selected in January 2028, with deployment becoming mandatory two years later
The algorithms covered under Korea's Cryptographic Module Validation Program (KCMVP) are expected to include both the domestic KpqC algorithms and the NIST standards. The NIS also said it plans to release three practical guides before the end of the year, covering cryptographic security criteria, key management, and PQC migration. On top of that, it's discussing whether to move the transition deadline earlier than 2035 for critical areas such as classified systems. For a closer look at the plan's timeline and why the mandate came about, see South Korea's PQC Migration: From Recommendation to Roadmap.
It's also worth noting that PQC is being layered, step by step, onto KCMVP, a validation system that's already well established. Because the existing framework stays in place, both public institutions and their suppliers can prepare for the transition through processes they already know.
An Amended Law Makes Quantum-Safe Security Mandatory for the Public Sector
The legal foundation is now in place too. An amendment to the Quantum Technology Industry Act, which requires the public sector to adopt quantum-safe security systems such as PQC and quantum key distribution (QKD), passed the National Assembly in April 2026 and was approved by the Cabinet in May. It takes effect on November 20, 2026. Under the amended law, central government agencies, local governments, and public institutions must plan and build quantum-safe security systems in line with technical guidelines from MSIT and the NIS. Details such as scope and timing will be set in the enforcement decree.
Pilot Migrations in Real Industry Settings
Field testing is underway as well. In 2026, MSIT and the Korea Internet & Security Agency (KISA) are running a PQC pilot migration program across five sectors: telecommunications, finance, transportation, defense, and space. The projects apply PQC in very different real-world environments, including research network data security, card payment infrastructure compatibility, autonomous driving data integrity, end-to-end encryption from drones to back-end servers, and communications between satellites and ground stations.
The point isn't just to confirm that PQC works. It's to build a body of evidence on what the process actually requires when PQC goes into live IT infrastructure, and on what constraints and trade-offs come up along the way. Korea's PQC conversation is moving from algorithm research to how to actually make the switch in the real world.
The G7 Is Now Talking About PQC Migration Too
PQC has also become part of the international cybersecurity agenda, well beyond individual countries.
In January 2026, the G7 Cyber Expert Group published a PQC transition roadmap for the financial sector. It recommends that institutions begin preparation and implementation between 2026 and 2029, prioritize critical systems for migration between 2030 and 2032, and wrap up remaining systems around 2035. The roadmap is non-binding guidance, not regulation, but it gives the financial sector a shared timeline to work from.
Then in September 2026, the G7 Cybersecurity Working Group released "Preparing for the Post-Quantum Era: A Call to Action," which laid out five priority areas:
- Raising awareness of quantum risk and PQC
- Developing national PQC strategies
- PQC research and development, including pilots and testbeds
- Strengthening partnerships among government, industry, and academia
- Integrating PQC into cybersecurity requirements, including public procurement
It's a clear signal that PQC migration is no longer a task for one country or a handful of tech companies. It's something the world's major economies now intend to move on together.
How Far Along Are the Big Tech Companies?
While governments refine their roadmaps, global tech companies are already building PQC into real products and services.
Google: Full PQC Readiness by 2029
In a PQC roadmap published in August 2026, Google Cloud set a goal of full PQC readiness by 2029. google.com and Google Cloud API endpoints already offer hybrid key exchange that pairs ML-KEM with classical cryptography, and Cloud KMS now fully supports ML-KEM, ML-DSA, and SLH-DSA. Google's ALTS protocol, which secures internal service-to-service traffic, finished moving to ML-KEM back in 2025.
Microsoft: Pulling the Target Forward from 2033 to 2029
As recently as 2025, Microsoft's plan called for early adoption by 2029 and a completed transition by 2033. In June 2026, it announced it was accelerating the target to transition its products and services to PQC by 2029, and folded the effort into its Secure Future Initiative. ML-KEM and ML-DSA APIs have been generally available on Windows 11 and Windows Server 2025 since November 2025.
AWS: Deploying PQC, and Helping Customers Find What Needs to Change
AWS published its official PQC migration plan in December 2024. Since then, it has rolled out hybrid ML-KEM key establishment on endpoints including AWS KMS, ACM, and Secrets Manager, and added ML-DSA support in AWS KMS and AWS Private CA. In May 2026, it also released a sample solution built on AWS Config that automatically checks whether load balancer and API Gateway TLS configurations support PQC. The same theme from the government roadmaps shows up here: knowing what you're running today matters just as much as deploying PQC.
Cloudflare: Fully Post-Quantum Secure by 2029
In a roadmap published in April 2026, Cloudflare set a target of becoming fully post-quantum secure by 2029, including authentication. That means extending PQC beyond encryption and into authentication as well. The same month, it made hybrid ML-KEM generally available for IPsec.
Apple: Already in Consumers' Hands
Apple is a slightly different kind of example. In February 2024, it introduced the PQ3 protocol for iMessage, which applies PQC not only to the initial key establishment but also to the periodic rekeying that happens throughout a conversation. And starting with iOS 26, released in September 2025, Apple devices offer hybrid ML-KEM by default on TLS 1.3 connections. Rather than a company-wide migration roadmap, Apple's case is best read as proof that PQC is already running inside consumer services used by hundreds of millions of people.
Different Countries, Common Steps
You can't lump the U.S., the EU, the U.K., Canada, Japan, and Korea together and say "the world will finish migrating to PQC by 2035." The scope differs, and so do the timelines. But put the roadmaps side by side and the same steps keep showing up.
① Standardization — Which PQC algorithms will we use?
② Cryptographic Discovery & Inventory — Where are we using cryptography today, and what kind?
③ Risk Assessment & Prioritization — What needs to change first?
④ Migration Planning — When and how will we make the change?
⑤ Testing & Deployment — Does it hold up in real-world environments?
⑥ Crypto-Agility — Can we adapt quickly to the next change in cryptography?
Not every country or company follows this exact order. But these elements show up again and again across official roadmaps.
What to Look at Before 2035
There's no single global deadline for PQC migration. The U.S. has put 2030 and 2031 deadlines on a subset of critical federal systems. The EU plans to migrate high-risk use cases first, by 2030. The U.K., Canada, and Japan are working in phases toward 2035. Korea now has a concrete 2029 deployment mandate, plus a legal basis that takes effect this November. And in the private sector, real-world deployment is already underway.
So the numbers that matter right now aren't just 2030 or 2035. There are more immediate questions to answer first. What cryptography are our systems using today? Which of it is exposed to quantum risk? What should we replace first? And, finally, are we actually ready to make the change?
PQC migration isn't a one-day job where you swap out an old algorithm for a new one. The standards work is largely done. What governments and companies face now is the work of understanding their current cryptographic landscape, setting priorities, and migrating real systems one at a time. The next chapter of PQC may have less to do with the algorithms themselves and more to do with the migration itself.
References
Standards and the United States
EU, U.K., Canada, and Japan
South Korea (Korean-language sources)
- ZDNet Korea, Coverage of the NIS Comprehensive PQC Transition Plan (Sept. 20, 2026)
- Newsworks, NIS Presents PQC Transition Plan at CSK 2026 (Sept. 17, 2026)
- Electronic Times, Cabinet Approves Quantum Technology Industry Act Amendment (May 12, 2026)
- Newsis, Cabinet Approves Quantum Technology Industry Act Amendment (May 12, 2026)
- KOIT, NIS and MSIT Announce National PQC Master Plan (July 2023)
- KpqC Research Group, Final Results of the KpqC Competition (Jan. 2025)
- KISA, 2026 PQC Pilot Migration Program Announcement
- Asia Economy, PQC Pilot Migration Program Selection Results (May 6, 2026)
International Bodies and Industry
- U.S. Treasury, G7 Cyber Expert Group: Roadmap for the Transition to PQC in the Financial Sector (Jan. 2026)
- ANSSI, G7: Preparing for the Post-Quantum Era: A Call to Action (Sept. 2026)
- Google Cloud, PQC in Plaintext: Google Cloud's Post-Quantum Cryptography Roadmap
- Microsoft Security Blog, Microsoft Advances Quantum-Safe Security as the Risk Timeline Shifts (June 2026)
- Microsoft Security Blog, Quantum-Safe Security: Progress Towards Next-Generation Cryptography (Aug. 2025)
- Microsoft Tech Community, Post-Quantum Cryptography APIs Now Generally Available on Microsoft Platforms (Nov. 2025)
- AWS, Post-Quantum Cryptography
- AWS Security Blog, Automating Post-Quantum Cryptography Readiness Using AWS Config (May 2026)
- Cloudflare, Post-Quantum Roadmap (Apr. 2026)
- Cloudflare, Post-Quantum IPsec
- Apple Security Research, iMessage with PQ3 (Feb. 2024)
- Apple Support, Quantum-Secure Encryption in iOS 26 and Related Platforms
See It in Practice
Every PQC migration starts with knowing where and how your organization uses cryptography today. If you're building a migration plan, these are good places to start.
☑️ Explore ICTK's Quantum-Ready Technology
☑️ Talk to Us About PQC Services
Related Reading
☑️ South Korea's PQC Migration: From Recommendation to Roadmap
☑️ Quantum Security Explained: Beginner's 11 FAQs on PQC
The standards are set, and now the deadlines are arriving. A look at PQC roadmaps across Korea, the U.S., the EU, and Japan, and at how far global tech companies have gotten
"PQC mandate" has become a familiar phrase in South Korea's security news lately. In May, the government approved an amendment to the country's Quantum Technology Industry Act that requires the public sector to build quantum-safe security systems, and the law takes effect on November 20. Then in September, Korea's National Intelligence Service (NIS) unveiled a comprehensive plan for transitioning to post-quantum cryptography (PQC), naming 2029 as the year certain PQC algorithms become mandatory. PQC is no longer a research-lab topic in Korea. It's now something public institutions and their suppliers have to plan around, on a real schedule.
A few years ago, almost every conversation about PQC ended up at the same question: "So when are quantum computers actually going to show up?" That's no longer the question governments and major tech companies are asking. Instead of waiting to find out when a quantum computer might break today's encryption, they're asking when, and in what order, they should move the cryptography they already rely on over to PQC.
Korea isn't alone in this. Since NIST finalized the first PQC standards in 2024, the U.S., the EU, the U.K., Canada, and Japan have each published migration roadmaps, and companies like Google, Microsoft, AWS, Cloudflare, and Apple are already shipping PQC in production services. So where does the global PQC transition actually stand today?
At a glance ― Global PQC Migration Roadmap
It Started in August 2024 with NIST's PQC Standards
Any timeline of the global PQC transition starts on August 13, 2024. That's the day the U.S. National Institute of Standards and Technology (NIST) finalized its first three PQC standards.
NIST said the standards were "ready for immediate use" and encouraged system administrators to begin transitioning as soon as possible. In March 2025, it selected HQC as a backup key encapsulation algorithm to complement ML-KEM, and FN-DSA (FIPS 206), based on Falcon, is currently in draft.
Before the standards existed, the PQC conversation was mostly about which algorithms to use. Once they were finalized, the question became how to actually deploy them in real systems. That's a much harder problem. Legacy cryptography is embedded in servers, network gear, applications, certificates, and security appliances, and none of it can be swapped out overnight. That's why the word that now defines PQC is migration.
United States: "Someday" Now Has a Date
In 2026, the U.S. introduced a policy that changed the weight of the conversation. On June 22, 2026, the President signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks."
The order makes it official U.S. policy to transition federal information systems to NIST-approved PQC standards. The direction itself wasn't new. What was new were the deadlines.
One point is easy to misread. This does not mean every U.S. system has to be on PQC by 2030. The 2030 and 2031 deadlines apply to federal HVAs and high impact systems, and national security systems are excluded. Even so, it's a meaningful shift. PQC migration went from "something to prepare for eventually" to "this, by this date."
The order also reaches into procurement. It directs a rulemaking process, to begin within 180 days, to add PQC requirements to the Federal Acquisition Regulation (FAR), with federal contractors expected to meet FIPS requirements, including PQC, by the end of 2030. So PQC is no longer just an internal IT project for government agencies. It now shapes the product roadmaps and compliance plans of every company that sells to the federal government.
So Where Do You Start?
Say an organization has decided to migrate. Can it just drop in ML-KEM or ML-DSA and call it done? Not really.
Cryptography shows up in far more places than most organizations realize. It's in servers and network equipment, but also in applications, certificates, crypto libraries, communication protocols, security appliances, and all kinds of hardware. If you don't know where you're using RSA and where you're using ECC, it's hard to decide what to replace first.
That's why the U.S. executive order also addresses the cryptographic bill of materials (CBOM). It directs CISA, working with NIST, to publish public guidance within 270 days that defines the minimum elements of a CBOM. The goal is a common framework for identifying and assessing the cryptographic assets used across hardware and software.
In the end, the first question of any PQC migration is surprisingly simple: "Where, exactly, is our organization using cryptography today, and what kind?" It's the same reason nearly every national roadmap lists cryptographic discovery and inventory as step one.
European Union: Start Together, Fix the Riskiest Systems First
The EU's approach centers on coordination. In April 2024, the European Commission adopted a recommendation on the transition to PQC. Building on it, the member states and the Commission published the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography in June 2025.
The roadmap sets out three milestones. By the end of 2026, every member state should begin work on a national PQC transition strategy. By the end of 2030 at the latest, high-risk use cases should be migrated. And by 2035, the transition should be complete for as many systems as practically feasible. Rather than trying to move everything at once, the EU is prioritizing the areas with the most at stake.
The EU puts particular emphasis on moving together. Europe's digital infrastructure is tightly interconnected across borders, so one country migrating on its own doesn't solve much. The EU has repeatedly stressed that the transition needs to be "coordinated and synchronised" across member states.
United Kingdom: The Number to Watch Is 2028, Not 2035
The timeline published by the U.K.'s National Cyber Security Centre (NCSC) in March 2025 is refreshingly clear.
The year that deserves the most attention here isn't 2035. It's 2028. The job between now and then isn't replacing every algorithm. It's figuring out what cryptography is in use and where. The NCSC expects large organizations, and those running their own IT infrastructure, to need two to three years just to complete discovery and assessment, define a migration strategy, and build an initial plan. That's why 2035 isn't a reason to wait.
Canada: Supporting PQC Isn't the Same as Migrating to It
The Government of Canada has laid out a phased schedule of its own.
What stands out in Canada's roadmap is that it defines what "done" actually means. Adding a PQC algorithm to a system doesn't make the risk from legacy cryptography disappear. Canada considers a system migrated only when its quantum-vulnerable algorithms have been disabled, isolated, or tunnelled. In other words, being able to use PQC and having migrated to PQC are not the same thing.
Japan: Government Agencies Are Aiming for 2035
Japan's Cybersecurity Strategy, released in December 2025, sets a goal for government agencies and related bodies to migrate to PQC by 2035, in principle. Relevant ministries will work together on a detailed roadmap in fiscal 2026 and will also look at ways to support a smooth transition for critical infrastructure operators and private companies. For information that's especially sensitive or needs protection over a very long period, an earlier transition is also on the table.
The technical groundwork is moving forward too. In March 2026, CRYPTREC, Japan's cryptographic evaluation program, revised its e-Government Recommended Ciphers List to include a new PQC section, adding ML-KEM (ML-KEM-768 and ML-KEM-1024) under key establishment. The digital signature category is still empty. So rather than reading this as Japan adopting NIST's full PQC suite, it's more accurate to see it as a phased rollout starting with key establishment.
South Korea: A Law and a Timeline, Side by Side
Korea's PQC transition has picked up noticeably this year. The reason is simple: the country now has both a legal basis and a concrete schedule in place.
A National Roadmap Built on a 2035 Target
The starting point was July 2023, when the NIS and the Ministry of Science and ICT (MSIT) announced a national PQC master plan with the goal of completing the transition of Korea's national cryptographic systems by 2035. Alongside it, Korea ran the KpqC competition to develop homegrown algorithms, and the final results were announced in January 2025. AIMer and HAETAE were selected for digital signatures, and NTRU+ and SMAUG-T for public-key encryption and key establishment.
The NIS Unveils a Comprehensive PQC Transition Plan
On September 17, 2026, the NIS presented its Comprehensive Plan for the Transition to Post-Quantum Cryptography at Cyber Security Summit Korea (CSK 2026). The plan is organized around two strategies, six core tasks, and 59 detailed action items, and it matters because it turns the 2023 master plan into an actual execution schedule.
The key milestones:
The algorithms covered under Korea's Cryptographic Module Validation Program (KCMVP) are expected to include both the domestic KpqC algorithms and the NIST standards. The NIS also said it plans to release three practical guides before the end of the year, covering cryptographic security criteria, key management, and PQC migration. On top of that, it's discussing whether to move the transition deadline earlier than 2035 for critical areas such as classified systems. For a closer look at the plan's timeline and why the mandate came about, see South Korea's PQC Migration: From Recommendation to Roadmap.
It's also worth noting that PQC is being layered, step by step, onto KCMVP, a validation system that's already well established. Because the existing framework stays in place, both public institutions and their suppliers can prepare for the transition through processes they already know.
An Amended Law Makes Quantum-Safe Security Mandatory for the Public Sector
The legal foundation is now in place too. An amendment to the Quantum Technology Industry Act, which requires the public sector to adopt quantum-safe security systems such as PQC and quantum key distribution (QKD), passed the National Assembly in April 2026 and was approved by the Cabinet in May. It takes effect on November 20, 2026. Under the amended law, central government agencies, local governments, and public institutions must plan and build quantum-safe security systems in line with technical guidelines from MSIT and the NIS. Details such as scope and timing will be set in the enforcement decree.
Pilot Migrations in Real Industry Settings
Field testing is underway as well. In 2026, MSIT and the Korea Internet & Security Agency (KISA) are running a PQC pilot migration program across five sectors: telecommunications, finance, transportation, defense, and space. The projects apply PQC in very different real-world environments, including research network data security, card payment infrastructure compatibility, autonomous driving data integrity, end-to-end encryption from drones to back-end servers, and communications between satellites and ground stations.
The point isn't just to confirm that PQC works. It's to build a body of evidence on what the process actually requires when PQC goes into live IT infrastructure, and on what constraints and trade-offs come up along the way. Korea's PQC conversation is moving from algorithm research to how to actually make the switch in the real world.
The G7 Is Now Talking About PQC Migration Too
PQC has also become part of the international cybersecurity agenda, well beyond individual countries.
In January 2026, the G7 Cyber Expert Group published a PQC transition roadmap for the financial sector. It recommends that institutions begin preparation and implementation between 2026 and 2029, prioritize critical systems for migration between 2030 and 2032, and wrap up remaining systems around 2035. The roadmap is non-binding guidance, not regulation, but it gives the financial sector a shared timeline to work from.
Then in September 2026, the G7 Cybersecurity Working Group released "Preparing for the Post-Quantum Era: A Call to Action," which laid out five priority areas:
It's a clear signal that PQC migration is no longer a task for one country or a handful of tech companies. It's something the world's major economies now intend to move on together.
How Far Along Are the Big Tech Companies?
While governments refine their roadmaps, global tech companies are already building PQC into real products and services.
Google: Full PQC Readiness by 2029
In a PQC roadmap published in August 2026, Google Cloud set a goal of full PQC readiness by 2029. google.com and Google Cloud API endpoints already offer hybrid key exchange that pairs ML-KEM with classical cryptography, and Cloud KMS now fully supports ML-KEM, ML-DSA, and SLH-DSA. Google's ALTS protocol, which secures internal service-to-service traffic, finished moving to ML-KEM back in 2025.
Microsoft: Pulling the Target Forward from 2033 to 2029
As recently as 2025, Microsoft's plan called for early adoption by 2029 and a completed transition by 2033. In June 2026, it announced it was accelerating the target to transition its products and services to PQC by 2029, and folded the effort into its Secure Future Initiative. ML-KEM and ML-DSA APIs have been generally available on Windows 11 and Windows Server 2025 since November 2025.
AWS: Deploying PQC, and Helping Customers Find What Needs to Change
AWS published its official PQC migration plan in December 2024. Since then, it has rolled out hybrid ML-KEM key establishment on endpoints including AWS KMS, ACM, and Secrets Manager, and added ML-DSA support in AWS KMS and AWS Private CA. In May 2026, it also released a sample solution built on AWS Config that automatically checks whether load balancer and API Gateway TLS configurations support PQC. The same theme from the government roadmaps shows up here: knowing what you're running today matters just as much as deploying PQC.
Cloudflare: Fully Post-Quantum Secure by 2029
In a roadmap published in April 2026, Cloudflare set a target of becoming fully post-quantum secure by 2029, including authentication. That means extending PQC beyond encryption and into authentication as well. The same month, it made hybrid ML-KEM generally available for IPsec.
Apple: Already in Consumers' Hands
Apple is a slightly different kind of example. In February 2024, it introduced the PQ3 protocol for iMessage, which applies PQC not only to the initial key establishment but also to the periodic rekeying that happens throughout a conversation. And starting with iOS 26, released in September 2025, Apple devices offer hybrid ML-KEM by default on TLS 1.3 connections. Rather than a company-wide migration roadmap, Apple's case is best read as proof that PQC is already running inside consumer services used by hundreds of millions of people.
Different Countries, Common Steps
You can't lump the U.S., the EU, the U.K., Canada, Japan, and Korea together and say "the world will finish migrating to PQC by 2035." The scope differs, and so do the timelines. But put the roadmaps side by side and the same steps keep showing up.
① Standardization — Which PQC algorithms will we use?
② Cryptographic Discovery & Inventory — Where are we using cryptography today, and what kind?
③ Risk Assessment & Prioritization — What needs to change first?
④ Migration Planning — When and how will we make the change?
⑤ Testing & Deployment — Does it hold up in real-world environments?
⑥ Crypto-Agility — Can we adapt quickly to the next change in cryptography?
Not every country or company follows this exact order. But these elements show up again and again across official roadmaps.
What to Look at Before 2035
There's no single global deadline for PQC migration. The U.S. has put 2030 and 2031 deadlines on a subset of critical federal systems. The EU plans to migrate high-risk use cases first, by 2030. The U.K., Canada, and Japan are working in phases toward 2035. Korea now has a concrete 2029 deployment mandate, plus a legal basis that takes effect this November. And in the private sector, real-world deployment is already underway.
So the numbers that matter right now aren't just 2030 or 2035. There are more immediate questions to answer first. What cryptography are our systems using today? Which of it is exposed to quantum risk? What should we replace first? And, finally, are we actually ready to make the change?
PQC migration isn't a one-day job where you swap out an old algorithm for a new one. The standards work is largely done. What governments and companies face now is the work of understanding their current cryptographic landscape, setting priorities, and migrating real systems one at a time. The next chapter of PQC may have less to do with the algorithms themselves and more to do with the migration itself.
References
Standards and the United States
EU, U.K., Canada, and Japan
South Korea (Korean-language sources)
International Bodies and Industry
See It in Practice
Every PQC migration starts with knowing where and how your organization uses cryptography today. If you're building a migration plan, these are good places to start.
☑️ Explore ICTK's Quantum-Ready Technology
☑️ Talk to Us About PQC Services
Related Reading
☑️ South Korea's PQC Migration: From Recommendation to Roadmap
☑️ Quantum Security Explained: Beginner's 11 FAQs on PQC