NCSC PQC migration timeline: what is due by 2028 and 2031?

The NCSC PQC migration timeline is the UK National Cyber Security Centre’s recommended schedule for moving from quantum-vulnerable public-key cryptography (RSA, Diffie-Hellman, elliptic curves) to post-quantum cryptography. It has three milestones: discovery and planning by 2028, the highest-priority migrations by 2031, and full migration by 2035.

For organisations running operational technology (OT) and critical infrastructure, the encrypted connections between sites, cloud environments and remote users are where this timeline first becomes concrete. This article sets out what each milestone requires, where hybrid key exchange fits, and how the UK dates line up with European and US policy.

What are the NCSC post-quantum migration deadlines?

The NCSC sets three target years: 2028, 2031 and 2035. They come from its guidance Timelines for migration to post-quantum cryptography, published in March 2025.

On March 20, NCSC-UK outlined key milestones for the UK’s migration to post-quantum cryptography. In summary:

The audience is not every small business. According to CERT-EU’s summary, the guidance targets critical infrastructure, large enterprises, and bespoke IT systems. Most OT operators fall into at least one of those groups.

The ten-year span reflects past experience, not leniency. NIST observes that past cryptographic migrations have taken over a decade, and this more complex migration will likely take at least that long.

What do UK organisations have to complete by 2028?

By 2028 the NCSC expects discovery and planning to be finished: you know where quantum-vulnerable cryptography is used, you have set migration goals, and you have an initial plan. Large-scale deployment is not required by then.

In OT environments, discovery is harder than in IT because cryptography sits in places that asset registers rarely record. A useful 2028 inventory for connectivity covers:

• Every inter-site path, for example substation to control centre, pumping station to telemetry hub, or plant to historian. Record the transport (leased line, public internet, private APN, satellite) and the key exchange it uses.
• Edge-to-cloud flows, where OT data goes to analytics, maintenance platforms or vendor portals, including who terminates the encryption.
• Remote access routes for engineers, integrators and on-call staff, including third-party maintenance access.
• Data lifetime for each flow. Process data, network topology, safety-system configurations and credentials can stay sensitive for decades, and that is what makes “harvest now, decrypt later” relevant to them.
• Upgrade path per component: can the device or link take a firmware change, does it need replacing, or must it be protected by something in front of it?

Which high-priority migrations should be finished by 2031?

By 2031, organisations should have completed the migrations they ranked highest in their 2028 plan. For most infrastructure operators that means wide-area connections carrying long-lived or operationally sensitive data across networks they do not control.

The NCSC leaves prioritisation to each organisation, but its logic favours links that meet several of these conditions:

• Traffic crosses the public internet or a carrier network, so it can be intercepted and stored.
• Data stays confidential long after transmission, such as engineering drawings, grid models or patient records.
• The link carries control or configuration traffic, where integrity matters as much as confidentiality.
• Many sites depend on the same key infrastructure, so one improvement covers a large share of exposure.

Encrypted tunnels between sites, cloud and remote users often satisfy all four. They are also among the most practical early wins, because the encryption terminates on a small number of network devices rather than on thousands of endpoints. Ollie Whitehouse, the NCSC’s Chief Technology Officer, said in joint OT connectivity guidance: “As operational technology systems benefit from greater connectivity and attract more attention from adversaries, it is vital cyber security is treated as a foundational requirement”.

Does the NCSC recommend hybrid post-quantum key exchange?

The NCSC accepts hybrid (post-quantum/traditional) key exchange as a transitional measure, but does not treat it as the end state. Systems should be able to move to post-quantum-only key establishment later.

A European Commission Joint Research Centre review of national positions puts it this way: NCSC-UK only endorses NIST standards and suggests the use of hybrid schemes for additional security and retro-compatibility during migration. It adds that hybrid systems can be envisaged as a temporary solution only and that the systems should be capable of switching to standalone post-quantum cryptography in the future.

Two practical points follow for anyone choosing connectivity equipment now:

1. Use standardised algorithms. For key establishment that means ML-KEM, specified in FIPS 203, which NIST lists among its post-quantum standards alongside the signature schemes ML-DSA and SLH-DSA.
2. Require crypto agility. A hybrid design you cannot reconfigure will become a liability once classical components are deprecated. Ask whether the post-quantum algorithm can be swapped, and how updates reach devices in segmented or air-gapped networks.

Quantum Network’s QPN gateway is one example of the hybrid approach at the network layer. It combines a classical and an ML-KEM key agreement into one session key and allows the post-quantum algorithm to be changed if necessary. Whatever you choose, check how algorithm updates are delivered and what happens when support for the product ends.

How does the NCSC timeline apply to operators of essential services?

The timeline is guidance, not a statutory deadline. For operators of essential services (OES), though, it shapes what regulators are likely to consider reasonable cryptographic risk management under the Network and Information Systems Regulations 2018 (SI 2018/506).

Under the NIS Regulations, OES in energy, transport, drinking water, health and digital infrastructure must take appropriate and proportionate security measures. Sector competent authorities assess those measures against the NCSC Cyber Assessment Framework (CAF). The CAF does not name post-quantum algorithms. Its data security principle (B3, which covers data in transit) and its asset management expectations do require operators to understand and protect sensitive data flows, and a 2028 cryptographic inventory is direct evidence for both.

The Cyber Security and Resilience Bill, which updates and extends the UK NIS framework (including to more digital and managed service providers), adds a supply-chain angle. Managed service providers and suppliers that run connectivity for OES may come under closer scrutiny, so their post-quantum roadmaps become part of your own risk picture. Check the Bill’s current parliamentary status and any secondary legislation before relying on specific provisions.

How does the UK timeline compare with the EU and US deadlines?

The UK, the EU and the US all aim to finish by 2035. The EU is stricter on the interim date: it expects high-risk use cases, explicitly including critical infrastructure, to be migrated by the end of 2030, one year before the UK’s 2031 milestone.

European Union

The EU Member States, supported by the Commission, adopted the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography in June 2025. The earlier Commission Recommendation (EU) 2024/1101 already anticipated deployment into existing public administration systems and critical infrastructures via hybrid schemes. Industry engagement was substantial: the consultation on the roadmap received 97 submissions in total. Henna Virkkunen, Executive Vice-President of the European Commission, said: “As we enter the quantum era, post-quantum cryptography is essential to ensure a high level of cybersecurity”.

United States

National Security Memorandum 10 sets the overall goal: the US should transition with the goal of mitigating as much of the quantum risk as is feasible by 2035. NIST’s draft IR 8547 proposes that quantum-vulnerable algorithms at 112-bit security strength are deprecated after 2030, disallowed after 2035. More recently, EO-14412 mandates an accelerated, government-wide migration to PQC for federal systems, establishing binding deadlines for high-value assets and pushes NIST PQC standards onto federal contractors.

What the comparison means in practice

A UK operator with EU group companies, EU-based suppliers or cross-border interconnections should plan to the EU’s end-2030 date for high-risk links. Vendors serving several markets will design to the earliest deadline among them, and US federal procurement rules will push the same algorithms (ML-KEM, ML-DSA) into products sold worldwide. Aligning your 2031 priorities with 2030 leaves a buffer for the commissioning windows and outage scheduling that OT changes always need.

How should OT operators sequence connectivity work against the timeline?

Treat inter-site, edge-to-cloud and remote-access encryption as a separate workstream that can move faster than device-level migration. Protection at the network layer covers legacy equipment that will never run post-quantum code.

A workable sequence:

1. 2026 to 2027: map every wide-area path and remote access route, rank them by how long their data stays sensitive and how exposed they are, and record supplier roadmaps.
2. 2027 to 2028: pilot hybrid post-quantum key exchange on one or two representative links, including one air-gapped or bandwidth-constrained path, and confirm that firewall inspection and monitoring still work.
3. 2028 to 2030: roll out to all high-priority links, aiming at the EU’s end-2030 date if you have European exposure.
4. 2031 to 2035: migrate remaining paths, move from hybrid to post-quantum-only key establishment where standards and products allow, and retire or isolate what cannot be migrated.

Encryption in transit protects confidentiality and integrity on the wire. It does not replace segmentation, firewall inspection, endpoint hardening or monitoring, and your migration plan should say how each of these continues to work once tunnels are post-quantum.