Post quantum cryptography deadline: what is the date?

The post quantum cryptography deadline isn’t a single date. It is a set of overlapping milestones from NIST, the NSA and the European Union, each saying when organisations must replace quantum-vulnerable public-key algorithms such as RSA and elliptic-curve cryptography (ECC) with quantum-resistant ones. For critical infrastructure in Europe, the key milestone is the end of 2030.

For operators of OT and critical infrastructure, these dates apply first to the connections between sites, cloud environments and remote users. Those links carry control traffic and operational data over networks the operator doesn’t control. This article explains each framework, what it requires and how the dates apply to network connections.

What is the deadline for post quantum migration?

The main dates are end 2026 to start, end 2030 for high-risk and critical infrastructure use cases, and 2035 to finish. Which ones bind you depends on your jurisdiction and customers.

The dates below come from four documents. Only some are legally binding, but in practice all of them shape procurement, audits and what vendors build.

The US federal anchor is National Security Memorandum 10. The NIST IR 8547 timeline supports the NSM-10 goal of transitioning USG systems to PQC by 2035. The Quantum Computing Cybersecurity Preparedness Act was signed in December 2022 and codified as 6 U.S.C. § 1526. It reaffirms NSM-10 and M-23-02, and includes requirements for an inventory of cryptographic systems, migration to PQC, and reporting in line with the earlier PQC memorandums. CISA’s programme page now also lists OMB Memorandum M-26-15 next to M-23-02 as a basis for the federal migration.

When will NIST deprecate RSA and ECC?

Under the NIST IR 8547 draft, RSA and ECC at 112-bit security strength become deprecated after 2030. All quantum-vulnerable public-key algorithms, whatever their strength, are disallowed after 2035.

NIST published the draft in November 2024. It lists RSA, (EC) Diffie-Hellman, MQV, ECDSA and EdDSA as vulnerable, and ML-KEM, ML-DSA, SLH-DSA, LMS and XMSS as post-quantum. In NIST’s terms:

• Deprecated after 2030: 112-bit keys, such as RSA-2048, can still be used, but you accept the risk.
• Disallowed after 2035: no new protection with RSA, ECDH, ECDSA or EdDSA at any key size, including P-384 or RSA-3072.

Symmetric cryptography mostly stays in place. NIST-approved symmetric primitives providing at least 128 bits of classical security continue to be approved. So the migration is mainly about key exchange and signatures, not bulk encryption.

NIST’s project page puts it plainly: NIST will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems transitioning much earlier. NIST’s own priority list puts systems with long-term confidentiality needs, e.g., VPN, TLS first, which covers the inter-site and remote-access links this article is about.

What is CNSA 2.0?

CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) is the NSA’s list of quantum-resistant algorithms and deadlines for US National Security Systems. It was released in September 2022.

CNSA 2.0 provides guidance on quantum-resistant algorithms, timelines and additional guidance sources for NSS and related assets. It took over from CNSA 1.0, which served as a bridge between the original set and a fully quantum-resistant cryptographic capability.

CNSA 2.0 picks the strongest parameter sets. The NSA’s IPsec profile for CNSA 2.0 uses ML-KEM-1024 (FIPS 203) for key establishment and ML-DSA-87 (FIPS 204) for digital signatures. The NSA has published the deadlines as a table by product category. Traditional networking equipment such as VPNs and routers has an earlier deadline than most other categories, and the NSA wants all NSS to be quantum-resistant by 2035.

For a European grid or water operator, CNSA 2.0 isn’t law. It still matters in two ways. Suppliers to US defence and government customers have to follow it. And because it is the strictest public profile available, many buyers use it to judge vendor roadmaps.

What does the EU PQC roadmap require for critical infrastructure?

The EU roadmap asks Member States to start by the end of 2026 and to move high-risk use cases, explicitly including critical infrastructure, to PQC by the end of 2030. Everything else should follow by 2035 as far as feasible.

The basis is Commission Recommendation (EU) 2024/1101 of 11 April 2024. It aims at deploying Post-Quantum Cryptography technologies into existing public administration systems and critical infrastructures via hybrid schemes. The EU Member States, supported by the Commission, then adopted the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography in June 2025. The NIS Cooperation Group set up a PQC work stream, co-chaired by Germany, France and the Netherlands, which drafted it.

The three milestones

• End 2026: PQC roadmaps defined in each Member State, with planning for high- and medium-risk use cases underway.
• End 2030: high-risk use cases migrated, covering critical infrastructure (e.g. water, energy, health care, finance and transportation) and high-risk domains. Quantum-safe software and firmware upgrades are enabled by default.
• End 2035: all migrations should be completed for every risk level.

Launching the roadmap, Executive Vice-President Henna Virkkunen said that “the post-quantum cryptography roadmap provides a clear direction to ensure the robust security of our digital infrastructure.”

The roadmap also sets technical expectations. The Commission stresses that all implementations of cryptography should be “crypto-agile”: cryptographic routines and ciphers can be easily upgraded or replaced without having to completely replace the underlying application or device. It also favours hybrid deployments that combine PQC with current public-key cryptography.

Industry engaged with the draft in large numbers. The public consultation received 97 submissions in total, and 73 respondents provided an overall rating of the document and/or feedback on its contents (European Commission, September 2026). The NIS Cooperation Group answered with an FAQ document on risk estimation, milestones, prioritisation and hybrid schemes.

Does NIS2 require quantum safe encryption?

Not by name. The NIS2 Directive requires essential and important entities to have cryptography and encryption policies, but it names no algorithms. The EU roadmap is the document that adds the quantum timeline.

Article 21(2)(h) of Directive (EU) 2022/2555 lists policies and procedures on the use of cryptography and, where appropriate, encryption among the minimum cybersecurity risk-management measures. Article 21 also asks for measures that reflect the state of the art and are proportionate to the risk. NIS2 never says “post-quantum”.

The link to the roadmap is organisational. The NIS Cooperation Group was set up under NIS2, and it wrote the roadmap. The Commission states that Member States should identify high-risk cases in critical entities and ensure quantum-safe encryption for these high-risk cases as soon as possible and no later than by the end of 2030. So if a cryptography policy written under Article 21 ignores the quantum threat to long-lived OT data, it will be hard to justify as state of the art once national authorities turn the roadmap into national plans.

Why are OT connections the first priority?

OT data is valuable for a long time, and OT equipment runs for decades. A link protected only with classical key exchange today could be decrypted later.

The Commission warns that “store now, decrypt later” attacks are already likely occurring. Nobody knows when the needed quantum computers will exist. NIST observes that no one knows how long it will take to build a cryptographically relevant quantum computer, and while predictions vary widely, some people think it may be possible in less than 10 years (NIST NCCoE, September 2025).

OT devices also last longer than migration plans. A comment submitted to NIST pointed out that long-lived SCADA/ICS devices installed today may remain operational by the time quantum computers become viable, and that upgrading embedded devices with PQC after installation may not be feasible. The joint CISA, NSA and NIST factsheet likewise says prioritization should be given to high impact systems, industrial control systems (ICSs), and systems with long-term secrecy needs.

At the factsheet launch, then-CISA Director Jen Easterly said: “It is imperative for all organizations, especially critical infrastructure, to begin preparing now for migration to post-quantum cryptography.” NSA’s Rob Joyce added that “the transition to a secured quantum computing era is a long-term intensive community effort that will require extensive collaboration between government and industry.”

How do you plan the migration for sites, cloud and remote users?

Plan each connection separately: list the key exchange on every link, compare how long the data must stay secret with the 2030 date, and protect at the network layer wherever the endpoints can’t be upgraded.

1. Inventory by connection, not only by asset

The NCCoE inventory guidance covers cryptographic protocols and services, such as TLS, SSH, VPNs, code signing, email encryption, and certificate-based authentication. For OT, group the inventory into three kinds of link: site to site (substations, pumping stations, plants), edge to cloud (historians, analytics), and remote access (engineers, vendors). You don’t need to do this alone. CISA notes it is a collaborator along with over 28 industry partners in the NIST National Cybersecurity Center of Excellence’s “Migration to PQC” project (CISA, September 2024), which publishes reference material on discovery tooling.

2. Compare data lifetime with the dates

If traffic on a link must stay confidential beyond 2030, for example network topology, setpoints or maintenance credentials, treat that link as high-risk under the EU roadmap now. Don’t wait for the 2030 deadline.

3. Protect at the network layer where endpoints can’t change

PLCs and RTUs often can’t run new cryptographic libraries. NIST’s VPN guidance notes that network-layer controls apply to all applications and are not application-specific, so applications do not have to be modified to use the controls. That makes encryption gateways at each end of a link the most practical option for legacy OT. One example is Quantum Network’s QPN gateway. It sits at each end of a connection, encrypts at Layer 3, and combines a classical and an ML-KEM (FIPS 203) key agreement into one session key, without installing software on the equipment behind it. Gateways like this protect data in transit only. They don’t protect the devices behind them, and they don’t replace your firewall.

4. Require hybrid and crypto-agile designs

The EU recommendations encourage hybrid solutions with both PQC and current asymmetric cryptography. Hybrid matters because the post-quantum algorithms are still new: if one turns out to be weak, the classical part still protects the session. Ask vendors to explain how you would replace an algorithm in the field, including on air-gapped sites that can’t receive online updates. That is the practical test of the roadmap’s crypto-agility principle.