Compliance & Regulatory Strategy
Navigate the complex landscape of PQC compliance requirements across jurisdictions and frameworks.
Why this matters: Regulatory deadlines (CNSA 2.0, NIS2, DORA) are already law in some jurisdictions and proposed in others — a strategy built from live framework data, not last year's summary, is the difference between meeting a deadline and discovering it too late.
Start here: Overlay your migration milestones on the framework deadlines in the Compliance Timeline: the gap between dates you chose and dates you did not is the plan.
For your role
- Executive / Business Leader
- Map the PQC frameworks and deadlines across the jurisdictions you operate in, then build the compliance timeline overlaying those deadlines on your migration: the gap assessment says where you are late.
- GRC / Risk & Compliance
- The audit-readiness checklist and the Regulatory Gap Assessment across your selected jurisdictions produce the compliance position from live framework data rather than last year's summary.
- Researcher / Academic
- The framework map is built from the live compliance dataset, so the deadlines and their sources can be checked on the Compliance page; the gap assessment is reproducible for any set of jurisdictions.
- Curious Explorer
- Pick a country or two and see which rules about post-quantum cryptography already apply there and by when: the module turns a pile of regulations into a list with dates.
The PQC Compliance Landscape
Governments and standards bodies worldwide are establishing requirements for the transition to . For organizations operating across borders, navigating these overlapping and sometimes conflicting requirements is a critical challenge.
“A quantum computer of sufficient size and sophistication — also known as a cryptanalytically relevant quantum computer — will be capable of breaking much of the public-key cryptography used on digital systems across the United States and around the world.”
— Executive Order 14306, Sustaining Select Efforts to Strengthen the Nation's Cybersecurity (June 6, 2025)
NIST, NSA, ETSI, , and are all publishing PQC transition guidance with concrete deadlines.
PCI DSS, HIPAA, FedRAMP, and CMMC are incorporating quantum-safe requirements into their compliance frameworks.
Organizations operating in multiple jurisdictions must reconcile different algorithm preferences, timelines, and certification requirements.
Key Frameworks
Understanding the major compliance frameworks driving PQC adoption is essential for building a multi-jurisdiction strategy.
The Commercial National Security Algorithm Suite 2.0 mandates PQC adoption for National Security Systems. Key deadlines: software/firmware signing preferred by 2025, exclusive by 2030 (with traditional networking); operating-system support by 2027; web/cloud/servers and operating systems by 2033 (NSM-10 targets all NSS quantum-resistant by 2035). Requires -1024 (FIPS 203) and -87 (FIPS 204) as minimum security levels.
NIST's transition guidance for post-quantum cryptography standards (Initial Public Draft published November 2024; comment period closed January 2025; final version pending). Recommends deprecating RSA, ECC, and other classical public-key algorithms by 2030 and disallowing them entirely after 2035. Emphasizes cryptographic agility and hybrid approaches during the transition period.
European bodies have published PQC migration guidance. ANSSI recommends hybrid cryptography combining classical and PQC algorithms. BSI endorses ML-KEM (FIPS 203) and ML-DSA (FIPS 204) with specific parameter recommendations. ETSI provides interoperability guidance for hybrid key exchanges.
All major frameworks converge on a two-phase transition arc. In Phase 1 (now through roughly 2028), organizations deploy hybrid mode — running a classical algorithm alongside a PQC algorithm in parallel. ANSSI and BSI require this during transition because it preserves security even if PQC implementations have undiscovered flaws. In Phase 2 (2028 onward, timed to your earliest jurisdiction deadline), organizations move to pure PQC: CNSA 2.0's “exclusive” requirements mean dropping the classical component once FIPS 140-3 validated implementations are widely available and proven.
Executive rule of thumb: Start hybrid deployments now. Plan your transition to pure PQC to meet your earliest jurisdiction deadline — which you will identify in the Jurisdiction Mapper workshop below.
Compliance-First vs Risk-First
Organizations typically approach PQC migration from one of two angles. The optimal strategy often combines both, using compliance deadlines as hard constraints and risk scoring to prioritize within those constraints.
- • Driven by regulatory deadlines and audit requirements
- • Prioritizes systems under regulatory scope first
- • Clear, external-driven milestones
- • Risk: may miss high-risk systems outside compliance scope
- • Best for: regulated industries (finance, government, healthcare)
- • Driven by data sensitivity and exposure windows
- • Prioritizes highest-risk assets regardless of regulatory scope
- • Addresses threats early
- • Risk: may not satisfy auditors without compliance mapping
- • Best for: technology companies, defense, intelligence
Major Compliance Deadlines
Key deadlines are converging across jurisdictions, creating a narrow window for organizations to complete their PQC migration.
NIST
NSA
NSA
NSA/NIST
ANSSI
NSA
EO 14412
EO 14412
NIST
Country-Specific Deadlines
Individual countries are setting their own PQC transition deadlines, and they do not line up. Organizations operating internationally must track every jurisdiction they touch — the binding date is the earliest one, not the average.
| Country | Agency | Key Deadline | Details |
|---|---|---|---|
| United States | EOP / OMB / NSA | 2030 | Two parallel clocks. Federal civilian: EO 14412 (22 June 2026) requires High Value Assets, high-impact systems and covered contractors to use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031, implemented by OMB M-26-15. National security systems: CNSA 2.0 — software/firmware signing and traditional networking exclusive by 2030; web browsers/servers, cloud and operating systems by 2033; NSS transition complete by 2035 per NSM-10. |
| Australia | ASD | 2030 | Cease use of traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA) in government and critical infrastructure systems; algorithms “will not be approved for use beyond 2030” (ASD). Phased: transition plans required by end of 2026, implementation begins 2028, full completion by 2030. |
| Canada | CCCS | 2026 | Federal departments submit PQC migration plans by April 2026; high-priority systems by 2031; full transition by 2035 |
| United Kingdom | NCSC | 2028 | Three-phase roadmap: discovery (2025–2028), priority migration (2028–2031), full migration (2031–2035) |
| Czech Republic | NUKIB | 2027 | First EU member state to set a specific encryption migration deadline — ahead of the broader EU coordinated roadmap |
| European Union | EC | 2030 | Coordinated Implementation Roadmap (v1.1, June 2025): high-risk systems by 2030, full transition by 2035 — aligned with NIST timelines |
| Israel | INCD | 2025 | Quantum threat assessments completed by end of 2025; PQC required in new contracts |
| Taiwan | NICS | 2027 | PQC migration target for critical semiconductor and technology sectors |
| Singapore | MAS | Guidance | Monetary Authority of Singapore issued PQC readiness guidance (November 2024) directing financial institutions to begin cryptographic inventory and migration planning. No hard mandate yet; best-practice alignment with NIST standards expected. Particularly relevant for financial sector organizations. |
| Germany | BSI/DLR | 2030 | QUANTITY initiative (March 2025) for quantum cryptanalysis; critical applications PQC-protected by end of 2030 |
| G7 | CEG | 2034 | Cyber Expert Group (January 2026): financial sector PQC migration by 2034 with phased preparation from 2025 |
Key takeaway: Organizations must meet the earliest deadline across all jurisdictions where they operate. A company in Australia and the EU faces a 2030 hard deadline, not the EU's 2035 full transition target.
Compliance Dependencies
Several cross-cutting compliance requirements affect PQC migration timelines regardless of jurisdiction.
The Cryptographic Module Validation Program certifies cryptographic implementations for government use. PQC algorithm implementations (FIPS 203/204/205) must undergo CMVP validation before deployment in federal systems. Validation exists on a spectrum: full CMVP validation (gold standard), modules in process, FIPS-mode operation, and partial compliance (FedRAMP, WebTrust). This certification backlog is a key dependency in migration timelines.
The updated EU regulation for electronic identification mandates European Digital Identity (EUDI) wallets with deployments starting 2027+. While eIDAS 2.0 does not yet mandate PQC specifically, these wallets will need quantum-safe cryptography for long-term trust. ENISA identifies wallet providers as high-impact entities for early PQC adoption.
EO 14306 (June 6, 2025) — “Sustaining Select Efforts to Strengthen the Nation's Cybersecurity” — directs CISA, in consultation with NSA, to publish and maintain a list of product categories in which PQC-capable products are widely available (initial list due December 1, 2025). CISA subsequently issued advisory procurement guidance recommending that agencies acquire PQC capabilities in new federal product and service acquisitions (EO 14306 removed EO 14144's binding solicitation requirement), encouraging market demand for PQC-capable solutions.
EO 14412 (signed June 22, 2026) — “Securing the Nation Against Advanced Cryptographic Attacks” — is the order that actually sets dates. Federal High Value Assets, high-impact systems and covered contractors must use PQC for key establishment by December 31, 2030 and for digital signatures by December 31, 2031. The function split is deliberate: key establishment carries harvest-now-decrypt-later exposure, so it moves first. It further directs a FAR Council proposed rule on contractor FIPS/PQC compliance (due 19 December 2026, 180 days after EO 14412) and CISA guidance on minimum elements (due 19 March 2027, 270 days after EO 14412). OMB Memorandum M-26-15 (June 24, 2026) is the implementing guidance: a five-phase agency schedule and PQC migration plans filed with OMB. National security systems are out of scope — they remain under CNSA 2.0.
The EU's Digital Operational Resilience Act (enforcement January 2025) requires financial institutions to implement robust ICT risk management including cryptographic controls. While not PQC-specific yet, organizations subject to DORA must demonstrate encryption resilience planning that will inevitably encompass quantum threats.
A CBOM is your foundational compliance artifact — you cannot migrate what you haven't inventoried, and in most organizations the inventory does not yet exist in any auditable form. EO 14412 puts a date on it: CISA guidance on the minimum elements of a CBOM is due 19 March 2027, 270 days after the order, to enable automated assessment of cryptographic assets. For the full CBOM framework, including CycloneDX format requirements and vendor contract language, see Vendor & Supply Chain Risk.
Industry finding: most financial-sector organisations report being unprepared for post-quantum cybersecurity (Europol's Quantum Safe Financial Forum, Call to Action, 2025).
Workshop Overview
This workshop guides you through building a comprehensive compliance strategy in three steps:
Select your operating jurisdictions and see which frameworks, deadlines, and requirements apply. Identify conflicts between jurisdictions.
Build a comprehensive audit readiness checklist covering cryptographic inventory, policy, technical controls, vendor management, and documentation.
Overlay regulatory deadlines with your migration milestones. Identify gaps and build a timeline to close them.
Related Resources
Map jurisdictions, build audit checklists, and construct compliance timelines.
Related modules
- Cryptographic Management ModernizationSame track · Executive · Shares ML-DSA, ML-KEM, NIST SP 800-90B
- Migration Program MgmtSame track · Executive · Shares EO 14306, OMB M-23-02
- Government & Defense PQCShares ML-DSA, ML-KEM, EO 14306
- PQC Governance & PolicySame track · Executive · Shares ML-DSA, ML-KEM, OMB M-23-02
Check your understanding
11 questions on Compliance & Regulatory Strategy, each with its answer and the reason.
Take the quizNext step
Produce the artifact: Compliance ChecklistThis module belongs to the Foundations phase; Compliance Checklist produces a deliverable of that phase in the Command Center.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.