Post-quantum deadlines, United States and the Gulf.
Every dated duty and target we could trace to its source, marked binding or guidance, with the six Gulf states side by side. Reviewed October 30, 2026.
The road to 2035.
The dates that fall due, year by year. The square shows how much force each one has; the tables below give the full wording and who it binds. To date your own systems against these deadlines, see our post-quantum readiness assessment.
- Binding
- A legal or regulatory duty on the bodies named.
- Contractual
- Binding through a contract or an industry scheme, not through law.
- Guidance
- Advice or a recommendation. Not enforceable on its own.
- Pending
- Ordered or under way, not yet in force.
- Standard
- A published standard, or a step in a standards process.
- Text not public
- Announced as a requirement, but the text has not been published.
-
2026
-
2027
-
2028
- UK: discovery and an initial migration plan, by 20284 Guidance
-
2030
-
2031
-
2035
United States.
Federal duties now run to 2030 for key exchange and 2031 for signatures on the most sensitive systems. A rule for contractors is next.
| Date | Who | What | Applies to | Force |
|---|---|---|---|---|
| The White House | National Security Memorandum 10 sets the goal of mitigating as much quantum risk as feasible by 2035 and asks for annual cryptographic inventories.9 | Federal agencies | Binding | |
| NIST | FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) published as final standards.10 | Federal systems; used worldwide | Standard | |
| CISA | Lists product categories with widely available post-quantum support and tells buyers to acquire only PQC-capable products in those categories.11 | Federal buyers | Guidance | |
| The White House | Executive Order 14412 signed. It requires post-quantum key establishment by December 31, 2030 and post-quantum signatures by December 31, 2031 for federal high value assets and high impact systems.1 | Federal agencies, military departments included; national security systems excluded | Binding | |
| OMB | M-26-15 orders agencies to migrate their highest-risk systems first, mitigating as much quantum risk as feasible by December 31, 2030. Plans should run in five phases: discovery 2026 to 2027, pilots 2027 to 2028, key establishment 2028 to 2030, signatures 2031, full migration 2035.8 | Federal agencies; national security systems excluded | Binding | |
| Federal agencies | Post-quantum migration plans due to OMB and the National Cyber Director.8 | Federal agencies; national security systems excluded | Binding | |
| NIST | IR 8547 final. RSA, elliptic-curve and finite-field key exchange and signatures deprecated after 2030 and disallowed after 2035.6 | Systems that follow NIST standards | Standard | |
| FAR Council | Proposed rule due requiring covered contractors to comply by December 31, 2030 with NIST’s FIPS, including all applicable FIPS that incorporate post-quantum algorithms.1 | Covered federal contractors, once adopted | Pending | |
| FAR Council and CISA | Proposed rule due for contractor vulnerability disclosure programs to accept reports of cryptographic weaknesses. CISA guidance due on the minimum elements of a cryptographic bill of materials.1 | Covered federal contractors, once the rule is adopted; the CISA guidance is advisory | Pending | |
| Federal agencies | Support TLS 1.3 or a successor.5 | Federal agencies | Binding | |
| Federal agencies | High value assets and high impact systems use post-quantum cryptography for key establishment.1 | Federal agencies, military departments included; national security systems excluded | Binding | |
| Federal contractors | Comply with NIST’s post-quantum FIPS, if the FAR rule is adopted as ordered.1 | Covered federal contractors | Pending | |
| Federal agencies | High value assets and high impact systems use post-quantum digital signatures.1 | Federal agencies, military departments included; national security systems excluded | Binding | |
| Federal government | Target for completing the federal migration: the NSM-10 goal, which NIST says remains in place, and M-26-15 phase five.8 | Federal agencies | Guidance | |
| NIST | Quantum-vulnerable public-key algorithms disallowed under NIST standards and guidelines after 2035.6 | Systems that follow NIST standards | Standard |
Gulf states.
Saudi Arabia’s central bank has the only dated duties. Kuwait and the UAE have binding text without dates. Qatar, Bahrain and Oman have no published rule that we found.
- Saudi Arabia
- SAMA’s circular sets the only dated quantum duties we found in the Gulf: December 31, 2026 and March 31, 2027. The NCA’s binding National Cryptographic Standards, NCS-1:2020, were written assuming no quantum computers exist and say post-quantum cryptography will come in a later version.2,25
- United Arab Emirates
- Control T3.4.4 of the national Information Assurance Standard, applied on a risk basis, requires a public-key inventory and lab testing of post-quantum standards. The National Encryption Policy, announced on November 27, 2025, “defines requirements for key management, post-quantum cryptography, implementation, and ongoing performance monitoring”, says the government portal, which links the published text. The summary gives no dates.12,13,26
- Kuwait
- The central bank’s CORF requires a quantum readiness strategy with timelines and milestones, without a completion date.14
- Qatar
- We found no published post-quantum rule. The NCSA’s September 2026 licensing form lists post-quantum cryptography assessment and quantum key distribution implementation as cybersecurity services a firm can add to its license. Ooredoo, HBKU and the Ministry of Defense run a quantum key distribution testbed on Ooredoo’s network.27,28
- Bahrain
- We found no published post-quantum rule from the CBB or the NCSC. The NCSC’s baseline controls do not mention quantum computing.29
- Oman
- We found no published post-quantum rule. The Ministry of Transport, Communications and Information Technology published “Quantum Computing: Challenges and Opportunities” on June 1, 2026, an awareness guide under the National Digital Economy Program. It sets no requirements and lists the potential to break current encryption among the risks.30
For Gulf regulators’ rules on security testing, see testing rules.
| Date | Who | What | Applies to | Force |
|---|---|---|---|---|
| UAE Cyber Security Council | Information Assurance Standard v2.1, control T3.4.4: keep an inventory of systems that use public-key cryptography and test post-quantum standards in a lab before production. No completion date.12 | Federal entities and critical information infrastructure | Binding | |
| UAE | National Encryption Policy and its executive regulation announced. The regulation calls on government entities to develop approved plans for the move to post-quantum cryptography. The policy text has since been published; the government portal’s summary gives no dates.13 | Government entities | Binding | |
| Central Bank of Kuwait | CORF v1.0, controls 7.1.4.1 to 7.1.4.4: adopt quantum-resistant algorithms, assess cryptographic practices periodically, and keep a quantum readiness strategy with timelines and milestones. No completion date.14 | CBK-regulated banks and financial institutions | Binding | |
| SAMA | Circular 482021280 on quantum computing risks issued and in force.2 | Banks, finance companies, payment service providers and credit bureaus | Binding | |
| SAMA | Procedures for identifying and classifying all cryptographic assets accurate and complete, “by the end of the fourth quarter of 2026”.2 | Banks, finance companies, payment service providers and credit bureaus | Binding | |
| SAMA | Enterprise-level assessment of quantum computing risks, with action plans, “by the end of the first quarter of 2027”.2 | Banks, finance companies, payment service providers and credit bureaus | Binding |
Other governments.
Allies converge on about 2030 for priority systems and 2035 for the rest. Most of it is guidance.
| Date | Who | What | Applies to | Force |
|---|---|---|---|---|
| UK NCSC | Discovery and an initial plan by 2028, highest-priority migration by 2031, all systems by 2035.4 | UK organizations | Guidance | |
| EU NIS Cooperation Group | First steps and national roadmaps by the end of 2026, high-risk use cases by the end of 2030, medium-risk by the end of 2035.3 | EU member states | Guidance | |
| Government of Canada | Departmental plans by April 1, 2026, high-priority systems migrated by the end of 2031, the rest by the end of 2035.7 | Federal departments | Binding |
Financial sector.
Outside the Gulf, financial rules on quantum are advisory. The OCC says banks should consider how to monitor quantum computing, and Treasury launched a sector task force in August 2026. We found no post-quantum deadline from the OCC, Federal Reserve, FFIEC, SEC or NYDFS as of October 28, 2026.
| Date | Who | What | Applies to | Force |
|---|---|---|---|---|
| PCI Security Standards Council | PCI DSS 4.0 requirement 12.3.3 takes effect: document the cipher suites and protocols in use and review them at least every 12 months.15 | Entities that store, process or transmit card data | Contractual | |
| G7 Cyber Expert Group | Suggests critical financial systems move in 2030 to 2032 and the sector by about 2035. States that it sets no regulatory expectations.16 | G7 financial sectors | Guidance | |
| OCC | Cybersecurity report: banks and service providers “should be aware of the risk implications and should consider how to effectively monitor developments in quantum computing as they manage future infrastructure investments.” No deadline.17 | OCC-supervised banks and their service providers | Guidance | |
| PCI Security Standards Council | FAQ 1491: “It is considered best practice to implement TLS versions and cipher suites that support forward secrecy and the implementation of ciphers utilizing post-quantum cryptography (for key exchange and end-point authentication).” No date.18 | Entities that store, process or transmit card data | Guidance | |
| US Treasury | Quantum-Readiness Task Force launched, “a public-private initiative to help accelerate the U.S. financial sector’s transition to quantum-safe technology”. Three workstreams: sector alignment and PQC transition, third-party and vendor readiness, and digital assets and emerging technology risk. The release sets no duties or dates.19 | US financial sector | Guidance |
Standards.
The standards the deadlines point to, and the ones still being written.
| Date | Who | What | Applies to | Force |
|---|---|---|---|---|
| NIST | HQC selected as a backup key-encapsulation algorithm. NIST planned a draft in about a year and a final standard in 2027. No draft had appeared by October 27, 2026.20 | Standards process | Standard | |
| IEEE Standards Association | P802.11bt approved: an amendment project to extend Wi-Fi security to post-quantum algorithms.21 | Wi-Fi equipment and networks | Pending | |
| NIST | CSWP 39upd1 on crypto agility published, superseding CSWP 39 of December 19, 2025. It defines crypto agility as “the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations.”22 | Advisory white paper, for any organization | Guidance | |
| NIST | The HAWK team withdrew its scheme from round 3 of the additional signature process after Anthropic announced its AI model had found a mathematical vulnerability.23 | Standards process | Standard | |
| IETF | RFC 10024 published as a Proposed Standard: hybrid ML-KEM key agreement for TLS 1.3, including X25519MLKEM768.24 | TLS implementations | Standard |
Sources.
Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.
- 1 Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026 Checked October 29, 2026.
- 2
- 3
- 4 Timelines for migration to post-quantum cryptography, UK NCSC, March 20, 2025 Checked October 28, 2026.
- 5 Executive Order 14306, June 6, 2025 Checked October 28, 2026.
- 6 NIST IR 8547, Transition to Post-Quantum Cryptography Standards, final, October 27, 2026 Checked October 30, 2026.
- 7 Migrating the Government of Canada to post-quantum cryptography, Government of Canada Checked October 28, 2026.
- 8 OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026 Checked October 28, 2026.
- 9 National Security Memorandum 10, The White House, May 4, 2022 Checked October 28, 2026.
- 10 Post-quantum cryptography publications, NIST Checked October 28, 2026.
- 11 Product categories for technologies that use post-quantum cryptography standards, CISA, January 23, 2026 Checked October 28, 2026.
- 12 UAE Information Assurance Standard v2.1, UAE Cyber Security Council, November 2025 Checked October 28, 2026.
- 13 UAE announces approval of National Encryption Policy, WAM report as carried by Tribune India, November 27, 2025 Checked October 28, 2026. Secondary copy; the primary source could not be reached.
- 14 Cyber and Operational Resilience Framework (CORF) v1.0, Central Bank of Kuwait, December 3, 2025 Checked October 29, 2026.
- 15 Summary of changes from PCI DSS version 3.2.1 to 4.0, PCI Security Standards Council Checked October 28, 2026.
- 16
- 17
- 18 FAQ 1491, which versions of TLS PCI DSS requires, PCI Security Standards Council, July 2026 Checked October 30, 2026.
- 19 Treasury announces the Quantum-Readiness Task Force, US Department of the Treasury, August 24, 2026 Checked October 30, 2026.
- 20 NIST selects HQC as fifth algorithm for post-quantum encryption, NIST, March 11, 2025 Checked October 28, 2026.
- 21 P802.11bt project authorization request, IEEE Standards Association, approved September 10, 2025 Checked October 30, 2026.
- 22
- 23
- 24
- 25 National Cryptographic Standards NCS-1:2020, National Cybersecurity Authority, Saudi Arabia Checked October 28, 2026.
- 26 National Encryption Policy, UAE government portal (u.ae), updated July 2, 2026 Checked October 30, 2026.
- 27
- 28
- 29 Baseline Cybersecurity Controls, NCSC-CP-D22-0001, National Cyber Security Center, Bahrain, January 2022 Checked October 30, 2026.
- 30
Discuss an engagement privately.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.