Home / Tools / Post-quantum deadlines
Free tool · runs in your browser
Post-quantum cryptography deadlines: NIST, NSA CNSA 2.0, UK and EU
The short version: NIST proposes deprecating RSA-2048-class algorithms after 2030 and disallowing all quantum-vulnerable public-key cryptography after 2035. The NSA wants national security systems on CNSA 2.0 algorithms by 2030 to 2033 depending on the product, and the UK and EU both target 2035.
Built by Kyeson Blake Utley for the free Quantum Defense course.
Every date in one table
| When | Authority | Milestone |
|---|---|---|
| May 2022 | US · White House, OMB, Congress | NSM-10 signed Published US national security memorandum: mitigate quantum risk "to the maximum extent feasible by 2035". |
| Sep 2022 | US · NSA (CNSA 2.0) | CNSA 2.0 announced Published NSA names the algorithms for US national security systems: ML-KEM-1024, ML-DSA-87, LMS/XMSS, AES-256, SHA-384/512. |
| Nov 2022 | US · White House, OMB, Congress | OMB M-23-02 Published Federal civilian agencies must submit a prioritized inventory of quantum-vulnerable cryptographic systems every year (first due May 2023) through 2035. |
| Dec 2022 | US · White House, OMB, Congress | Quantum Computing Cybersecurity Preparedness Act Published Signed 21 December 2022. Directs OMB to guide federal agencies' migration to post-quantum cryptography. |
| Aug 2024 | US · NIST | FIPS 203, 204, 205 published Published 13 August 2024: ML-KEM, ML-DSA and SLH-DSA become federal standards. |
| Nov 2024 | US · NIST | NIST IR 8547 (initial public draft) Published Proposes the end dates for quantum-vulnerable public-key algorithms (see 2030 and 2035). Still a draft. |
| Mar 2025 | US · NIST | HQC selected Published 11 March 2025: code-based HQC picked as a backup KEM. Draft standard expected later. |
| Mar 2025 | UK · NCSC | NCSC migration timelines Published UK guidance sets three milestones: 2028, 2031, 2035. |
| Jun 2025 | EU | EU coordinated roadmap Published Member States' joint roadmap for the transition to PQC. |
| 2025 | US · NSA (CNSA 2.0) | Support & prefer: software/firmware signing; browsers, servers, cloud Deadline / target CNSA 2.0 systems should support and prefer the new algorithms in these categories. |
| 2026 | US · NSA (CNSA 2.0) | Support & prefer: traditional networking equipment Deadline / target VPNs, routers and similar gear in national security systems. |
| 2026 | EU | Start the transition (by end of 2026) Deadline / target All Member States should start transitioning to PQC by the end of 2026. |
| 2027 | US · NSA (CNSA 2.0) | Support & prefer: operating systems Deadline / target CNSA 2.0 milestone for OS vendors. |
| 2028 | UK · NCSC | Discovery and plan Deadline / target Define migration goals, complete discovery of where cryptography is used, build an initial plan. |
| 2030 | US · NSA (CNSA 2.0) | Exclusive: software/firmware signing; traditional networking Deadline / target CNSA 2.0 algorithms only. Also: niche equipment should support and prefer them. |
| 2030 | US · NIST | Deprecate 112-bit quantum-vulnerable algorithms (proposed) Proposed (draft) Draft IR 8547: RSA-2048 and other quantum-vulnerable algorithms at 112-bit security deprecated after 2030. |
| 2030 | EU | High-risk use cases migrated (by end of 2030) Deadline / target Protect high-risk use cases with PQC no later than the end of 2030. |
| 2031 | UK · NCSC | Highest-priority migration done Deadline / target Early, highest-priority migrations complete; roadmap refined. |
| 2033 | US · NSA (CNSA 2.0) | Exclusive: browsers, servers, cloud, operating systems, niche equipment Deadline / target Custom applications and legacy equipment must be updated or replaced by 2033 too. |
| 2035 | US · White House, OMB, Congress | NSM-10 target Deadline / target Federal systems: quantum risk mitigated to the maximum extent feasible. |
| 2035 | US · NIST | Disallow all quantum-vulnerable public-key algorithms (proposed) Proposed (draft) Draft IR 8547: RSA, ECDSA, ECDH, DH and friends disallowed after 2035. |
| 2035 | UK · NCSC | Migration complete Deadline / target All systems, services and products migrated to PQC. |
| 2035 | EU | As many systems as feasible Deadline / target Transition as many systems as feasible by 2035. |
Which dates apply to you
- US federal civilian agencies follow OMB M-23-02 (an annual inventory of quantum-vulnerable systems through 2035) and NIST’s standards, including the end dates proposed in draft NIST IR 8547.
- US national security systems and their vendors follow NSA’s CNSA 2.0, the strictest clock: exclusive use of the new algorithms by 2030 for software and firmware signing and networking equipment, and by 2033 for browsers, servers, cloud services, operating systems and niche equipment.
- UK organizations have the NCSC’s three milestones: discovery and a plan by 2028, highest-priority migration by 2031, everything by 2035.
- EU Member States agreed a coordinated roadmap: start by the end of 2026, protect high-risk use cases by the end of 2030, and move as many systems as feasible by 2035.
Even if none of these binds you directly, they set the pace of what vendors ship: browsers, operating systems and VPNs are built once for everyone. Three caveats: IR 8547 is still a draft, CNSA 2.0 applies only to national security systems, and the NCSC and EU dates are guidance and roadmap targets, not laws.
This tool comes from Lesson 9: The deadlines: who requires what, and when, part of a free 18-lesson post-quantum cryptography course. Every figure there links to its source.
Questions
When will RSA be deprecated?
NIST's draft IR 8547 proposes deprecating quantum-vulnerable algorithms at the 112-bit security level, such as RSA-2048, after 2030, and disallowing all quantum-vulnerable public-key algorithms (RSA, ECDSA, ECDH, DH and similar) after 2035. It is an initial public draft, so the dates could change.
What are the CNSA 2.0 deadlines?
CNSA 2.0 sets dates by product category. Software and firmware signing and traditional networking equipment must use the new algorithms exclusively by 2030; browsers, servers, cloud services, operating systems and niche equipment by 2033. Custom and legacy equipment must be updated or replaced by 2033.
Are these deadlines legally binding?
It depends on the source. OMB memoranda and CNSA 2.0 bind US federal agencies and national security systems respectively. NIST IR 8547 is a draft proposal, and the UK NCSC and EU dates are guidance and roadmap targets.
What should an organization do first?
Build a cryptographic inventory: find where public-key cryptography is used, then prioritize long-lived data and key exchange, which harvest-now-decrypt-later already threatens.