The NCSC PQC migration timeline: what to do by 2028, 2031 and 2035.

Why there is a deadline at all

Most of today’s secure communication depends on public-key cryptography: RSA and elliptic-curve cryptography (ECC), used for key exchange, digital signatures and certificates. A large enough quantum computer could break these algorithms. Nobody knows exactly when such a machine will exist, but the risk already applies today.

The reason is “harvest now, decrypt later”. An adversary can record encrypted traffic now and store it until it can be decrypted. If your data must stay confidential for ten years or more, such as health records, intellectual property, government or financial data, the exposure has already begun.

Migration is also slow. The NCSC describes it as “a mass technology change that will take a number of years”. Cryptography is built into applications, devices, networks, certificates and supplier products, so changing it means finding it first.

The three NCSC milestones

The NCSC published Timelines for migration to post-quantum cryptography in March 2025. It sets indicative target dates for UK industry, government and regulators.

1. 2028 Discovery and planning

   Define your migration goals. Complete discovery and assessment of your cryptographic dependencies. Build an initial plan covering priorities, supplier and infrastructure dependencies, investment and any long-lived hardware roots of trust. Tell your suppliers what you need.

2. 2031 Early migration

   Complete your highest-priority migration activities to protect your most critical assets. Prepare your infrastructure for PQC, and refine the plan into a clear route to full migration.

3. 2035 Full migration

   Complete migration of all your systems, services and products to PQC. The NCSC accepts there will be a tail of harder cases, but expects every organisation to work towards this date.

The important point is that 2028 is not a migration deadline. It is a knowledge deadline: you cannot prioritise, budget or brief suppliers until you know where your cryptography is and what it protects.

What discovery and assessment involve

The NCSC lists the activities it expects in the discovery phase. In summary:

• identify your key services and applications;
• record the data you hold, how long it must stay protected and how valuable it would be to an adversary;
• document how data is protected in transit and at rest;
• map the systems that process it, including those hosted or managed by third parties;
• cover the whole estate: servers, network devices, mobile devices, IoT and industrial control systems, end-user tokens and field sensors;
• record versions and patch levels, and the dependencies between components.

For each system you then choose a strategy: replace in place, re-platform, retire, run to end of life, or accept the risk for now. The NCSC also asks you to plan for cryptographic agility, so systems can switch algorithms without being rebuilt.

Many organisations record the result as a cryptographic bill of materials (CBOM): a structured inventory of the algorithms, keys, certificates, protocols and libraries in each application or system. CBOM is an industry practice rather than an NCSC requirement, and the NCSC says discovery “is not intended to be a formal asset register”. A CBOM is still the most practical way to keep the inventory current as systems change.

How the NIST timeline lines up

The US National Institute of Standards and Technology (NIST) published the final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards, in October 2026. It says quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed after 2035.

For UK organisations this matters because many of your suppliers sell into the US federal market. Expect vendor roadmaps, product certifications and procurement questions to follow the NIST dates. The two timelines point to the same end date of 2035.

Does the timeline apply to you?

The NCSC aims the guidance mainly at:

• large organisations;
• operators of critical national infrastructure;
• organisations with bespoke or custom-built IT.

Smaller organisations that run commodity IT can generally expect their vendors to deliver PQC through normal updates. But any custom software you own follows the same timetable as larger organisations, and you will still need to ask your suppliers when and how they will migrate.

The new algorithms

The NCSC points to the NIST standards published in 2024:

• ML-KEM (FIPS 203) for key establishment;
• ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures;
• LMS and XMSS (NIST SP 800-208), earlier hash-based signatures with more limited uses.

Several major browsers already use hybrid key exchange, which combines a traditional algorithm with ML-KEM. The NCSC notes that standards for PQC in protocols such as TLS are still being finalised, and that web PKI and industrial protocols are among the harder areas.

A practical plan for reaching 2028

Two years sounds a long time, but discovery across a large estate, followed by supplier engagement and budgeting, takes most of it. A workable sequence is:

1. Step 01

   Name an owner and set goals

   Give one person accountability, and agree what “done by 2028” means for your organisation.

2. Step 02

   Run cryptographic discovery

   Combine automated scanning of networks, applications and cloud with interviews and supplier questionnaires. Record the results as an inventory or CBOM.

3. Step 03

   Assess and prioritise

   Rank systems by the lifetime and value of the data they protect, and by how hard they will be to change.

4. Step 04

   Engage suppliers

   Share a statement of intent and ask each critical supplier for their PQC roadmap.

5. Step 05

   Plan and budget

   Turn the priorities into a costed roadmap for 2031 and 2035, with rollback and continuity plans.

6. Step 06

   Pilot

   Test hybrid or post-quantum options on one high-value system, and confirm it actually negotiates PQC rather than falling back.

Common questions

Is the NCSC timeline mandatory?

The NCSC describes its dates as indicative targets rather than legal requirements. Regulators, government buyers and large customers are likely to use them as a benchmark, so treat them as the expected standard.

We use cloud services. Is the provider responsible?

Partly. Major cloud providers are adding PQC to their own services, but you remain responsible for your applications, keys, certificates and the configuration you choose. Discovery should cover what runs on the cloud, not only the cloud itself.

Can we wait until 2030 and migrate everything at once?

That leaves no time to find hidden dependencies, wait for supplier updates or replace long-lived hardware. It also leaves long-life data exposed to “harvest now, decrypt later” in the meantime.

What is the difference between PQC and QKD?

Post-quantum cryptography (PQC) uses new mathematical algorithms that run on existing hardware. Quantum key distribution (QKD) uses physics to share keys. The NCSC’s migration timeline is about PQC. Our Quantropi page explains digital QKD, which delivers QKD-style keys over ordinary networks.