PQC Timelines at a Glance

From Future Topic to Migration Task

Post-quantum cryptography, often abbreviated as PQC, was long treated primarily as a topic for research and standardization. That has changed:

• NIST has published the first finalized PQC standards.
• The EU is pursuing a coordinated implementation roadmap.
• Germany’s BSI has included specific migration timelines in its recommendations.
• The UK’s NCSC describes a phased model through 2035.
• The U.S. government has set deadlines for prioritized systems.

This also changes the perspective for companies. The question is no longer whether they should address quantum-safe cryptography. What matters now is how quickly they can identify their cryptographic dependencies, assess them, and move toward PQC in a planned way.

This is especially challenging for complex organizations. Cryptography is embedded in TLS connections, VPNs, email security, code signing, firmware updates, identity systems, HSMs, cloud services, applications, machines, gateways, and OT and IoT devices. Many of these components have evolved over years. Often, organizations do not have a complete view of which algorithms, keys, certificates, and protocols are used where.

That is why current PQC timelines matter: they provide orientation, define priorities, and make it clear that the shift cannot wait until a cryptographically relevant quantum computer becomes available.

Why Today’s Cryptography Is Under Pressure

Many asymmetric algorithms used today are based on mathematical problems that are difficult for conventional computers to solve. These include RSA, Diffie-Hellman, and algorithms based on elliptic curves. They secure connections, digital signatures, certificates, and many identity mechanisms.

A sufficiently powerful quantum computer would change this foundation. Asymmetric mechanisms for key exchange, digital signatures, and certificate infrastructures are particularly affected. Symmetric algorithms such as AES and hash functions are less central to the migration, since the associated risks can often be addressed by choosing appropriate key and hash lengths.

Harvest Now, Decrypt Later: Why the Threat Already Matters Today

A quantum computer does not have to be available today for a risk to exist. For confidential data with long-term protection requirements, the so-called “harvest now, decrypt later” scenario is already relevant: attackers can collect and store encrypted communications today and decrypt them later once the necessary computing power is available.

This is especially relevant for information that must remain confidential for years to come, such as trade secrets, research data, health data, industrial development data, financial information, or information from critical infrastructure. For this type of data, risk assessment does not begin on the day a cryptographically relevant quantum computer exists. It begins when data is transmitted, stored, or archived.

Key PQC Timelines at a Glance

Current PQC roadmaps differ in perspective and degree of obligation. Some provide technical standards, others define policy targets or describe practical migration phases. For companies, the important question is not only which years are mentioned, but also what role each source plays.

Taken together, the different sources point in a clear direction: the second half of the 2020s is the preparation phase. Prioritized migration steps follow in the early 2030s. By the mid-2030s, the transition is expected to be implemented for many systems.

The comparison shows that there is no single global PQC deadline for all companies. However, the roadmaps point in the same direction. Organizations should create transparency now, identify prioritized systems, and prepare the technical shift.

NIST: Standards as the Technical Foundation

With FIPS 203, FIPS 204, and FIPS 205, NIST has published the first finalized standards for key PQC use cases. FIPS 203 describes ML-KEM for key encapsulation and the secure exchange of key material. FIPS 204 describes ML-DSA for digital signatures. FIPS 205 describes SLH-DSA as a hash-based signature algorithm.

This gives many applications an implementation foundation that organizations can use for testing and planning.

U.S. Government: Deadlines for Prioritized Systems

With its Executive Order of June 22, 2026, the U.S. government has significantly tightened the timeline for prioritized systems. For High Value Assets and High Impact Systems in U.S. federal agencies, PQC algorithms for key establishment are to be introduced by the end of 2030; digital signatures for these systems are to be transitioned by the end of 2031.

For companies that are not part of the U.S. federal government, these deadlines are not automatically binding. However, they influence supply chains, vendor roadmaps, procurement decisions, and international security programs.

EU: Coordinated Migration in Europe

The EU is pursuing a coordinated implementation roadmap for the move to post-quantum cryptography. Member states are expected to develop strategies and align implementation across Europe.

This places PQC in the broader context of digital sovereignty, critical infrastructure, and long-term cyber resilience.

BSI: Specific Recommendations for Germany

For Germany, BSI TR-02102-1 is particularly relevant. Version 2026-01 addresses PQC migration timelines, hybridization, and the foreseeable phase-out of today’s asymmetric algorithms.

The BSI recommends using today’s key-agreement mechanisms on their own only until the end of 2031; established signature algorithms are currently classified through the end of 2035. Since quantum-safe algorithms still need to gain broader practical adoption, hybrid approaches play an important role during the transition phase.

NCSC UK: Migration as a Phased Model

NCSC UK describes PQC migration as a multi-year transformation program: by 2028, organizations should have completed discovery, assessment, and initial planning. By 2031, prioritized migration steps should be implemented. By 2035, the migration of all systems, services, and products should be complete.

This phased model makes it especially clear that PQC should not be understood as a short-term algorithm swap.

What the Timelines Have in Common

The roadmaps set different priorities, but they lead to the same conclusion: organizations first need visibility. They need to know which cryptographic algorithms they use, which systems depend on them, and where long-term protection requirements exist.
The secure exchange of key material comes into focus particularly early, often referred to as key establishment in technical standards. If confidential communications can be recorded today, organizations need to assess whether they will remain protected in the future.
Digital signatures follow a different risk logic, but they are also critical: once today’s signature algorithms become vulnerable, the authenticity, integrity, and trustworthiness of certificates, software, firmware, and documents are called into question.
The transition to PQC is therefore not an isolated cryptography project. It affects IT security, enterprise architecture, PKI teams, application owners, compliance, procurement, supplier management, and operations teams.

What Companies Should Prepare Now

The right starting point is not the immediate replacement of individual algorithms, but a reliable inventory. This requires a cryptographic inventory that captures certificates, keys, algorithms, protocols, libraries, deployment locations, responsibilities, and protection requirements. Tools such as essendi cd can help structure the collection of certificates and cryptographic parameters and make them usable as a basis for assessment and prioritization.

Based on this inventory, companies can assess which data and systems need to remain protected beyond 2030 or 2035. Environments with long-term confidentiality requirements are especially relevant, as are external interfaces, VPNs, TLS, identity systems, PKI, code signing, firmware updates, HSMs, cloud services, and production-related OT and IoT environments.

The next step is practical testing. This means evaluating which libraries, HSMs, CAs, clients, protocols, and applications support PQC or hybrid approaches. The focus is not only on cryptographic security, but also on compatibility, performance, certificate size, and operational processes.

Clear responsibilities are equally important. PQC should be planned as a multi-year program, not as an isolated task for a single department. Visibility creates room to act: companies can prioritize, test, and transition step by step before suppliers, products, budgets, or expertise become bottlenecks.

Support from essendi it

This creates a clear task for organizations: they need to understand, assess, and manage their cryptographic landscape. This is where essendi it comes in.

essendi cd captures certificates and cryptographic parameters, creating a foundation for cryptographic inventory, assessment, and prioritization. essendi xc centrally manages and automates certificate processes — from request and issuance to renewal, deployment, and monitoring.

In addition, essendi it supports companies in analyzing their current situation, prioritizing affected systems, and planning their post-quantum transition.

Want to Go Deeper into the Technical Details?

The current timelines show when companies should act. The next article looks at what needs to change at the technical level: the roles of ML-KEM, ML-DSA, and SLH-DSA, and why post-quantum cryptography is especially relevant for certificates, PKI structures, and automated certificate processes.