Vendor PQC Timeline
When will your technology stack be quantum-safe? Track the post-quantum cryptography roadmaps of major vendors.
Last Updated: September 2026 | Next Update: November 2026
The hard truth: Even if you identify every vulnerable cryptographic implementation today, you cannot remediate most of them until your vendors ship PQC support. Oracle shipped post-quantum TLS in Java 27 in September 2026 and backported PQC to every supported LTS JDK. Google Cloud turns on post-quantum key exchange by default in October 2026. Microsoft, Google and Cloudflare are all now targeting 2029. Plan your migration around vendor reality.
Major Vendor PQC Roadmaps
Current status and projected timelines from key technology providers (as of September 2026).
| Vendor | Status | Key Milestone | Full PQC Target |
|---|---|---|---|
| .NET / C# | Active | .NET 10 GA with ML-KEM, ML-DSA, SLH-DSA via System.Security.Cryptography | Now available (.NET 10) |
| Akamai | Active | PQC in TLS 1.3 for both client-to-Akamai and Akamai-to-origin connections, on by default for all Enhanced TLS customers since March 2026 | Now on by default |
| Apple | Active | CryptoKit PQC APIs (iOS 26, macOS Tahoe). Auto PQ-TLS (X25519MLKEM768) in all OS. iMessage PQ3 | Now available (iOS 26+) |
| AWS | Active | PQ-TLS across S3, KMS, ACM, Secrets Manager, CloudFront, ALB/NLB, Private CA (ML-DSA), Payments Cryptography. CRYSTALS-Kyber removed from AWS endpoints in 2026 in favour of ML-KEM | Phased — no published completion date |
| Cloudflare | Active | Over two-thirds of browser traffic PQ-encrypted. Post-quantum authentication deployment has begun. Cloudflare One covers TLS, MASQUE and IPsec | 2029 full PQ security (PQ encryption 2030, PQ authentication 2031) |
| Dell | Planned | CNSA 2.0 compliant hardware, crypto agility in BIOS/firmware | 2027-2030 hardware phase-out |
| Google Cloud | Active | PQ key exchange enabled by default on Cloud Load Balancers from October 2026. Cloud KMS ML-KEM/ML-DSA/SLH-DSA GA. Chrome, Android 17 (ML-DSA Verified Boot), Tink library | 2029 full PQC — SNDL end-2027, signatures end-2028, key management end-2028 |
| IBM | Active | Guardium Cryptography Manager for crypto posture management and PQC remediation | Now available |
| Java (Oracle JDK / OpenJDK) | Active | Java 27 (15 Sep 2026) adds JEP 527 hybrid post-quantum key exchange for TLS 1.3. PQC backported across Oracle JDK LTS releases: 25, 21, 17, 11 and 8 | Now available (Java 27 + LTS backports) |
| Microsoft | Active | PQC APIs GA on Windows (SymCrypt ML-KEM / ML-DSA). AD CS ML-DSA certificate issuance GA (May 2026). Windows signing moves to RSA-3072/SHA-384 by end 2026, then PQC-by-default Windows Production signing in 2027 | 2029 full transition (accelerated from 2033) |
| Node.js | Active | Linked to OpenSSL 3.5+, hybrid key exchange in crypto module | Now available |
| OpenSSL | Active | OpenSSL 4.0 (Apr 2026): ML-KEM, ML-DSA and SLH-DSA in the default and FIPS providers, plus Encrypted Client Hello and the SM2MLKEM768 group. OpenSSL 4.1 due Oct 2026 | Now available (4.0) |
| Oracle | Active | Java 27 with JEP 527 hybrid PQ key exchange for TLS 1.3 (Sep 2026), backported to LTS JDK 25/21/17/11/8. AI Database 26ai hybrid PQC TLS (ECDHE + ML-KEM) | 2026 cloud, 2027+ full database |
| PHP | Pending | RFC under discussion to expose OpenSSL provider-based algorithms and generic KEM encapsulation (ML-KEM, ML-DSA, SLH-DSA) through ext/openssl | TBD no native PQC in a stable release |
| Red Hat | Active | RHEL 10.1 DEFAULT crypto policy enables and prefers PQC for TLS and SSH. RPMs signed with a hybrid ML-DSA-87 + Ed448 key (RHEL 9.7+ and 10) — first major Linux distribution to do so. PQC key exchange live on cdn.redhat.com and subscription.rhsm.redhat.com since 2 Jun 2026 | Now PQC by default (RHEL 10.1) |
| Salesforce | Planned | RSA key exchanges phased out for TLS, pushing TLS 1.3 as PQC prerequisite | TBD TLS 1.3 migration underway |
| SAP | Active | Cryptographic Library v8.6 with quantum-safe TLS 1.3 (X25519MLKEM768). BTP Cloud Foundry PQC root CAs. Cryptography Centre of Excellence governs migration and maintains a CBOM inventory | 2029 post-quantum ready across products and infrastructure |
| STMicroelectronics | Active | ST54M mobile chip with hardware PQC accelerator (ML-KEM, ML-DSA) for NFC, eSIM and secure element (Jun 2026) | Jul 2026 full production |
| Ubuntu | Active | Ubuntu 26.04 LTS ships post-quantum-aware crypto defaults with no migration toggle required, plus OpenSSH 10.2 which warns when a non-post-quantum key agreement is negotiated | Now PQC by default (26.04 LTS) |
| VMware / Broadcom | Active | vDefend and Avi Load Balancer with NIST-approved PQC + HSM integration | Now available |
Network & Security Vendors
VPN, firewall, and network infrastructure PQC support status.
| Vendor | Status | PQC Capability |
|---|---|---|
| Check Point | Active | R82 release supports ML-KEM (Kyber) for IPsec VPNs and IKEv2 |
| Cisco | Active | IOS XE 26.1 adds native ML-KEM for IPsec, DMVPN and FlexVPN via IKEv2. IOS XE 26.2 adds ML-DSA signatures for IKEv2, making site-to-site tunnels quantum-safe end to end. C9350 smart switches add ML-KEM-based PQC MACsec |
| Fortinet | Active | FortiOS 8.0 adds ML-DSA and SLH-DSA signature authentication for IKEv2 VPNs and PQC for agentless VPN, on OpenSSL 3.5. ML-KEM plus BIKE, HQC and Frodo for IPsec key exchange across FortiGate NGFW and SD-WAN |
| HP / HPE | Active | Silicon Root of Trust and PQC-ready firmware for ProLiant servers |
| Palo Alto | Active | Quantum-Safe Security GA 30 Jan 2026. PAN-OS 12.1 “Orion” cipher translation upgrades classical TLS to quantum-safe on the firewall, plus 14 quantum-optimised 5th-generation NGFW models |
PQC Services from Major Providers (2026)
Specific quantum-safe services and protocols available today.
| Provider | PQC Service | Algorithm | Use Case |
|---|---|---|---|
| Akamai | Enhanced TLS (client-to-edge and edge-to-origin) | X25519MLKEM768 | On by default for all Enhanced TLS customers since March 2026 |
| Apple | iMessage (PQ3), Secure Enclave | ML-KEM-1024, ML-DSA | Secure messaging with self-healing re-keying, firmware verification |
| AWS | KMS, Secrets Manager, ACM, CloudFront, S3, ALB/NLB, Private CA, Payments Cryptography | Hybrid ML-KEM (PQ-TLS), ML-DSA (signing) | API calls, storage, load balancing, certificates, payment processing |
| Cloudflare | CDN edge, WARP client, origin connections, Cloudflare One (TLS, MASQUE, IPsec) | X25519MLKEM768 | Over two-thirds of browser traffic PQ-encrypted. Automatic PQ for all customers, every plan, at no extra cost |
| Cloud Load Balancing, Cloud KMS (KEMs + signatures), Chrome, Tink Library, all internal comms | ML-KEM-768/1024, ML-DSA, SLH-DSA, X-Wing | PQ key exchange on by default for load balancers from Oct 2026. Hybrid key exchange, TLS handshakes, digital signatures, developer APIs | |
| Meta | Internal Infrastructure, WhatsApp | Hybrid ML-KEM/ML-DSA, PQ-X3DH | Data center traffic protection, E2E encryption |
| Microsoft | Azure Key Vault, Entra ID, Windows, AD CS (ML-DSA certificates) | SymCrypt (ML-KEM / ML-DSA) | Key storage, identity verification, OS-level support, enterprise PKI certificate signing |
| SAP | SAP Cryptographic Library v8.6, BTP Cloud Foundry | Hybrid ECDHE-MLKEM (X25519MLKEM768) | Quantum-safe TLS 1.3 handshakes for SAP applications |
| Signal | Signal Protocol: PQXDH plus the Triple Ratchet (Double Ratchet + Sparse Post-Quantum Ratchet) and ML-KEM Braid | ML-KEM-768, X25519 | Quantum-safe end-to-end messaging with forward secrecy and post-compromise security |
Key Industry Standards & Deadlines
NIST Standards
Global Baseline
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) are the baseline. FIPS 206 (FN-DSA, FALCON-based) remains unpublished — NIST has yet to release even an initial public draft, so build on ML-DSA rather than waiting for it. HQC was selected in March 2025 with a final standard expected 2027. NIST IR 8547: deprecate quantum-vulnerable algorithms by 2030, disallow by 2035.
CNSA 2.0 (NSA)
US National Security
Hard deadline: Systems handling national security information must be PQC-compliant by 2030 (software) and 2035 (hardware).
Executive Order 14412 & OMB M-26-15
US Federal Civilian (June 2026)
Signed 22 June 2026, with OMB memorandum M-26-15 setting the execution clock. High Value Assets and high-impact systems must move to post-quantum key establishment by 31 Dec 2030 and post-quantum signatures by 31 Dec 2031. Agencies named PQC migration leads within 30 days; OMB guidance on inventory review and transition timelines lands at 90 days (September 2026). At 180 days (December 2026) CISA and NIST must publish the minimum elements for a Cryptographic Bill of Materials, the FAR Council must propose contractor compliance rules for end of 2030, and NIST must accelerate CMVP validations. NIST's own migration pilot completes by 31 Dec 2027.
EU Coordinated PQC Roadmap
European Union
The European Commission recommends all Member States begin PQC transition by end of 2026; critical infrastructure by 2030. Under NIS2 and EuroQCI, essential entities must implement "state-of-the-art" cryptographic measures with hybrid schemes. France's ANSSI is making PQC mandatory for products entering qualification from 2027; its national certification centre updated the cryptographic approval doctrine in March 2025 and the first French security visas covering post-quantum cryptography have already been issued, to Thales and Samsung products.
UK NCSC
United Kingdom
Three-phase migration: discovery and migration planning by 2028, high-priority migration by 2031, complete migration by 2035 for government and critical national infrastructure. NCSC expects hardware acceleration for PQC to become available during 2026–27, which is a legitimate reason to schedule some remediation rather than force it early.
Canada CCCS
Canada
Federal PQC migration plans were due April 2026. From 1 April 2026 every Government of Canada contract with a digital component must carry procurement clauses requiring PQC support, CMVP-certified cryptographic modules and cryptographic agility — binding suppliers, not just departments. High-priority systems by 2031, all systems by 2035. HNDL-susceptible systems are highest priority.
CISA Product Categories
US Federal Procurement (Jan 2026)
Published 23 January 2026: agencies should plan acquisitions to procure only PQC-capable products in categories where such products are widely available — cloud services, web software, endpoint security and collaboration software. Networking hardware, databases, email and identity management are listed as still in transition. CISA's own caveat matters: most categories have implemented PQC for key encapsulation but not yet for digital signatures.
G7 & Financial Sector
Global Finance
The G7 Cyber Expert Group, chaired by the US Treasury and the Bank of England, issued a coordinated PQC roadmap on 12 January 2026: six phases from awareness through discovery and inventory to validation, with 2035 as the overall sector target and critical systems prioritised in 2030–32. The US Treasury launched a Quantum-Readiness Task Force on 24 August 2026 covering sector alignment, third-party and vendor readiness, and digital assets. France holds the 2026 G7 Presidency, with ANSSI leading the cyber working group on PQC.
Australia ASD
Australia
Most aggressive Western timeline, per the ISM updated March 2026: a refined transition plan by end 2026, transition commenced starting with critical systems by end 2028, and transition complete by end 2030 — Diffie-Hellman is not approved beyond 2030. ASD also publishes Post-quantum questions to ask your vendors (July 2026).
Global PQC Strategies
Different regions are taking different approaches to quantum security.
US / EU / UK / Canada
Software-First (PQC)
Focus on NIST-standardised PQC algorithms. The internet is too large to rewire with QKD hardware. Software patches can protect millions of devices overnight. Canada mandates federal PQC plans by April 2026 (ITSM.40.001).
China
Independent Standards + QKD
China launched its own independent PQC algorithm call in 2025, diverging from NIST. Stage A (2025 Q4 - 2026 Q4) focuses on national GB/T PQC standards. Also operates the 2,000km Beijing-Shanghai QKD Trunk Line.
Japan / Singapore / Australia
Tiered Approach
Japan's NCO mandates full PQC by 2035; CRYPTREC added ML-KEM to its Recommended Ciphers List on 30 March 2026, and a government-wide PQC migration roadmap is being developed during FY2026. Singapore's NQSN+ provides nationwide quantum-safe networking, and CSA, GovTech and IMDA published the Quantum-Safe Handbook V1 and Quantum Readiness Index in July 2026 — a five-domain self-assessment plus requirements for CII owners. Australia's ASD requires classical crypto phase-out by 2030 — the most aggressive Western timeline.
South Korea / India
Sovereign Development
South Korea's KpqC competition selected national algorithms (HAETAE, AIMer, SMAUG-T, NTRU+). India's roadmap targets critical infrastructure PQC by 2027, full adoption by 2033.
UAE / Gulf States
Policy-Led Transition
UAE approved a National Encryption Policy requiring government entities to develop PQC transition plans. Abu Dhabi's Technology Innovation Institute operates full-stack PQC research. Saudi Arabia added PQC to national standards in 2025.
Israel
Financial Sector First
Bank of Israel directive (January 2025) requires banks to build cryptographic inventories and develop PQC roadmaps. INCD national cybersecurity strategy 2025-2028 includes quantum-resistant encryption mandates.
Global PQC Migration Deadlines
| Region | Deadline | Requirement | Authority |
|---|---|---|---|
| Canada | Apr 2026 | Initial departmental PQC migration plans, plus mandatory PQC, CMVP and crypto-agility clauses in all contracts with a digital component | CCCS (ITSM.40.001) |
| US (Federal) | Sep 2026 | OMB guidance in force: agencies review High Value Asset inventories and set PQC transition timelines | White House / OMB (M-26-15) |
| US (Federal) | Dec 2026 | CISA and NIST publish minimum elements for a Cryptographic Bill of Materials (CBOM) | Executive Order 14412 |
| EU | End 2026 | All Member States must begin PQC transition | European Commission |
| Australia | End 2026 | Organisations must have a refined PQC transition plan | ASD/ACSC |
| France | 2027 | PQC becomes mandatory for products entering ANSSI security qualification | ANSSI |
| US (Federal) | Dec 2027 | NIST completes its own PQC migration pilot project | Executive Order 14412 |
| India | 2027 | Critical infrastructure sectors begin formal PQC implementation | C-DOT Task Force |
| Australia | End 2028 | PQC transition commenced, starting with critical systems | ASD/ACSC |
| UK | 2028 | Phase 1 complete: discovery and migration planning | NCSC |
| Global (finance) | 2030-32 | Most critical financial sector systems prioritised for migration | G7 Cyber Expert Group |
| Australia | 2030 | Cease using traditional asymmetric cryptography entirely | ASD/ACSC |
| EU | 2030 | Critical infrastructure PQC migration complete | European Commission |
| US (NSS) | 2030 | Quantum-vulnerable algorithms deprecated (software) | NIST IR 8547 / NSA CNSA 2.0 |
| US (Federal) | Dec 2030 | High Value Assets and high-impact systems on post-quantum encryption; contractors compliant with NIST PQC standards | Executive Order 14412 |
| Canada | 2031 | High-priority federal systems PQC migration complete | CCCS |
| US (Federal) | Dec 2031 | Post-quantum digital signatures and authentication on High Value Assets and high-impact systems | Executive Order 14412 |
| India | 2033 | Full nationwide PQC adoption | C-DOT Task Force |
| Global (finance) | 2035 | Overall financial sector migration target | G7 Cyber Expert Group |
| Global | 2035 | All quantum-vulnerable algorithms disallowed | NIST / NCSC / Japan NCO / Canada CCCS |
What This Means for Your Assessment
Know When, Not Just What
Your assessment should map findings to vendor timelines — showing when each issue becomes actionable, not just that it exists.
Prioritise by HNDL Risk
Data with long shelf-life is at risk today. Prioritise by data sensitivity, not just cryptographic algorithm weakness.
Group by Vendor Dependency
"Blocked by Microsoft" vs "Blocked by Oracle" vs "Fixable now" — actionable categorisation for your roadmap.
Satisfy Compliance Once
NIS2 requires demonstrable cryptographic risk management, not full implementation. A single assessment with migration plan demonstrates compliance.
What You Can Fix Now
You don't need to wait for vendors to take action. Here are 5 things you can do today.
Inventory Your Crypto Estate
You can't migrate what you don't know you have. Generate a CBOM to understand your current cryptographic usage across source code and infrastructure.
Retire Deprecated Algorithms
Remove MD5, SHA-1, DES, and 3DES from your codebase now. These are already broken — no need to wait for quantum computers.
Enable TLS 1.3 Everywhere
TLS 1.3 is faster, more secure, and easier to upgrade to hybrid PQC when the time comes. Disable TLS 1.0 and 1.1 today.
Audit Key Lengths
Ensure RSA keys are at least 3072-bit and ECC keys are at least 256-bit. Short keys are the lowest-hanging fruit for quantum attackers.
Start Your PQC Roadmap
A documented migration plan satisfies most current regulatory requirements. You don't need to implement PQC today — but you need a plan for when you will.
Get a Vendor-Aware PQC Assessment
We don't just tell you what's vulnerable — we tell you what's blocked by vendors, what's at HNDL risk, and what you can actually fix today.
Request Assessment