The answer, up front
Governments on three continents have published concrete public-sector paths to post-quantum cryptography, and the dates cluster around the end of the decade. India's task force set 2027 to 2029 milestones for critical information infrastructure, the European Union's coordinated roadmap targets 2030 for high-risk systems, and Singapore released practical tools for agencies and critical-infrastructure owners. This is a well-covered sector with direct, primary-source material from India and the EU alongside trade coverage of Singapore.
India
India's Department of Science and Technology released a task force report in February 2026 covering digital identity, e-governance services, banking, telecom and critical infrastructure 1. The roadmap has critical information infrastructure sectors such as defense, power and telecom lay foundations by 2027 and finish migration by 2029, with other enterprises following between 2028 and 2033 1. It defines four assurance levels and three laboratory tiers for testing post-quantum products, and it prefers indigenously developed solutions while keeping interoperability with global standards 1.
The European Union
The EU took a coordinated approach. The Commission's April 2024 recommendation asked Member States to adopt a harmonized transition strategy and a coordinated roadmap within two years, and it explicitly addresses the digital infrastructure and services of public administrations, with progress to be assessed within three years in a way that could lead to binding Union law 2. The roadmap that followed asks all Member States to start the transition and national strategies by the end of 2026, migrate high-risk critical-infrastructure use cases by the end of 2030, and complete the transition by 2035 where feasible 3. Both EU sources are trade coverage of the Commission's work, so the dates are reported rather than quoted from the primary text.
Singapore
Singapore published practical tools. The World Economic Forum reported in November 2025 that the Cyber Security Agency released a handbook on moving to quantum-resistant cryptography and a Quantum Readiness Index self-assessment, built with GovTech Singapore, the Infocomm Media Development Authority and industry, and aimed at critical-infrastructure owners and government agencies 4.
What this means for public-sector bodies
The dates are close enough to act on. Agencies and their suppliers should build a cryptographic inventory now, align migration plans to the relevant national timeline, and use self-assessment tools like Singapore's index to brief leadership. Vendors selling into these governments should expect procurement to ask for cryptographic inventories, crypto agility and testing against the named assurance levels.
How ArcQubit approaches it
ArcQubit treats discovery as the first deliverable each of these programs assumes. QuCode builds the cryptographic inventory across public-sector systems, and QuTrust holds the migration plan so an agency can show a current, defensible posture against its national timeline.