The answer, up front
The information-technology sector owns the cryptography the rest of the economy runs on, and it is already shipping post-quantum protection at scale. Cloudflare reported in February 2026 that more than 60 percent of human-generated TLS traffic to its network already uses hybrid ML-KEM protection 1. At the same time, UK and EU timelines put the weight of the migration on software, cloud and managed-service providers, because smaller organizations will largely migrate through the products they buy. Cloudflare is a vendor reporting its own deployment data, so read its figures as self-reported.
Cloud providers are deploying
Cloudflare announced in February 2026 that it extended hybrid ML-KEM post-quantum key exchange to its IPsec service and the Cloudflare One Appliance, covering its full SASE platform, following the IETF-standardized hybrid model that runs post-quantum key exchange alongside classical Diffie-Hellman 1. A July 2025 TechTarget survey describes a phased approach at AWS, investment in key-management and HSM services at Google, and post-quantum TLS tunnels at Cloudflare, and it names four obstacles: legacy hardcoded cryptography, missing cryptographic inventories, third-party library and HSM dependencies, and integration complexity 2.
Regulators set the pace
The UK's NCSC sets discovery by 2028, high-priority migration by 2031, and full migration by 2035, and it notes that small and medium enterprises typically migrate through vendor and service upgrades, which puts weight on software vendors and cloud and managed-service providers 3. The EU applies similar pressure: Member States should start national strategies by the end of 2026, move high-risk use cases by the end of 2030, and finish by 2035 where feasible, with first steps including cryptographic asset management and supply-chain coordination and next steps tied to the Cyber Resilience Act and NIS2 4. The EU detail comes from trade coverage rather than the primary text.
Why IT carries the load
Because so many organizations will migrate through their vendors, the IT sector effectively carries the migration for everyone downstream. That is why the four obstacles the TechTarget survey names, especially missing cryptographic inventories and hardcoded cryptography, matter beyond IT: an unresolved dependency in a widely used product propagates to every customer.
What this means for IT providers
Software, cloud and managed-service providers should expect customers to ask what post-quantum support their products carry and when. The practical steps are to inventory cryptography across the product estate, remove hardcoded algorithms in favor of agile interfaces, and publish a clear post-quantum roadmap customers can plan against.
How ArcQubit approaches it
ArcQubit treats discovery and crypto agility as the core problem for IT providers. QuCode builds the cryptographic inventory across the product and infrastructure estate, and QuTrust holds the migration plan so a provider can show customers a current, defensible roadmap rather than a one-off attestation.