UK NCSC sets 2028, 2031 and 2035 migration deadlines
20 MARCH 2025, LONDON
The UK's National Cyber Security Centre set three post-quantum deadlines on 20 March 2025. Organizations should complete discovery and planning by 2028, begin early migration by 2031, and finish migration by 2035. The staged sequence tells organizations to understand their estate first, migrate the priority systems next, and complete the work within a decade.
Putting discovery first reflects how the NCSC sees the problem. An organization cannot migrate cryptography it has not located, so the 2028 milestone focuses on finding where cryptography is used and building a plan. The heavier migration work in 2031 and 2035 then rests on that picture rather than starting blind.
The NCSC issues guidance rather than binding regulation, so the timeline sets a strong national expectation rather than a universal legal mandate. Regulated sectors may face firmer requirements derived from it, and organizations across the United Kingdom can treat the dates as a planning baseline that aligns with the 2035 horizon used in several other jurisdictions.
Why it matters. The NCSC timeline gives UK organizations a clear, staged schedule anchored on a 2028 discovery milestone. Because migration depends on knowing where cryptography lives, the 2028 date is the one that most affects whether the later deadlines are achievable. Organizations that start discovery now have the time to plan an orderly migration; those that wait compress all three stages into a shorter window.