[{"data":1,"prerenderedAt":117},["ShallowReactive",2],{"news-\u002Fresources\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":80,"date":81,"description":82,"draft":83,"extension":84,"faqs":8,"findingsSource":8,"image":85,"keyFindings":8,"meta":86,"modified":81,"navigation":87,"path":88,"pullquote":8,"recommendations":8,"references":89,"related":99,"seo":106,"signposts":8,"slug":107,"stats":8,"stem":108,"tags":109,"tldr":115,"__hash__":116},"news\u002Fresources\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about.md","2028 Is the Post-Quantum Deadline Nobody Is Talking About","Steve Enlow II","",null,{"type":10,"value":11,"toc":73},"minimark",[12,17,30,34,47,50,54,57,60,64],[13,14,16],"h2",{"id":15},"the-number-everyone-quotes-is-the-wrong-one","The number everyone quotes is the wrong one",[18,19,20,21,25,26,29],"p",{},"Ask a security leader when post-quantum migration is due and most will answer 2035. That date is real, and it is also the least useful one on the calendar. The deadline that governs what your team does this year is not the finish line. It is the starting gun, and two regulators have already fired it. The UK's National Cyber Security Centre expects cryptographic discovery finished by 2028, and the European Union expects Member States to publish national transition roadmaps by 2026 ",[22,23,24],"span",{},"1",", ",[22,27,28],{},"2",". Both dates measure the same thing: whether you know where your vulnerable cryptography lives.",[13,31,33],{"id":32},"why-discovery-is-the-real-deadline","Why discovery is the real deadline",[18,35,36,37,39,40,42,43,46],{},"Every credible migration plan begins with an inventory, because you cannot replace an algorithm you have not found. The NCSC makes this explicit by carving discovery out as its own phase and dating it to 2028, ahead of the high-priority upgrades it expects by 2031 and the full migration it expects by 2035 ",[22,38,24],{},". The EU roadmap does the same thing from a different angle, requiring national plans by 2026 so that critical infrastructure can hit its 2030 target ",[22,41,28],{},". NIST reinforces the sequencing in its transition guidance, which treats identifying and prioritizing quantum-vulnerable systems as the work that everything else depends on ",[22,44,45],{},"3",".",[18,48,49],{},"The reason is practical, not bureaucratic. Discovery is the slowest and least predictable part of the whole program. Vulnerable cryptography hides in source code, in dependencies, in certificates, in infrastructure configuration, in compiled binaries, and in the tokens your services issue at runtime. Teams routinely find that the real exposure lives in surfaces they never scanned, so the inventory takes longer than anyone budgets. If you wait until 2033 to start looking, you will not finish looking in time to migrate.",[13,51,53],{"id":52},"the-trap-of-anchoring-on-2035","The trap of anchoring on 2035",[18,55,56],{},"Anchoring on 2035 creates a comfortable illusion of time, and that illusion is expensive. A leader who hears 2035 mentally schedules the work for the early 2030s. A leader who understands that discovery is due in 2028, and that a defensible EU roadmap is due in 2026, schedules the work now. The gap between those two mindsets is the difference between a migration you control and a migration that controls you.",[18,58,59],{},"The near-term dates also carry the audit risk. A regulator in 2029 will not ask whether you finished migrating. It will ask whether you know your exposure and whether you have a credible plan. Those are discovery questions, and you either have the inventory to answer them or you do not.",[13,61,63],{"id":62},"start-the-clock-on-your-terms","Start the clock on your terms",[18,65,66,67,72],{},"Discovery is knowable today, and it is the one part of the program you can complete before any deadline forces you to. ",[68,69,71],"a",{"href":70},"\u002Fqutrust","QuTrust"," builds your cryptographic inventory across all seven surfaces, classifies each finding by quantum risk, and turns the result into a roadmap you can defend to the NCSC, an EU supervisor, or a U.S. auditor. The finish line is 2035. The starting gun already fired. Run.",{"title":7,"searchDepth":74,"depth":74,"links":75},2,[76,77,78,79],{"id":15,"depth":74,"text":16},{"id":32,"depth":74,"text":33},{"id":52,"depth":74,"text":53},{"id":62,"depth":74,"text":63},"Analysis","2026-07-08","Everyone cites 2035, but the UK NCSC wants cryptographic discovery done by 2028 and the EU wants roadmaps by 2026. Here is why discovery is the real near-term deadline.",false,"md","\u002Fassets\u002Fog-default.png",{},true,"\u002Fresources\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about",[90,93,96],{"label":91,"url":92},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC (UK), 2025.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":94,"url":95},"European Commission and NIS Cooperation Group, \"A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,\" Jun. 2025.","https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcoordinated-implementation-roadmap-transition-post-quantum-cryptography",{"label":97,"url":98},"National Institute of Standards and Technology, \"NIST IR 8547: Transition to Post-Quantum Cryptography Standards,\" NIST, 2024.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fir\u002F8547\u002Fipd",[100,103],{"label":101,"url":102},"What Executive Order 14412 Requires","\u002Fresources\u002Fnews\u002Fus-executive-order-14412-post-quantum-deadline",{"label":104,"url":105},"One Clock, Three Jurisdictions: How the U.S., UK, and EU Deadlines Line Up","\u002Fresources\u002Fnews\u002Fus-uk-eu-post-quantum-deadlines-aligned",{"title":5,"description":82},"2028-the-post-quantum-deadline-nobody-is-talking-about","resources\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about",[110,111,112,113,114],"cryptographic discovery","PQC migration","NCSC PQC timelines","EU PQC roadmap","quantum readiness","While the headlines fixate on 2035, the UK expects cryptographic discovery finished by 2028 and the EU expects national roadmaps by 2026, which makes discovery the deadline that actually starts the clock.","67WEfPJ7m4JJlGTuL3ZJ8LM0paKIKuvUnas3hG4cD-4",1784747240118]