The first deadline cluster
Australia targets completion, while the EU points its highest-risk uses toward the same year.
The useful date is not the quantum date.
Nobody knows exactly when a powerful quantum computer will arrive. Finance teams do know that replacing old encryption across suppliers can take years.
5official plans checked, each with a different scopeNew standards are available
NIST published standards for secure connections and digital signatures. Testing can begin now.
Financial systems to inspect first
Customer connections, payments, software updates, stored records, hardware security and blockchain keys need separate plans.
Finance has a common direction
The G7 plan lines up work across firms and suppliers. It is guidance, not a binding rule.
These words do not mean the same thing
GuidanceA recommended path. It is not automatically a law.
RoadmapA dated programme for a named group or country.
StandardA technical replacement that systems can use.
Do not compare the dates without comparing who they cover. A federal government timetable, security guidance for large organisations and a technical standards programme carry different force.
Five plans. One direction.
Find every affected system, change the most important ones first, then finish the rest. The dates and the covered groups differ.
Australia
National guidanceWho it covers
Government guidance for organisations
Recommended planning path20262030
Next: Have a detailed transition plan by the end of 2026.
Later: Start critical systems by 2028 and complete the transition by 2030.
Canada
Government roadmapWho it covers
Federal government systems
Department schedule20262035
Next: The first departmental plans were due in April 2026, followed by annual progress reports.
Later: High-priority systems by 2031; remaining systems by 2035.
United Kingdom
Security guidanceWho it covers
Large organisations and critical infrastructure
Recommended security timetable20282035
Next: Find every affected system and complete the first migration plan by 2028.
Later: Protect the highest-priority systems by 2031; complete migration by 2035.
European Union
Coordinated roadmapWho it covers
Public bodies and critical infrastructure
Member-state target20302035
Next: Move the highest-risk uses first, no later than 2030.
Later: The coordinated roadmap points the wider transition toward 2035.
United States
Standards programmeWho it covers
Federal standards with wider industry use
Technical standards and deprecation plan20302035
Next: Move high-risk systems earlier and begin using the new NIST standards now.
Later: Quantum-vulnerable algorithms are set to leave NIST standards by 2035.
What needs changing?
Quantum-safe encryption means new digital locks designed to resist future quantum computers. Open a system to see who must act first.
Customer connectionsThe secure connection used by websites, apps and outside services.
Who must move
Application, network and cloud teams
First useful action
List certificates, connection libraries and outside gateways.
Payment messagesThe signed instructions that tell money where to move.
Who must move
Payments, security and network partners
First useful action
Map every signer, certificate and outside network in the payment path.
Software updatesThe digital signature that proves new code is genuine.
Who must move
Engineering and software suppliers
First useful action
Find code-signing keys and ask when each build tool will support the new standards.
Stored recordsData that must remain private for years, even if it is copied today.
Who must move
Data, legal, security and cloud teams
First useful action
Start with records whose useful life is longer than the migration window.
Hardware securityMachines and cards that store keys and approve important actions.
Who must move
Security, procurement and hardware vendors
First useful action
Record model, support date, replacement date and supplier upgrade path.
Blockchain signing keysKeys that approve wallet, custody, validator and contract-admin actions.
Who must move
Custody, protocol and infrastructure teams
First useful action
Separate keys that can be rotated from contracts or addresses that cannot change easily.
A visible slice of value controlled by blockchain keys$305.2bntracked across 174 networks through 2026-09-19
This is an example, not the total exposure.
Blockchain signatures control wallets, custody approvals, validators and contract-admin actions. Those paths do not all change in the same way.
What the number cannot tell us: it does not show which keys are vulnerable, how long they remain in use, or which systems are hard to upgrade.
The new locks do different jobs.
Secure connections and digital signatures are separate tasks. One replacement cannot cover both.
ML-KEM
Creates a shared secret for a secure connection.
NIST sourceML-DSA
Signs data so a receiver can verify who sent it.
NIST sourceSLH-DSA
A second kind of digital signature built from hash functions.
NIST sourceWhat can change in 90 days?
The first quarter is about making the work visible and stopping new systems from adding more old encryption.
Give one person authority
One executive needs the budget and power to coordinate the change.
List critical systems
Record important keys, certificates, suppliers and the systems that use them.
Ask suppliers for dates
New products should support approved quantum-safe upgrades.
Learn what breaks
Move a non-critical connection through a new standard and record the result.
The main risk is waiting. Replacing old encryption will take years even if the exact quantum threat date remains unknown.
Read the official plans.
The checked date applies to the roadmap summary. Each link opens the organisation that published the plan.
The G7 published a common financial-sector roadmap. It is guidance, not a binding rule. Read the G7 plan.