United Kingdom
NIST bloc Standard-takerThe National Cyber Security Centre (NCSC) leads the United Kingdom's post-quantum cryptography posture and has set a phased national timeline to migrate to post-quantum cryptography by 2035, with discovery by 2028 and highest-priority migration by 2031, aligned with the NIST FIPS 203, 204 and 205 standards. The NCSC presents post-quantum cryptography as the primary mitigation against the quantum threat and, in its work on quantum key distribution, treats post-quantum cryptography as the preferred approach with quantum key distribution only as an additional layer. The transition is increasingly visible across government and the financial sector: the Bank of England now urges firms to prepare and plan their migration now, and Parliament has examined the issue through written questions, committee evidence and a Commons debate. None of this rests on a binding post-quantum statute; the position is carried through guidance rather than law.
Governance credibility
| Criterion | Score | Confidence |
|---|---|---|
| Relevance | 1.5 / 2 | High |
| Coherence | 1.5 / 2 | High |
| Effectiveness | 1.0 / 2 | High |
| Efficiency | 1.0 / 2 | High |
| Governance | 2.0 / 2 | High |
| Impact | 2.0 / 2 | High |
Regulatory basis
- NCSC post-quantum cryptography migration timelines and guidance (to 2035)
Legal status: Soft law only
There is no economy-wide post-quantum statute and no binding PQC mandate. The NIS Regulations 2018 place binding cyber security and resilience duties on designated operators of essential services and relevant digital service providers, assessed by sector regulators against the NCSC Cyber Assessment Framework, but these are technology-neutral and do not require post-quantum migration. PQC itself is addressed only through NCSC guidance, which directs migration to the NIST FIPS 203/204/205 algorithms on a phased national timeline to 2035 and carries no legal obligation.
Standards and algorithms
- Standard families
- NIST FIPS 203, FIPS 204, FIPS 205
- Algorithms
- ML-KEM, ML-DSA, SLH-DSA
Hybrid stance
None stated
Migration timeline
- 2028Complete discovery of systems and services using cryptography
- 2031Complete migration of highest-priority systems and services
- 2035Complete migration of all systems, services and products
Target completion: 2035
International standards processes
- RFC 9794 (IETF post-quantum terminology) NCSC contributes to and promotes the terminology standard
Governmental and standards bodies
- NCSC UK national technical authority for cyber security; sets the PQC migration timeline and guidance
- Bank of England Financial-sector authority; urges firms to plan and prepare PQC migration and assesses quantum risk to financial stability
- DSIT Department for Science, Innovation and Technology; commissions research on quantum key distribution and the PQC transition
- POST (UK Parliament) Parliamentary Office of Science and Technology; briefs Parliament on quantum and PQC
- UK Parliament Scrutinises the PQC transition through written questions, committee evidence and debate
- UK Government Publishes research on the plan for the PQC transition
Key institutional documents
- Preparing for post-quantum threat will make "fixing the Millennium Bug look easy"
- Timeline for PQC migration revealed
- Setting direction for the UK's migration to post-quantum cryptography
- Post-quantum cryptography: what comes next?
- Migrating to post-quantum cryptography (PQC)
- Quantum Technology - parliamentary written question and answer (40039)
- Quantum Technology - parliamentary written question and answer (40038)
- Cyber Coordination Group insights 2025
- Security Standard SS-002: Public Key Infrastructure & Key Management (version 2.1)
- Security Standard SS-007: Use of Cryptography (version 2.1)
- The National Cyber Advisory Board
- Cyber Security and Resilience (Network and Information Systems) Bill - Lords Grand Committee debate, 1 September 2026
- Post-quantum cryptography (PQC) migration workshop report
- Quantum key distribution research report
- Enhancing the Privacy of a Digital Pound (MIT report)
- John Taylor questionnaire, January 2024
- Written evidence on quantum technologies (QUT0015)
- Written evidence to a UK Parliament committee on quantum technologies (121374)
- Financial Stability Report - December 2025
- 2025 CBEST thematic
- A systemic risk perspective on operational resilience (speech)
- The Bank of England's approach to innovation in artificial intelligence, DLT and quantum computing
- Google Quantum Computing Chip - House of Commons debate (Hansard)
- Quantum Technology - parliamentary written question and answer (8496)
- Quantum Technology - parliamentary written question and answer (40037)
- Quantum computing, sensing and communications (POSTnote PN 0742)
- Perspectives on the plan for PQC transition
- Post-quantum cryptography (NCSC Annual Review 2024 chapter)
- Migrating to post-quantum cryptography (NCSC Annual Review 2025 chapter)
- Post-quantum cryptography (PQC) pilot under the Assured Cyber Security Consultancy scheme
- RFC 9794: a new standard for post-quantum terminology
- Next steps in preparing for post-quantum cryptography
- Timelines for migration to post-quantum cryptography
Advising on this transition, or your own sector's? Request a briefing →