Quantum computing remains an uncertain technological horizon, but the cybersecurity response is becoming increasingly concrete. Governments are setting migration dates, updating procurement rules, funding domestic capabilities and building national standards for post-quantum cryptography (PQC). The central concern is not simply when a cryptographically relevant quantum computer arrives. It is whether encrypted information stolen today can be decrypted tomorrow.
That threat, known as “harvest now, decrypt later” (HNDL), changes the timetable. Sensitive data – including defence plans, health records, financial information, intellectual property and government archives – may retain value for decades. Adversaries can collect it now and wait for sufficiently powerful quantum machines. NIST notes that replacing cryptographic systems can take 10 to 20 years, which is why organisations are being urged to begin migration before Q-Day becomes measurable.
Why the Race Has Accelerated
The immediate vulnerability is concentrated in public-key cryptography. RSA, Diffie-Hellman and elliptic-curve systems protect key exchange, authentication, certificates and digital signatures across the internet. A sufficiently capable quantum computer running Shor’s algorithm could undermine these mechanisms.
PQC aims to replace vulnerable public-key systems with algorithms designed to resist both classical and quantum attacks. In 2024, NIST finalised three foundational standards: ML-KEM for key establishment, ML-DSA for digital signatures and SLH-DSA as a hash-based signature alternative. These standards provide a common technical basis, although countries are increasingly adding their own requirements and algorithms.
The United States has now connected those standards to federal deadlines. Executive Order 14412 requires high-value federal assets and high-impact systems to adopt PQC for key establishment by December 31, 2030 and for digital signatures by December 31, 2031. It also requires agencies to appoint migration leads, review cryptographic inventories and submit migration plans. The order explicitly identifies the risk of adversaries collecting information now for later decryption.
This is more than a compliance exercise. It makes cryptographic visibility a prerequisite for national resilience. Organisations cannot migrate what they cannot locate.
Global powers are shifting focus from simply building quantum computers to safeguarding critical infrastructure and long-term data against future exploitation. With countries like India targeting 2029 and the US setting 2030 deadlines, post-quantum migration has become an urgent matter of national security
India Puts 2029 on the Calendar
India has established one of the most aggressive deadlines in the emerging global quantum security strategy. The Department of Science and Technology’s Quantum Safe Ecosystem in India report targets quantum resilience across critical information infrastructure by 2029 and enterprise-wide PQC adoption by 2033.
The proposed sequence is significant. Critical infrastructure operators are expected to complete cryptographic inventories by 2027, migrate high-priority systems by 2028 and achieve full implementation by 2029. A national testing and certification programme is intended to support assurance and interoperability.
India’s approach also links national policy with financial-sector oversight. The Reserve Bank of India established the Q-SAFE expert committee to assess the sector’s cryptographic inventory through a Cryptographic Bill of Materials (CBOM) and recommend a quantum-safe roadmap. That places science policy, telecommunications standards and financial regulation on overlapping migration tracks.
The strategic logic is clear: India is not waiting for a foreign technology ecosystem to define its security posture. It is attempting to develop indigenous capabilities while maintaining interoperability with global standards. This is the essence of quantum sovereignty policy – protecting national systems while reducing dependence on external suppliers, algorithms and infrastructure.
Nations are enacting aggressive timelines and industrial policies – such as the US EO 14412 mandates and India’s 2029 critical infrastructure targets – to secure their systems. Through domestic standards like NIST and India’s CBOM framework, countries are building indigenous capabilities to reduce dependence on foreign tech suppliers
The United States: Money, Mandates and Industrial Policy
The United States combines the strongest regulatory push with major quantum defence investment. The 2026 executive order provides dated obligations for federal systems, while procurement rules are expected to extend PQC requirements into the contractor and defence-industrial base.
The US is also investing heavily in the supply chain. The Department of Commerce announced letters of intent worth approximately $2.013 billion in CHIPS Act incentives for nine quantum companies. That spending reflects a broader shift: quantum policy is no longer limited to research grants. It now covers manufacturing, hardware access, workforce development, standards and strategic resilience.
The private sector is reinforcing the government timetable. Google has set 2029 as its target for moving its infrastructure to PQC, citing developments in quantum hardware and error correction. Cloudflare has also publicly targeted 2029 for full post-quantum security. These commitments matter because hyperscale infrastructure providers can accelerate adoption across browsers, cloud platforms and enterprise networks.
Yet, the US timeline is not universal. The executive order primarily binds federal agencies. Critical infrastructure, state governments and private companies may face indirect pressure through procurement, regulation and customer requirements rather than one national deadline. That distinction will shape how quickly the broader economy moves.
Major players including Australia, Canada, Japan, and hyperscalers like Google and Cloudflare are lining up migrations between 2029 and 2035. Smaller economies are securing strategic leverage by developing custom algorithms or funding specialised quantum hubs to maintain independent operational resilience
Australia, Canada and Japan Converge on the 2030s
Australia has one of the clearest general-purpose positions. Its Information Security Manual advises organisations to stop using traditional asymmetric cryptography – including RSA, Diffie-Hellman, ECDH and ECDSA – by the end of 2030. It also expects newly purchased systems with long service lives to support approved post-quantum algorithms.
The country is pairing migration guidance with industrial investment. Australia and Queensland committed A$940 million to PsiQuantum’s photonics-based quantum computer project near Brisbane. This illustrates a recurring pattern: governments are simultaneously preparing to defend against quantum computing and investing to develop it.
Canada is following a staged civil-and-defence model. Its government migration roadmap required federal departments to create initial PQC plans by April 2026. High-priority systems are due to migrate by the end of 2031, with the remaining systems targeted for 2035. In parallel, Canada launched a Quantum Defence Innovation Secure Hub with C$20.3 million for quantum sensing, secure communications and algorithms.
Japan’s government agencies are targeting completion of their PQC transition by 2035. The country is also strengthening its domestic quantum industry through approximately ¥50 billion in support for more than ten companies. The approval pathway for ML-KEM through CRYPTREC is important because it links international standards with Japanese government procurement.
Together, these countries show that post-quantum cryptography countries are converging on a practical pattern: inventory first, high-risk systems next, and broad completion between 2030 and 2035.
Smaller States are Pursuing Strategic Leverage
Smaller economies are not attempting to match the largest countries dollar for dollar. Instead, they are choosing specific points of leverage.
Singapore is pursuing hardware access, financial-sector readiness and ecosystem control. Its long-term research and innovation plan identifies quantum as a strategic growth area, while its partnership with Quantinuum is intended to provide access to a flagship quantum computer. The Monetary Authority of Singapore has also funded quantum and artificial-intelligence capabilities for financial services and plans supervisory expectations for quantum resilience.
Government deadlines are final targets, meaning enterprise preparation must begin immediately by mapping existing systems. Crafting a Cryptographic Bill of Materials (CBOM) allows organisations to locate vulnerable asymmetric algorithms, assess risks and deploy hybrid, crypto-agile solutions
South Korea has taken a more explicitly sovereign route. Its KpqC competition selected domestic algorithms including HAETAE, AIMer, SMAUG-T and NTRU+. The country’s 2035 transition plan includes pilots across telecommunications, finance, transport, defence and space. This creates a parallel standards track rather than complete dependence on NIST algorithms.
The Netherlands is working through the European Union’s coordinated roadmap, which calls for member states to begin transitioning by the end of 2026, address high-risk use cases by 2030 and complete medium-risk migrations by 2035. The country is also mobilising more than €2 billion in public and private quantum investment.
The UAE has approved a National Encryption Policy requiring government entities to prepare PQC migration plans. Saudi Arabia is incorporating post-quantum requirements into its national cryptographic standards. Israel, meanwhile, is pursuing domestic capability through Project Nexus, a tender for a nationally produced quantum computer.
These initiatives demonstrate that quantum sovereignty does not have one definition. It may mean owning hardware, developing algorithms, controlling cryptographic libraries, securing supply chains or ensuring that sensitive systems can operate independently during geopolitical disruption.
The Enterprise Deadline Arrives First
The common mistake is to treat a government deadline as the date when migration should begin. In practice, the real deadline arrives earlier.
Every organisation must first discover where cryptography is used: applications, APIs, databases, certificates, VPNs, TLS connections, PKI systems, hardware security modules, cloud services, operational technology and third-party platforms. It must then identify which data needs confidentiality for years or decades and which systems depend on vulnerable public-key algorithms.
Transitioning to PQC is no longer just an IT project – it is a core business and security governance requirement. Solutions like QNu Labs’ QShield 2.0 highlight the need for continuous asset discovery, risk assessment and automated assurance before the migration window closes
The practical first step is a Cryptographic Bill of Materials. That inventory should record algorithms, keys, certificates, protocols, owners, dependencies, renewal dates and data sensitivity. It enables risk-based sequencing rather than a disruptive, organisation-wide replacement.
Hybrid deployments – combining classical and post-quantum mechanisms during transition – can reduce interoperability risk. Crypto-agility is equally important: organisations need the ability to replace algorithms, certificates and protocols without redesigning entire systems.
This is the operational gap that QNu Labs’ QShield 2.0 is designed to address. Launched in September 2026, the platform supports India’s National Cryptographic Assessment and Assurance Framework through three functions: discover cryptographic assets, assess classical and quantum risk, and assure security continuously. Its five modules cover quantum entropy, readiness risk assessment, quantum PKI, quantum vault capabilities and AI security.
The broader lesson is that quantum readiness is becoming a governance discipline, not merely a cryptography project. Nations have begun setting the clock. Enterprises that wait for a final Q-Day forecast may discover that their migration window has already closed.
The writer is Chief Marketing Officer at QNu Labs, India’s pioneering quantum cybersecurity company incubated at IIT Madras. An IIM-Calcutta alumnus with 22+ years of global marketing leadership, she has led quantum security thought leadership initiatives positioning India’s “Made in India, Made for the World” quantum capabilities across defence, government, and enterprise sectors globally. The views expressed are of the writer and do not necessarily reflect that of Raksha Anirveda
