In short: Every standard and PQC deadline with its status and next milestone. Filter by body, kind or status; each item shows its key facts first and folds its milestones and sources. Filter the tracker
Information only, not compliance or legal advice. Each status, date and deadline is as its official source states it on the date read; check the publisher for the authoritative current version. A milestone that is not verified is never used in the deadlines view, the feed, the early warning or the briefings.
Standards, specifications, committees and migration deadlines on post-quantum cryptography, quantum key distribution and quantum technologies: ETSI, CEN-CENELEC, ISO/IEC, ITU-T, IEEE, NIST and the IETF, the EU roadmap and the national agencies, each with its status and dates, its scope, what it means for organisations and its next milestone.
This page: every standard, committee and deadline with its status and next milestone. The other post-quantum pages: Guide: what post-quantum cryptography is and what to do first; Timeline by authority: the milestones of each EU and national authority, as its source states them; What is due when: everything due in the next 12 to 60 months, in date order, with a calendar feed; Compliance calendar: dated obligations and milestones beyond post-quantum.
Verification of the items on the date read: Verified: 57; Partly verified: 20; Not verified: 2.
3 items
ANSSI PQC page and PQC FAQ (cyber.gouv.fr): Cryptographie post-quantique (PQC) / FaQ sur la Cryptographie post-quantique (PQC)
Body
ANSSI (France)
Kind
Migration deadlines
Status
Active. Pages exist on cyber.gouv.fr but could not be read today (bot-protection interstitial); content and dates unconfirmed
Scope
Post-quantum cryptography
Jurisdiction
France
What it means for organisations
Would set the years from which PQC becomes a condition for French product qualification and when classical-only products stop being a reasonable purchase.
Next milestone
None stated by the sources read.
Milestones, links, verification and sources
Verification
Not verified. Both cyber.gouv.fr pages (FR and EN) returned an Incapsula bot-protection interstitial to WebFetch and curl; no bypass attempted. Search-engine snippets (not read on the page) suggested ANSSI aims at PQC obligations for entry into qualification for at least some product types from 2027, and considers buying non-PQC products after 2030 unreasonable; these years are NOT recorded as milestones because they were not read on the official page today. The 2025/2026 per-year qualification schedule asked for (2025/2026/2027, after 2030) could not be confirmed.
: Aim for post-quantum security for mechanisms used beyond this date or exposed to retroactive attack (RecoSécuLongTerme)
: 2048-bit minimum modulus acceptable only for use up to end of 2030; 3072 bits from 2031 (RSA factorisation and finite-field discrete-log moduli (RègleFactorisation))
Verification
Verified. PDF downloaded from messervices.cyber.gouv.fr and text extracted; version, date and both rules read directly. The 2030-12-31 row is a classical key-size limit, included because it is a dated end-of-use rule in the same guide.
ANSSI PQC position paper (2022) and follow-up (2023): ANSSI views on the Post-Quantum Cryptography transition / Avis de l'ANSSI sur la migration vers la cryptographie post-quantique (suivi 2023)
Body
ANSSI (France)
Kind
Migration deadlines
Status
Published (2023-12-21). 2022 position paper; follow-up dated 21 December 2023 accelerates the agenda
Scope
Post-quantum cryptography
Jurisdiction
France
What it means for organisations
Describes the phased French approach to security visas, with hybrid PQC expected for products protecting information beyond 2030.
: First French security visas for products with hybrid PQC expected
: ANSSI position: hybrid PQC for products protecting confidentiality beyond 2030 or used after 2030
Verification
Verified. 2022 page on messervices read via WebFetch (page dated 4 January 2022); 2023 follow-up PDF downloaded and text extracted (dated 21 December 2023). These are earlier positions; the newer 2025/2026 product timeline on cyber.gouv.fr could not be read (see separate item). The 2024 row stands for the stated range 2024-2025.