The PQC deadlines that set the pace.

Manufacturers must report actively exploited vulnerabilities and severe incidents — the CRA’s first binding obligations.

NIST/CMVP moves FIPS 140-2 modules to the Historical List — procurement against them ends for US federal systems. For FIPS 140-3 specifically, PQCA tracks your plan to move onto CMVP-certified modules. It does not validate modules, and it is not a substitute for CMVP.

Every federal civilian agency files its prioritized migration plan under EO 14412 and OMB M-26-15 — the first hard federal deliverable of the transition. National-security systems are expressly excluded.

Every cryptographic asset inventoried and classified by sensitivity and migration priority, with the operational agility, constraints and third-party dependencies of priority assets assessed. SAMA circular issued under the Saudi Central Bank Law (Royal Decree M/36) — binding on all banks, credit-information companies, finance companies, payment-services providers and licensed financing-support entities in the Kingdom. rulebook.sama.gov.sa

A quantum-computing risk assessment aligned with enterprise risk management, with plans for the risks it finds. Second milestone of the same SAMA circular (Royal Decree M/36).

PCI approval labs stop accepting new HSM submissions against PTS v4, ahead of v5 — the first PTS revision to carry post-quantum requirements.

Products with digital elements sold in the EU carry security and vulnerability-handling obligations — cryptographic hygiene included.

NSA guidance expects operating systems in national-security service to support and prefer CNSA 2.0 algorithms (ML-KEM, ML-DSA) by end-2027.

The first of three dated milestones on the Central Bank of Jordan’s published sectoral PQC roadmap for the Jordanian banking sector.

NCSC’s published timeline expects full cryptographic discovery and a funded transition plan by 2028.

Under NIST’s initial public draft, RSA-2048-class security moves to deprecated status — permitted, but flagged, ahead of the proposed 2035 disallow.

The EU coordinated PQC roadmap expects high-risk systems migrated by the end of 2030.

The second dated milestone on CBJ’s published roadmap — landing with the global 2030 cluster of NIST, EU and CNSA dates.

The most critical cryptography — long-shelf-life data, root keys, CA infrastructure — migrated by 2031.

NSA’s completion target: CNSA 2.0 as the baseline across NSS, with classical-only deployments needing explicit waivers.

Proposed in NIST’s initial public draft: RSA-2048-class cryptography disallowed for US federal use — the anchor date most global programs plan against.

The last dated milestone on CBJ’s published roadmap, coinciding with NIST IR 8547’s 2035 disallowance date.

All remaining systems quantum-safe by 2035 under the NCSC timeline.

NCA has published no post-quantum mandate, so its controls are scored as general cryptographic hygiene, not as a PQC deadline. Saudi Arabia’s dated post-quantum milestones are SAMA’s, above.