Post-quantum deadlines: NIST, CNSA 2.0, EU and UK

Governments have set dates for retiring RSA and elliptic-curve cryptography. Here is every official date that matters for a website, with its source, and what to do about it now.

In short

• No law today forces a private website to use post-quantum TLS.
• Every major government roadmap ends in 2035: by then quantum-vulnerable key exchange and signatures are meant to be gone.
• The EU and the UK expect high-priority systems to be migrated around 2030–2031.
• Key exchange is the part you can fix today (a configuration change); certificates come later, when browsers accept ML-DSA.

What is coming

1. 2026 — EU member states should have started their post-quantum transition and inventories.
2. 2028 — UK: discovery and migration plan complete (NCSC).
3. 2030 — EU: high-risk use cases migrated. NIST draft: 112-bit RSA/ECC deprecated.
4. 2031 — UK: high-priority migrations complete (NCSC).
5. 2033 — US national security systems: browsers, servers and cloud services use CNSA 2.0 algorithms exclusively.
6. 2035 — NIST draft: quantum-vulnerable algorithms disallowed. UK and EU: migration complete.

What has already happened

1. 2022-09 — NSA publishes CNSA 2.0 for US national security systems: web browsers, servers and cloud services should support and prefer the new algorithms by 2025 and use them exclusively by 2033. CNSA 2.0 requires ML-KEM-1024; the hybrid X25519MLKEM768 that browsers use is a step in that direction, not CNSA 2.0 compliance. (source)
2. 2024-08 — NIST publishes the first post-quantum standards: FIPS 203 (ML-KEM, key exchange), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, signatures). (source)
3. 2024-11 — Chrome 131 switches its default post-quantum key exchange to the standardised X25519MLKEM768; Firefox and Edge follow. From now on, any server that supports it is protected for most visitors automatically. (source)
4. 2024-11 — NIST draft IR 8547 proposes deprecating quantum-vulnerable algorithms (RSA, ECDH, ECDSA) at the 112-bit level after 2030 and disallowing them entirely after 2035. (source)
5. 2025-03 — The UK NCSC sets three milestones: discovery and a migration plan by 2028, high-priority migrations by 2031, migration complete by 2035. (source)
6. 2025-04 — OpenSSL 3.5 (long-term support) ships ML-KEM and offers X25519MLKEM768 by default, so nginx, Apache and HAProxy can enable it with a library upgrade. (source)
7. 2025-06 — The EU Coordinated Implementation Roadmap: every member state starts its transition by the end of 2026, high-risk use cases are migrated by the end of 2030, and as many systems as feasible by 2035. (source)

What this means for your website

Key exchange: act now. Traffic recorded today can be decrypted once a large quantum computer exists (harvest now, decrypt later). Enabling X25519MLKEM768 is a configuration change on a current TLS library, and browsers already use it.

Certificates: wait. Browsers do not accept ML-DSA certificates yet, so every site still uses RSA or ECDSA certificates. That is expected, not a misconfiguration.

Regulated sectors (EU NIS2, DORA): these laws do not name post-quantum cryptography, but they require appropriate, state-of-the-art security. Expect auditors to ask for a cryptographic inventory and a migration plan; the first line of that inventory is which of your hosts already negotiate post-quantum key exchange.

Check your site's key exchange now Track all your domains daily

Status as of 2026-11-04. Dates come from the linked official documents; drafts can change, so check the source before relying on a date.