The UK has no single binding PQC law like DORA's RTS. Instead, NCSC's 2028/2031/2035 migration timeline, the NIS Regulations, the Cyber Assessment Framework and sector rules combine into a de facto national deadline. Here is what actually applies.
There is no UK equivalent of DORA's Regulatory Technical Standards, no binding statute that names ML-KEM or sets a cryptographic key-rotation interval in law. Anyone looking for that single document will not find it, and concluding from its absence that the UK has no real PQC deadline would be a mistake. The obligation is assembled from several sources instead of one: a National Cyber Security Centre timeline that functions as the de facto national deadline even though it is guidance, not law; the Network and Information Systems Regulations 2018, which does bind you by law if you are an operator of essential services or a relevant digital service provider; the Cyber Assessment Framework your competent authority actually assesses you against; and, in financial services, a separate critical third parties regime that raises the bar without naming an algorithm.
This guide walks through each layer, what is actually binding versus strongly recommended, and what a working migration programme looks like once you combine them.
On 20 March 2025, the NCSC published "Timelines for migration to post-quantum cryptography" (reviewed and reconfirmed 3 August 2026), setting three milestone dates:
| By | Milestone |
|---|---|
| 2028 | Define your migration goals and carry out a full discovery exercise: identify which cryptographic services need upgrading and build a migration plan. |
| 2031 | Carry out your early, highest-priority PQC migration activities, refining plans as the ecosystem matures. |
| 2035 | Complete migration to PQC for all systems, services and products. |
The guidance states it is "primarily aimed at technical decision-makers and risk owners of large organisations, operators of critical national infrastructure (CNI) systems including industrial control systems (ICS), and companies that have bespoke IT." Organisations running mostly commodity IT are expected to migrate more seamlessly as vendors update their products, which is a meaningfully lower bar than "build your own migration plan by 2028."
The document itself does not cite the NIS Regulations, the Cyber Security and Resilience Bill or any specific statute. It frames migration as "a mitigation to a cyber security threat" and good cyber security practice, not a standalone compliance mandate. That framing is accurate on its own terms and also slightly misleading about what happens next: the timeline is guidance, but the bodies that assess your legal cyber security obligations (your NIS competent authority, in particular) treat NCSC guidance as the practical definition of "state of the art" and "appropriate," which is the actual statutory test. Sections 3 and 4 below cover how that connection works.
The NCSC's companion paper, "Next steps in preparing for post-quantum cryptography," endorses the same NIST-standardised algorithms most other national guidance now converges on:
| Purpose | Algorithm | NCSC-recommended parameter set |
|---|---|---|
| Key establishment | ML-KEM | ML-KEM-768 for most use cases |
| General-purpose digital signatures | ML-DSA | ML-DSA-65 for most use cases |
| Firmware and software signing | SLH-DSA | Stateless alternative to LMS/XMSS |
| Firmware and software signing (legacy path) | LMS / XMSS | Accepted, but requires strict state management |
The NCSC states these parameter sets "provide an acceptable level of security for personal, enterprise and OFFICIAL-tier government information," which matters if you sell into UK public sector: OFFICIAL is the classification tier most government and NHS contracts fall under, so this is effectively the floor your cryptography needs to clear.
On hybrid PQ/T schemes, the guidance is explicit that hybrid should be transitional, not a resting state: "If a PQ/T hybrid scheme is chosen, the NCSC recommends it is used as an interim measure that allows a straightforward migration to PQC-only in the future." In practice this means whatever hybrid configuration you deploy now (the same X25519MLKEM768-style hybrid groups covered in our F5 and FortiGate guides) should be chosen and configured so that dropping the classical half later is a configuration change, not a redesign.
The Network and Information Systems Regulations 2018 is the actual statute, binding operators of essential services (energy, transport, water, health, and digital infrastructure) and relevant digital service providers. Regulation 10 requires operators to take "appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies," with the measures required to "ensure a level of security of network and information systems appropriate to the risk posed," and operators must "have regard to any relevant guidance issued by the relevant competent authority."
Notice what the statute does not do: it does not name cryptography, algorithms, or PQC anywhere in that text. It sets a proportionality and "appropriate to the risk" standard and leaves the technical content of "appropriate" to sector-specific competent authorities and their guidance. That is where the NCSC timeline stops being merely advisory. When your competent authority (Ofcom for telecoms, the ICO for digital infrastructure, the Environment Agency for water, DfT/ORR for transport, and so on) assesses your compliance, it does so against the Cyber Assessment Framework, and the CAF explicitly incorporates NCSC's cryptography guidance as the working definition of appropriate practice. A published NCSC timeline that you have publicly ignored is difficult to reconcile with having taken "appropriate and proportionate" measures, even though the timeline itself is not the legal text.
The CAF is what NIS competent authorities actually use to assess operators of essential services. Objective B ("Protecting against cyber attack") contains Principle B3, Data Security, which is the principle that carries cryptographic controls:
Principal statement: "Data stored or transmitted electronically is protected from actions such as unauthorised access, modification, or deletion that may cause an adverse impact on essential functions."
B3 breaks into contributing outcomes, three of which are directly cryptographic:
Across these, the CAF's supporting guidance is consistent on one point that matters operationally: you must "protect cryptographic material such as certificates and keys from external or unauthorised access." Key management, not just the choice of algorithm, is what an assessor is actually looking for evidence of.
The CAF is reviewed and updated periodically, and it is the mechanism through which "current best practice" (including the NCSC's own PQC timeline) flows into an actual pass/fail assessment for regulated operators, without the underlying regulation ever needing to be amended to name a new algorithm.
The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to the House of Commons on 12 November 2025 and was still progressing through Parliament as of publication, with enactment expected later in 2026. It amends the NIS Regulations 2018 rather than replacing the cryptography framework described above. Its changes are about scope and enforcement, not about adding new technical cryptographic detail:
For a PQC migration programme, the practical effect is who else becomes subject to the CAF-based assessment described above, not a change to what "appropriate cryptography" means. If your organisation is a managed service provider or data centre operator that has not previously had to demonstrate NIS-style compliance, this Bill is the reason that changes, and the NCSC timeline and CAF Principle B3 above are what you will be assessed against once it does.
Financial entities themselves remain under the FCA and PRA's existing operational resilience rules, not a UK-specific DORA equivalent with RTS-level cryptographic detail. What did change: the FCA, PRA and Bank of England published PS24/16, "Operational resilience: Critical third parties to the UK financial sector," on 12 November 2024, with the regime's rules taking effect from 1 January 2025. This creates direct regulatory oversight of critical third parties (CTPs), typically large cloud and technology providers whose failure could threaten UK financial stability, requiring them to meet Fundamental Rules and more detailed operational risk and resilience requirements for their material services.
Unlike DORA's Commission Delegated Regulation 2024/1774, which sets out encryption and key-management obligations across two dedicated articles (see our DORA checklist), the CTP regime's published requirements do not set out algorithm-level or key-lifecycle-level cryptographic detail in the same way. The obligation sits at the level of general technology and cyber resilience risk management, with the detailed rules held in the CTP sourcebook. If you are a CTP, or a financial entity relying on one, treat the NCSC timeline and CAF Principle B3 above as the substantive cryptography bar, since the sector-specific regime does not currently set a more prescriptive one.
Article 32 UK GDPR requires controllers and processors to implement "appropriate technical and organisational measures" proportionate to risk, naming encryption specifically as an example measure, not a blanket requirement for every processing activity. The ICO's own guidance is consistent with that reading: encryption is not mandated in every circumstance, but the ICO has been explicit that encrypting portable devices and removable media holding personal data is expected, and enforcement history shows organisations that suffered a breach and could not demonstrate appropriate technical controls have faced the harshest outcomes.
This runs on a separate legal basis from the NIS Regulations (data protection rather than critical infrastructure security), but it reaches the same practical conclusion: "appropriate," tested against current risk and current attack capability, is where UK law actually lands the cryptography bar, rather than a named algorithm or a named deadline in the statute itself. As harvest-now-decrypt-later becomes a documented risk against long-lived personal data, that same "appropriate to current risk" test is what pulls PQC migration into Article 32 scope for anyone holding personal data with a multi-year confidentiality requirement, medical records and long-term financial records being the clearest examples.
Combine the layers above and a UK PQC programme has to produce evidence at three points, not just complete a project:
The cryptographic inventory that both the NCSC's 2028 discovery milestone and CAF Principle B3 assume is exactly what a CBOM (Cryptography Bill of Materials) captures: a CycloneDX-standardised, machine-readable record of every algorithm, certificate and key across your estate. Our CBOM guide covers generating one via filesystem, source-code and domain scans, plus the get_qrs_score and get_vulnerable_assets MCP tools for tracking migration progress against a baseline rather than producing a one-time snapshot for an audit.
For the "highest-priority migration activities" the NCSC expects by 2031, our F5 BIG-IP and FortiGate guides cover deploying NCSC-recommended hybrid key exchange on two of the most common pieces of edge infrastructure, including the agentic MCP tools (ensure_f5_mlkem_profile, ensure_fortinet_mlkem_ipsec) that turn a prioritised migration plan into a deployed configuration change without a separate infrastructure project for each target.
Q: Is the NCSC's 2028/2031/2035 timeline legally binding?
Not directly. It is guidance, not statute. It becomes practically binding for operators of essential services and relevant digital service providers through Regulation 10 of the NIS Regulations 2018's "appropriate and proportionate" test, assessed in practice against the Cyber Assessment Framework, which incorporates current NCSC guidance as the working definition of appropriate cryptographic practice.
Q: Does the Cyber Security and Resilience Bill add new cryptography requirements?
No. It expands who is regulated under the NIS framework (managed service providers, managed security service providers, data centres above threshold, and non-UK entities serving the UK market) and strengthens enforcement powers. The cryptographic bar itself remains the CAF's Principle B3, unchanged by the Bill.
Q: We're a UK financial entity. Do we have DORA-equivalent obligations?
Not with the same specificity. UK financial entities remain under FCA/PRA operational resilience rules, and Critical Third Parties are separately regulated under PS24/16, but neither sets out encryption or key-management detail at the level of DORA's Commission Delegated Regulation 2024/1774 Articles 6 and 7. Treat the NCSC timeline and CAF B3 as your substantive cryptography standard until sector-specific rules say otherwise.
Q: Does UK GDPR require post-quantum cryptography?
Not by name. Article 32 requires "appropriate" measures proportionate to risk, with encryption cited as an example, not a name-checked algorithm. As harvest-now-decrypt-later becomes a documented risk to long-lived personal data, "appropriate to current risk" is the clause that pulls PQC into scope for data with a multi-year confidentiality requirement, rather than a specific UK GDPR PQC mandate existing today.
Q: What algorithms does the NCSC actually recommend?
ML-KEM-768 for key establishment, ML-DSA-65 for general-purpose signatures, and SLH-DSA for firmware and software signing where a stateless scheme is preferred over LMS/XMSS. Hybrid PQ/T deployment is accepted as an interim step, provided it is deployed with a clear path to drop the classical component later.
The UK's PQC obligation does not read like DORA's or NIS2's implementing regulation, and looking for that kind of single, named-algorithm text in UK law will not find it. What exists instead is a chain: NCSC's 2028/2031/2035 timeline sets the practical deadline, the NIS Regulations 2018 and the Cyber Security and Resilience Bill's expanded scope make "appropriate and proportionate" cryptography a legal duty for an increasing set of organisations, and the Cyber Assessment Framework is where that duty gets tested against concrete evidence, cryptographic inventory, key management, protected data in transit and at rest. Build the inventory, prioritise the migration, and keep the hybrid step provably transitional, and you satisfy every layer at once, regardless of which one an assessor or regulator ultimately invokes.
Geschrieben von
Nagib Aouini
Related Resources
Sagen Sie uns, wo Kontrolle heute schwierig ist. Wir helfen Ihnen, den nächsten praktischen Schritt zu finden.
