Somewhere in a data centre right now, an attacker may already be copying encrypted files they cannot read. They don’t need to read them today. They only need to store them until a quantum computer can do the decrypting for them. That strategy has a name, “harvest now, decrypt later”, and it’s the reason the Post-Quantum Era has stopped being a theoretical concern for cryptographers and started being a practical deadline for IT teams across the UK and Ireland.
This guide explains what has actually changed since the National Institute of Standards and Technology finalised its first post-quantum encryption standards in August 2024, what the UK’s National Cyber Security Centre expects organisations to do by 2028, 2031 and 2035, and why most businesses should be running old and new encryption side by side rather than switching over in one step.
We’ll also look at which sectors carry the most risk, how to start a cryptographic inventory this quarter, and the questions IT and compliance teams ask most often about the transition. If some of the terms below are new to you, our glossary of key cybersecurity definitions is worth keeping open in another tab.
Table of Contents
The Immediate Risk: Why “Harvest Now, Decrypt Later” Changes the Timeline
A working quantum computer capable of breaking today’s encryption doesn’t exist yet, and nobody can say with certainty when one will. That’s exactly why the Post-Quantum Era matters sooner than it sounds: long-lived data is being intercepted and stored today, ready to be unlocked later.
Understanding the Threat to RSA and ECC Encryption
RSA and elliptic curve cryptography (ECC) protect the vast majority of internet traffic today, from online banking to email to the padlock icon in your browser. Both rely on mathematical problems- factoring large numbers and solving discrete logarithms- that are practically impossible for classical computers but fall to a quantum algorithm known as Shor’s algorithm once a sufficiently powerful quantum computer exists.
For a sense of how much data this actually covers, our cyber security facts and statistics page gives a wider view of how often encryption failures and breaches occur today, before quantum computing even enters the picture. Most security researchers place the quantum milestone somewhere between 2030 and 2035, though estimates shift as quantum hardware develops, which is precisely why organisations in the Post-Quantum Era are told to plan for the earliest plausible date rather than the average one.
Nobody can point to a working machine and say the countdown has started. That uncertainty is the whole problem. Planning around a fixed date such as 2030 or 2035 gives IT teams something to work towards, but the safer assumption is that any data collected today with a confidentiality requirement stretching past that window is already exposed. This is the calculation that separates a Post-Quantum Era migration plan from ordinary IT modernisation: it isn’t driven by a current attack, it’s driven by data that is being copied now for an attack that hasn’t happened yet.
The 2024 NIST Standards: What ML-KEM, ML-DSA and SLH-DSA Actually Do
In August 2024, after an eight-year evaluation process, NIST published the first three finalised post-quantum cryptography standards. A fourth, built on the Falcon algorithm, remains in draft. Together, these give engineering teams a fixed set of algorithms to build against rather than a moving target.
ML-KEM Replaces Key Exchange
FIPS 203, known as ML-KEM and built on the earlier CRYSTALS-Kyber design, handles key encapsulation: the process of securely agreeing on an encryption key between two parties before a message is sent. It’s the direct quantum-safe replacement for RSA and ECDH key exchange, and for most organisations, ML-KEM-768 offers the right balance of message size and security margin.
ML-DSA and SLH-DSA Replace Digital Signatures
FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) both provide quantum-resistant digital signatures, replacing RSA and ECDSA for verifying identity and confirming that data hasn’t been tampered with. ML-DSA, built on lattice mathematics, is faster and smaller, so most businesses will adopt it as their default. SLH-DSA relies purely on hash functions rather than lattice problems, so it’s kept as a conservative fallback for signatures that need to stay trustworthy for decades, even if a weakness were later found in the lattice-based approach.
A fourth signature standard, built on the Falcon algorithm and expected to be published as FN-DSA, was still in draft as this article was written, and NIST added a fifth algorithm called HQC in March 2025 as a code-based backup key encapsulation method in case a weakness is ever found in the lattice-based approach that ML-KEM relies on. None of this changes what a UK business needs to do today. It does explain why cryptographic agility, the ability to swap an algorithm without rebuilding a system, matters as much during the Post-Quantum Era as the algorithms themselves.
The UK and Ireland Regulatory Picture
Much of the coverage of post-quantum cryptography online is written for a US audience and stops at NIST. UK and Irish organisations answer to different regulators, on different timelines, and that distinction matters more than most general guides let on.
The NCSC’s Three-Phase Migration Roadmap
The National Cyber Security Centre recognises that the national migration to post-quantum cryptography is a mass technology change that will take a number of years, and in March 2025 it set out indicative target dates for migration activities. The roadmap is aimed squarely at technical decision makers, operators of critical national infrastructure, and organisations running custom-built IT systems, which covers a large share of UK financial services, healthcare and utilities firms. It sets a three-phase programme with a hard 2035 endpoint and interim milestones in 2028 and 2031.
By 2028, organisations are expected to have completed a full cryptographic discovery exercise, identifying every system, service and dependency that relies on encryption, and to have drafted a migration plan. Between 2028 and 2031, the priority shifts to executing the highest-risk migrations first, typically customer-facing systems and anything storing long-lived sensitive data, while refining the plan as tooling matures. The final phase, running to 2035, is about finishing the job across every remaining system, service and product. The full detail, including which sectors it treats as highest priority, sits in the NCSC’s own migration timeline guidance, which is worth reading alongside this article if you hold any position in IT risk or compliance.
For most small and medium-sized organisations without a dedicated security team, these dates can feel like they belong to somebody else’s problem. They don’t. The NCSC’s guidance is explicit that the core timeline applies across UK industry and government, not only to large enterprises and critical national infrastructure operators, even though the detailed technical guidance is aimed at bigger, more complex estates. A smaller business with a straightforward IT setup may only need a few weeks to complete its discovery phase, but the Post-Quantum Era clock is running for everyone holding data with a long shelf life, regardless of company size.
DORA and the Central Bank of Ireland’s Expectations
Financial entities in Ireland face an additional layer of obligation under the EU’s Digital Operational Resilience Act (DORA), which has applied in full since 17 January 2025. The Central Bank of Ireland is the competent authority responsible for DORA supervision of Irish financial institutions, including firms based in the International Financial Services Centre in Dublin. DORA doesn’t name post-quantum cryptography specifically, but its requirements for ICT risk management frameworks and regular resilience testing mean that a firm’s cryptographic inventory, the same document the NCSC asks for by 2028, is fast becoming something Irish regulators will expect to see evidence of during supervisory reviews.
The Hybrid Approach: Why You Shouldn’t Switch Off Classical Encryption Yet
It’s tempting to treat this as a straight swap: turn off RSA, turn on ML-KEM, done. In practice, almost no security team does that. Lattice-based cryptography has been studied for a shorter period than RSA or ECC, and hasn’t faced the decades of attacks that give older methods their track record.
How Hybrid Key Exchange Works
Two candidate algorithms, SIKE and Rainbow, were eliminated from NIST’s own evaluation process after researchers found practical breaks in them, a useful reminder that “no known attack” and “proven secure” are not the same claim. The practical answer most banks, government agencies and large enterprises are adopting is hybrid key exchange: combining a classical algorithm such as ECDH with a post-quantum algorithm such as ML-KEM in the same TLS handshake.
If either half is ever broken, the connection still needs the other half compromised too before an attacker gets anywhere. This is why the transition looks less like a single upgrade and more like a fleet of systems running two forms of protection at once for several years, which is exactly what the NCSC’s phased timeline is designed to accommodate.
Major browser vendors and cloud providers have already added hybrid key exchange support to modern versions of the TLS protocol, which means many organisations are running some Post-Quantum Era protection today without having changed anything themselves. The harder, slower work is everywhere else: internal certificates, VPN tunnels, backup encryption, hardware security modules, and authentication systems built around password and credential storage, since many of these rely on the same signature algorithms this transition affects. That’s the layer a cryptographic inventory is designed to expose.
Which Sectors Face the Greatest Risk
Not every organisation faces the same level of urgency, and the deciding factor usually isn’t industry size but how long the data needs to stay confidential.
Data Shelf Life Determines Priority
| Data type | Typical protection needed | Recommended approach today |
|---|---|---|
| Retail and e-commerce transactions | 5 to 7 years | Classical encryption, review by 2030 |
| Financial account and pension records | 20 to 40 years | Hybrid encryption now |
| Health and medical records | 50 years or more | Hybrid encryption now, prioritise migration |
| Government and national infrastructure data | Indefinite | Hybrid encryption now, highest priority |
Healthcare and financial services organisations, along with operators of critical national infrastructure such as energy and water utilities, sit at the top of the priority list under the NCSC’s guidance, largely because the data they hold has both a long shelf life and a high impact if exposed. These are also the sectors most frequently targeted by ransomware gangs today, and quantum readiness should sit alongside existing ransomware defences rather than replace them, since the two threats exploit different weaknesses at different points in time.
Energy and water networks bring an added complication: much of the equipment involved has a service life measured in decades, and some industrial control systems cannot be patched or upgraded without planned downtime, which makes early planning during the Post-Quantum Era far cheaper than an emergency retrofit closer to 2030.
A Practical Roadmap to Post-Quantum Readiness
Turning a 2035 deadline into something a small IT team can act on this year comes down to five steps, most of which can start with existing staff and no new hardware purchases.
Building the First Cryptographic Inventory
Start by listing every system that uses encryption or digital signatures: VPNs, internal certificates, email encryption, backup software, and any third-party services that handle customer data on your behalf. Most organisations are surprised by how much cryptography is buried in software they didn’t build themselves, which is why this step alone can take a few months for a mid-sized business.
Once the inventory exists, rank systems by data shelf life rather than by how visible or well-known the system is. A quiet backend service storing forty-year pension records deserves attention before a marketing website with no sensitive data behind it. From there, most organisations pilot hybrid TLS on a small number of customer-facing systems first, since vendors including major browser and cloud providers already support hybrid key exchange, before extending the approach to internal systems and, finally, to legacy infrastructure that may need replacing rather than upgrading.
Cryptographic agility matters because the algorithms themselves may not be the final word. NIST is still finalising a fourth standard, and a fifth backup algorithm, HQC, was only selected in March 2025. A system built to swap out its cryptographic library without a full rebuild will cope far better with that kind of change than one with encryption hard-coded throughout.
In practical terms, a Post-Quantum Era readiness plan tends to follow the same five stages regardless of company size:
- Build a cryptographic inventory covering every system, certificate, and third-party service that touches encryption.
- Rank each item by data shelf life, not by visibility, so long-lived sensitive data is dealt with first.
- Pilot hybrid TLS on a small number of customer-facing systems where vendor support already exists.
- Extend hybrid encryption to internal systems, VPNs and backup infrastructure.
- Replace or retire legacy systems that cannot be upgraded to support post-quantum algorithms at all.
Few organisations move through these steps in a straight line. It’s normal to be at stage one for VPN infrastructure while already at stage three for a public-facing website, and that unevenness is expected during a transition of this size.
Where to Start This Week
The Post-Quantum Era doesn’t require a finished migration this year, but it does require a starting point. Begin with a simple list of where encryption and signatures are used across your organisation, flag anything holding data with a shelf life past 2035, and raise the topic with your IT provider or internal security lead if you haven’t already. Encryption is only one part of a wider security programme, so if you’re reviewing this alongside other priorities, our guide to the best cyber security measures for small businesses is a useful next stop. For most UK and Irish organisations, that single conversation this month is worth more than waiting for a perfect plan later.
The organisations that find the Post-Quantum Era least disruptive won’t be the ones with the biggest security budgets. They’ll be the ones that started their cryptographic inventory early, adopted hybrid encryption while it was still optional rather than mandatory, and treated 2028 as a real deadline rather than a distant one. There’s no advantage to waiting for more certainty about exactly when a quantum computer capable of breaking RSA will exist. The migration work is the same either way, and it only gets more expensive the longer it’s left.
Frequently Asked Questions
A few questions come up repeatedly from IT and compliance teams working through their first Post-Quantum Era migration plan.
What is the difference between quantum computing and post-quantum cryptography?
Quantum computing is the hardware- machines that use quantum mechanics to solve certain mathematical problems far faster than classical computers. Post-quantum cryptography is the software response: encryption and signature algorithms designed to resist attacks from those machines, built and tested using ordinary computers today.
Does 256-bit AES encryption still work against quantum computers?
Largely, yes. Grover’s algorithm gives a quantum computer a speed advantage against symmetric encryption like AES, but only enough to roughly halve its effective strength. AES-256 still leaves a wide security margin even under that assumption, which is why the bigger concern sits with RSA and ECC rather than AES.
When should my business start migrating to post-quantum cryptography?
If you hold data that needs to stay confidential beyond the mid-2030s, start the discovery phase now. The NCSC’s own guidance sets 2028 as the deadline for having a migration plan in place, not for finishing the migration itself, so the clock on step one is already running.
Are existing VPNs quantum-safe?
Some are moving that way. Several major VPN and browser vendors have already added hybrid post-quantum key exchange as an option or default setting. Check your provider’s documentation for mentions of ML-KEM or hybrid key exchange, and if you don’t see either term, ask them directly about their migration timeline.
Does the NCSC recommend the NIST standards?
Yes. The NCSC’s guidance builds directly on the NIST algorithms finalised in 2024, adapting the timeline for a UK and CNI-focused audience rather than setting a competing standard.
Is Bitcoin or other cryptocurrency at risk from quantum computers?
The signatures that authorise cryptocurrency transactions rely on public key cryptography similar to ECC, which means they face the same theoretical risk as online banking. Most major blockchain projects are already researching quantum-resistant signature schemes, though moving an entire network to a new signature standard is a slower and more complex process than updating a single company’s systems.
What does the Post-Quantum Era mean for a small business with no dedicated IT team?
It usually means one conversation rather than one project. Ask your IT provider, web host and any software vendors handling customer data whether they have a post-quantum migration plan and a rough timeline for hybrid encryption support. Their answer tells you how much of this work is already being handled on your behalf, and how much you’ll need to plan for directly.