Guidance
What the regulators actually said.
Every entry on this page was checked against its source on or after 2026-08-09
Most of what is written about post-quantum guidance is second-hand. These pages carry the dates, the algorithm positions and the migration model, each one read against the issuing body’s own document.
Start with the FAQ → Shorter answers, no sources or dates — what the problem is, what has to change, and what this software does about it.
Four pages, four questions
- 01
When is my regulator expecting what — and does it actually bind me?
Every authority in date order, each milestone marked binding, recommendation or draft. Almost all of them land on 2030, 2031 or 2035. One does not.
- 02
Which algorithms am I allowed to use?
There is no single answer. One authority mandates ML-KEM-1024 and nothing else; one cantonal administration forbids ML-KEM outright. Both are current, and this page shows where the lines fall.
- 03
What does the work actually involve?
The six phases every published methodology converges on — preparation through monitoring — and the specific way each one is usually got wrong.
- 04
What have I probably been told that is not true?
Claims that circulate widely, including in summaries of the very documents they misdescribe, set against what each source actually says.
How these pages are kept honest
- Every entry names the document it came from, and links to it.
- Every entry carries two dates: when the document was published, and when we last checked the entry against it.
- Nothing is called a requirement unless the issuing body requires it. Most of this guidance recommends — the pages say which is which.
- A claim we could not verify against the source is left out, not hedged.