Skip to main content

Last reviewed 10 November 2026

Keep commodity software updated

When this applies​

You are on the vendor-managed route and no exception has moved you to another route.

Do this​

  1. Handbook practice: Confirm the supplier update that carries post-quantum cryptography is installed on each commodity device you listed in the inventory.
  2. Handbook practice: If the product is out of support or the supplier has no written migration plan, leave this page for the hard-to-change systems route.
  3. Handbook practice: Run the same exception check as the vendor-managed route. Long-lived confidential data belongs on the long-lived confidentiality route. A bespoke system, or a product whose signature check cannot be updated later, belongs on the hard-to-change systems route.

Authority recommendation: The UK NCSC timelines, modified 3 August 2026, United Kingdom, say migration for standard browsers, operating systems, and mobile devices happens as vendors update those services.

Keep this evidence​

The inventory row showing installed version and date checked, or a written note naming the route you moved to.

Example​

An insufficient record is "The platform will handle it."

A decision-ready record lists clinic laptops on the supplier-update path, records browser and operating-system versions checked on 1 November 2026, and notes that no exception applies.

Example: The clinic health records stay on the long-lived confidentiality route; only the laptops remain on this page.

Limits and next page​

This page does not record applicable national milestones. The next page is Post-quantum migration dates.

Sources​

  • UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines