Keep commodity software updated
The UK NCSC timelines, modified 3 August 2026, say that for organisations using mainly commodity IT, migration should happen as vendors update browsers, operating systems, and mobile devices.
The PQC Migration Handbook (AIVD, CWI, and TNO, December 2024) says regular adopters do not need to react to the quantum threat yet, and that an organisation on the boundary between urgent and regular should follow Section 3.2, which gives further guidelines on when to start migrating particular assets.
Handbook guidance: if you hold long-lived sensitive data or you ship a product that cannot update its signature check, you are on The migration plan, not on this page.
Reading order
This page, then Dates, then Inventory questions if you are not sure.
Sources
- UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines
- AIVD, CWI, and TNO, The PQC Migration Handbook, December 2024. Handbook