Explainers

Does New Zealand have a post-quantum deadline?

by Simon McCorkindale

In short

No. New Zealand remains the only Five Eyes member with no post-quantum migration deadline. NZISM Section 2.4 asks agencies to monitor post-quantum cryptography (PQC) developments, inventory their cryptographic systems and develop migration plans, but it sets no date.

What others have set

Other jurisdictions have moved from guidance to dates:

  • United States. Executive Order 14412, signed on 22 June 2026, requires agencies to move high-value assets and high-impact systems to PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. CNSA 2.0 targets full migration by 2035.
  • United Kingdom. The NCSC roadmap sets discovery by 2028, high-priority migration by 2031 and completion by 2035.
  • Australia. ASD guidance asks for a refined transition plan by the end of 2026, migration to commence in 2028 and to be complete by 2030.
  • European Union. Strategies by 2026, high-risk migrations by 2030 and full migration by 2035.

The detail, and the sources, are in Everyone else just set a date and the regulatory table in The quantum threat.

What NZISM Section 2.4 asks

New Zealand’s instrument is the NZISM, the New Zealand Information Security Manual. Section 2.4 requires agencies to monitor PQC developments, inventory their cryptographic systems and develop migration plans. No PQC algorithms have yet been approved for NZISM use, and no migration deadline has been set.

There is also no public enforcement mechanism attached to those provisions. The DPMC critical infrastructure consultation that closed in April 2026 made no substantive mention of cryptography, which is the gap we raised in our submission to the DPMC critical infrastructure consultation.

What that means for NZ organisations

No date is not the same as no exposure. Dates set elsewhere reach New Zealand through other routes: an Australian parent company, a contract with a US federal supplier, or a large provider changing what its services accept. Among the big four banks, which are subsidiaries of Australian parents, the cryptographic decisions sit in Sydney and Melbourne.

An organisation that abstracts its cryptography, removes hard-coded algorithms and builds a real inventory is ready whichever date lands, whether it comes from a future New Zealand regulator, an Australian parent or a supplier.

Where to start

Start with the data, not the date. Why get ready? sets out the filter we use: how long the data must stay secret, how long the systems protecting it would take to migrate, and when a capable quantum computer could plausibly arrive. Most systems will not need to move first. A few will.

See the readiness snapshot, or run the free external posture check.