Post-Quantum Cryptography

Your client files have a 2035 deadline — and it isn't yours to negotiate

Rajiv Abeysinghe · 3 July 2026 · Sources: NCSC, European Commission, NIST · Last reviewed: 3 July 2026
AI-assisted drafting · independent cross-model review (DeepSeek, Gemini) before publication

By 2028, the UK's National Cyber Security Centre expects your firm to have a written plan for migrating away from today's encryption. By 2035, it expects the migration finished. Those dates come from the NCSC's published guidance, not from a vendor's slide deck. They were not written for banks alone. They were written for you.

Here is the part most coverage misses. The NCSC says that for organisations running standard, commodity IT — mainstream browsers, operating systems, cloud services — post-quantum migration should happen largely through vendor updates. Your case-management provider migrates; you inherit the fix. But the same guidance is explicit that firms running custom or bespoke systems follow the same timetable as large enterprises. And every firm, commodity IT or not, still has to be able to show it checked.

What is actually happening

In August 2024, the US National Institute of Standards and Technology finalised the first post-quantum encryption standards: FIPS 203, 204 and 205. They replace the mathematics — RSA and elliptic-curve cryptography — that currently protects your client portal, your email in transit, your document signatures and your backups. That mathematics fails when a sufficiently capable quantum computer arrives. No one can tell you the year. Standards bodies have stopped waiting to find out.

The timetables are now official on both sides of the Channel. The NCSC's three phases: discovery and planning complete by 2028; highest-priority migrations executed between 2028 and 2031; everything finished by 2035. The European Commission's coordinated roadmap, published June 2025 under Recommendation (EU) 2024/1101, tracks the same arc — Member States begin the transition by the end of 2026, critical use cases migrate by 2030, full transition by 2035.

So a firm with EU-facing clients is already inside the transition window. Not in 2030. Now.

Why a 20-person firm should care about enterprise guidance

Because your obligations do not scale down with your headcount.

A solicitor's duty of confidentiality — SRA Code paragraph 6.3 — covers current and former clients and carries no time limit. UK GDPR Article 32 requires security measures "taking into account the state of the art", and names encryption expressly. When the state of the art moves — and finalised NIST standards plus published national migration timetables are exactly how it moves — the defensibility of not having looked decays year by year.

Richard Susskind has argued for three decades that professional work decomposes: some tasks stay judgment work, others become process, and process gets systematised. Post-quantum migration is a perfect specimen. The cryptography is the vendors' problem. The assurance — knowing which of your suppliers has a dated migration plan, and being able to produce that knowledge when a regulator, insurer or large client asks — is process work your firm owns. It cannot be delegated, but it can be systematised in an afternoon.

The afternoon's work

Three steps, in order.

List where encrypted client data lives. Case management. Email. Client portal. E-signature platform. Backups and archives. For most small firms the list has fewer than ten entries.

Ask each supplier one dated question. "What is your roadmap for migrating to the NIST post-quantum standards (FIPS 203/204), and by what date?" A supplier with a real answer names algorithms and years. A supplier without one has just told you something important.

Record the answers in your risk register. One page. Dated. Reviewed annually. That page is the difference between "we assumed the vendors handled it" and a documented, proportionate position — the artefact that satisfies Article 32's reasonableness test and your professional-indemnity insurer's next questionnaire.

The date that matters is not 2035

2035 is the finish line. The date that matters is 2028 — the first moment a client's due-diligence questionnaire, an insurer's renewal form or a regulator's enquiry can reasonably ask: "show me your plan." Firms that spent an afternoon in 2026 will answer with a page. Firms that didn't will answer with a scramble.

The deadline was set by people who will never attend your partners' meeting. It applies to your client files anyway.