India’s quantum-safe roadmap: what the dates ask of your teams

In May 2026, India’s Department of Science and Technology published “Report on Quantum-Safe Ecosystem in India: Roadmap to Quantum Resiliency”. A task force set up under the National Quantum Mission wrote it in two parts: one on how quantum-safe products should be tested and certified, the other on how organizations should move.

The report gives India what the US, the UK and the G7 already had: dates. It asks critical sectors to complete the move to quantum-safe encryption by the end of 2029, and every other enterprise by the end of 2033.

Two timelines: critical sectors and everyone else

The roadmap splits organizations by risk. Critical information infrastructure, which the report lists as government, strategic and defence systems, power, telecoms, transport, and banking, financial services and insurance, follows an earlier timeline. Other enterprises follow a later one.

• Milestone 1, foundations: critical sectors by 31 December 2027, other enterprises by 31 December 2028.
• Milestone 2, high-priority systems moved: critical sectors by 31 December 2028, other enterprises by 31 December 2030.
• Milestone 3, every system moved: critical sectors by 31 December 2029, other enterprises by 31 December 2033.

Two details change who counts as urgent. An organization that fits more than one profile follows the highest-risk one. And priority isn’t limited to the named sectors: the report says any network handling data that must stay confidential for a long time should move early, because data stolen today can be decrypted later.

What the first milestone asks for

The first milestone is preparation, and most of it is finding out what you have. The roadmap asks each organization to:

• Appoint a quantum lead, give them resources, and set up governance the board oversees.
• Discover and record the cryptography in use across the organization.
• Assess the quantum risk and put systems in order of priority.
• Check how quickly and safely each system can change its cryptography.
• Pilot quantum-safe and hybrid methods in high-priority systems, and begin limited early moves.

It also reaches into procurement. From the 2026-27 financial year, organizations are asked to start requesting a CBOM, a cryptographic bill of materials that records the cryptography inside a product, and a quantum readiness plan from their vendors. From 2027-28, the roadmap recommends making the CBOM a procurement requirement.

For critical sectors, all of this is due by the end of 2027. The inventory usually takes longest, because cryptography sits in applications, cloud services, network equipment and vendor products that different teams own.

Milestones two and three

The second milestone turns pilots into a migration programme with measurable targets. The roadmap asks organizations to stop deploying new systems that rely only on today’s methods, upgrade their certificate systems, key hardware, key management and software libraries to versions ready for quantum-safe methods, and require digital signatures that can use the new methods. Systems that can’t move yet are to be contained in controlled parts of the network until they can.

The third milestone completes the move. Every system uses quantum-safe or hybrid methods, every digital signature is quantum-safe, and vendor oversight and algorithm updates continue as standards evolve.

Testing, certification and buying Indian

The roadmap also shapes what organizations will buy. It recommends:

• A national testing and certification programme for quantum-safe products, run by the Telecommunication Engineering Centre (TEC), the Standardisation Testing and Quality Certification Directorate (STQC) and the Bureau of Indian Standards, with its first laboratories operating by December 2026.
• Common procurement requirements across government tenders, asking for quantum-safe products that can change their cryptography, with a bill of materials.
• Preferential consideration for quantum-safe products developed in India, in public and private organizations, subject to technical suitability and the ability to work with other systems. The report ties this to Atmanirbhar Bharat, the government’s self-reliance policy, and to domestic control over the cryptography protecting critical assets.
• An India-specific list of products that depend on cryptography, which includes automated tools for discovering and recording cryptography, to be communicated to vendors as a future compliance requirement.

For buyers, this adds three questions to every quantum-safe purchase: where the product is designed and built, whether the vendor will supply a CBOM, and how the product will go through national testing once the programme runs.

A roadmap, not yet a regulation

The report recommends. It asks ministries and regulators, including the Reserve Bank of India, the Securities and Exchange Board of India and the Central Electricity Regulatory Commission, to turn it into sector-specific guidance. The rules your sector ends up with may follow its shape and differ in detail.

That isn’t a reason to wait. The first milestone’s work, an owner, an inventory and a ranking, is needed whatever the final rules say, and it takes the longest. Organizations that have it in place will be ready to apply their regulator’s rules when they arrive.

Questions for your next planning meeting

• Are we critical information infrastructure, or do we supply systems to it?
• Which of our systems hold data that must stay confidential for many years?
• Do we have a current record of our cryptography, with an owner for every finding?
• Which of our vendors can give us a CBOM, and from when?
• Who is our quantum lead, and when does the board next see the plan?

Where Arcrix™ helps

Arcrix™ by QTrino Labs builds the record the first milestone starts from: a map of where your business relies on cryptography, with an owner for every finding, and a CBOM you can export. Arcrix™ Platform is developed in India, and a dedicated deployment can be hosted in India so your data stays in the country. Arcrix™ HSM, secure hardware that protects encryption keys, is being designed in India on our own core technology.