Pragati Q-Foundry 2026: seven lessons from the PQC Migration Workshop

Adversaries are collecting encrypted data today so they can read it once a cryptographically relevant quantum computer arrives. On 30 September, at Pragati Q-Foundry 2026 in New Delhi, the Department of Science and Technology, the National Quantum Mission and DSCI ran a PQC Migration Workshop on CBOM, quantum risk assessment and the practitioner’s view. The timeline shown on stage puts the break of RSA-2048 at 2029 on the aggressive view and 2031 on the conservative one. Here are the lessons that matter for CISOs, architects and policy teams, followed by a practical plan.

1. Every major economy has set a date

The global slide made the pattern clear:

• United States: all federal systems to migrate by 2035.
• United Kingdom and Canada: critical systems by 2031, full transition by 2035.
• European Union: critical systems by 2030, the rest by 2035.
• South Korea: a PQC Master Plan targeting nationwide transition by 2035.
• Singapore: an integrated QKD and PQC approach with ongoing risk assessment.
• China: indigenous PQC standards deployed alongside QKD, with no public deadline.

Critical systems by 2030 to 2031 and everything by 2035 is the working global benchmark. Two of these national approaches pair PQC with QKD.

2. The exposure window is already open

The roadmap slide defines a window of quantum risk exposure from 2024 to 2035. NIST released its first PQC standards in 2024. RSA, ECDSA, EdDSA, DH and ECDH are slated for deprecation in 2030 and disallowed by 2035. Harvest now, decrypt later means data captured today is already part of the exposure.

The CNSA 2.0 trajectory chart carried the number every programme owner should note. Organisations that have not started a cryptographic inventory by 2026 will miss the 2030 network equipment deadline, because migration typically takes three to five years. It is October 2026.

3. Risk follows data life and system life

One chart plotted data shelf life against system life cycle. Insurance, banking and the public sector sit in the quadrant at risk earliest, and the reasons are concrete:

• Banking: mortgage registers are kept for 30 years, fraud registers permanently, and applications run in production for up to 30 years.
• Health: patient records are kept for 10 years or more, and hospitals rarely update their information systems.
• Automotive: software takes five years to develop and stays in production for 10 years, with usage that can extend further.
• Public sector: GST and income tax portals retain data over multiple decades.

A simple test follows. If the years your data must stay secret, plus the years your migration needs, exceed the years until a quantum attack, you are already late.

4. India has a phased national plan

The Task Force report on the Quantum Safe Ecosystem, launched on 13 May 2025, sets separate clocks for Critical Information Infrastructure (CII) and enterprises.

Short-term actions also include a National PQC Testing and Certification Program through TEC, STQC and BIS, common PQC procurement guidelines with mandatory bills of materials for all Government RFPs, and a mandate to use indigenous quantum-safe solutions.

5. Assurance will shape procurement

The national testing and certification framework proposes a risk-based model with four hierarchical assurance levels and a three-tier national laboratory model. It also provides a common reference for regulators, government, industry and certifiers, plus sector-specific timelines that regulators can enforce. Combined with mandatory bills of materials in Government RFPs, buyers will ask vendors for evidence. Solutions that can be tested and certified will move faster through procurement.

6. Dual-track is the national direction

The roadmap calls for large-scale adoption of PQC alongside essential deployment of QKD across a national quantum-secure backbone. The example inter-city design uses PQC nodes at Layer 2 and Layer 3, QKD nodes and key relays, and encryptors running over existing DWDM links. QKD deploys in several forms, including point-to-point links, trusted-node networks, free-space and satellite.

Field evidence is building:

• A 1,004 km QKD field demonstration ran across six nodes, with trusted nodes between hops.
• C-DoT’s post-quantum in-line IP encryptor uses NIST FIPS 203 with AES-256 GCM, delivers 10 Gbps at Layer 3 and integrates ETSI GS QKD 014. It has been tested in the laboratory.
• IIT Delhi’s free-space quantum communication and entangled photon source are field deployed.
• ISRO’s satellite QKD has been tested in the laboratory.

7. Sovereign capability is being built

The hardware pipeline is visible. QPiAI has fabricated a 64-qubit superconducting chip, IISc is integrating a 24-qubit photonic computer, RRI is testing a 25-qubit neutral atom system and IISER Pune a 20-qubit trapped ion system. The quantum startups announcement on 26 November 2024 drew about 400 participants, including 200 venture capitalists. The supply chain slide stresses component manufacturing and skilled people, and the summary slide notes that India has a number of players offering indigenously developed quantum-safe products.

What to do in the next 90 days

1. Build a CBOM across applications, networks, hardware and third-party software.
2. Classify every asset by data shelf life and system life cycle, then rank high, medium and low.
3. Run a quantum risk assessment and set your migration goals. The slides place this by 2028.
4. Write crypto-agility and CBOM disclosure into every new RFP.
5. Pilot hybrid PQC on one high-priority system, and test QKD on links that carry long-life data.
6. Train your CISO office, security engineers and DevOps teams.

Where QNu Labs stands: discovery, assessment and assurance on one sovereign stack

Every lesson above ends with the same question. Who can take an organisation from discovery to assessment to assurance without stitching together imported parts?

QNu Labs built its stack for that sequence. QShield 2.0 starts with cryptographic discovery and CBOM, runs a Quantum Readiness Assessment, and adds Quantum PKI, AI Security and an advanced Quantum Vault, all on sovereign technology. Migration then draws on Hodos for PQC, Armos for QKD and Tropos for QRNG, with QHSM and QKMS for hardware security and key management. The hybrid design the national roadmap describes comes from one India-built stack.

Each product carries its own agentic AI layer for automated monitoring, orchestration and operational intelligence. That supports the continuous monitoring and lifecycle governance listed in the long-term actions. Hybrid is the honest answer, and QNu Labs delivers it from first inventory to ongoing assurance.

Final thoughts

The dates are set and migration takes three to five years. An inventory is the cheapest first step, and every month without one shortens your runway.