In June 2026, Thailand's National Cyber Security Agency (NCSA) unveiled a "Quantum-Ready 2030" roadmap alongside a national AI security strategy. A month later the Bank of Thailand put post-quantum cryptography into its BAHTNET modernisation consultation paper, with a 2030 roadmap target. Behind both sits a four-phase national plan on NCSA's public QUANTA platform that runs from 2024 to 2035.
That is a lot of moving parts, and no single executive owns all of them. This guide is written for the full group that will carry the work: CISOs and heads of cybersecurity, CTOs and technology and product chiefs, chief risk and compliance officers, heads of emerging and quantum technology, and OT leaders. It also covers what the plan means for Thai and regional universities that want to teach this or open a quantum research lab.
For the case for urgency, start with the video Digital Trust Is Under Severe Attack. It sets out why trust in digital systems is under pressure, which is the backdrop to everything NCSA and the Bank of Thailand are planning.
Quick answer: Thailand's plan starts in 2024 with a survey and risk assessment, moves to PQC integration at core infrastructure in 2027 to 2030, transitions financial gateways and power-control systems in 2031 to 2034, and targets full completion in 2035. NCSA and the Bank of Thailand both point to 2030 as a milestone. All of it is advisory today, and no formal CBOM requirement exists. Leaders should build the cryptographic inventory now, extend it into software and hardware bills of materials, and pilot hybrid cryptography. Universities are named as partners in the roadmap.
Migration has many owners. A practical split:
NCSA's secretary-general, AVM Amorn Chomchoey, said the roadmap aims to move government agencies and businesses to post-quantum cryptography before quantum computers can break today's widely used encryption. It focuses on four things: planning the migration, preparing national digital infrastructure, developing skilled people, and putting governance, regulations and technical standards in place.
NCSA also announced two national cybersecurity standards due later this year, which are not PQC-specific, and plans to update Thailand's cybersecurity legislation. It said it will widen cooperation with government, business, universities and international technology partners. A separate commitment, made at a March 2026 seminar, is a National PQC Migration Plan, which had not been published at the latest independent review in September 2026.
NCSA paired the quantum roadmap with a national AI security strategy, and the two risks overlap. The video Mythos AI: Coming for Your Encryption Keys looks at the AI side of that picture and why the keys that protect your data matter so much.
Thailand has an unusually detailed timeline for a country at the guidance stage. NCSA's QUANTA platform sets four phases:
Start: 2024. Working milestone: 2030. End: 2035. The Bank of Thailand adds its own marker. Its BAHTNET consultation paper, dated July 2026, says post-quantum cryptography will be built in from day one, aligned with the BIS financial system quantum-readiness roadmap, and that a published migration roadmap will target 2030 completion for Thailand's financial system.
Some secondary reports describe an interim rule for 2030, under which every new government and critical infrastructure project handling sensitive data must deploy PQC or hybrid encryption. We could not confirm that wording in an NCSA primary document, so verify it with NCSA before building a compliance plan on it.
Not yet. NCSA's roadmap is educational and advisory guidance, and its language says organisations should begin planning. The Bank of Thailand's paper is a stakeholder consultation and not an issued rule. Nothing published for Thailand carries statutory force for post-quantum cryptography. Two things can change that quickly: NCSA's planned legislative update and the finalisation of the central bank's roadmap. Government contractors and financial institutions should watch both.
Three bills of materials answer three different questions. Together they give a CTO, a CRO or a head of cybersecurity an evidence trail for supply chain and cryptographic risk.
A CBOM complements an SBOM and does not replace it. CycloneDX 1.6, released in 2024, introduced the CBOM (developed by IBM Research) next to formats for software, hardware, services and AI/ML. NIST's NCCoE has a draft practice guide, SP 1800-38B, on cryptographic discovery, and CISA's HBOM working group published a hardware bill of materials framework in 2023.
Where does Thailand stand? Neither NCSA's roadmap nor the Bank of Thailand's paper names a formal CBOM requirement with a reporting deadline. The first phase of NCSA's plan, a survey that identifies high-value assets and vulnerable communication channels, is the same work in practice. A compliance summary of NCSA's 2025 readiness guidance also describes a two-part inventory: data that must stay confidential beyond ten years, and the cryptographic assets that protect it.
The direction elsewhere is clear. India's roadmap calls for mandatory bills of materials in all government RFPs. The Philippines already makes an SBOM mandatory for government software procurement. Singapore's financial regulator has expected a cryptographic inventory since February 2024. A Thai company that builds its three bills of materials now will meet most vendor and regulator questions before they arrive.
For a business operating across the region, the common ground is visible: discovery first, high-priority systems around 2030, completion around 2035.
NCSA's first phase is due to finish this year, so inventory work is already late for many organisations.
Financial institutions have a further reason to move early. The Bank of Thailand's 2030 target applies to the settlement system that many banks connect to.
NCSA lists skilled personnel as one of the roadmap's four focus areas and says it will expand cooperation with universities. Thai universities are already building in this space. Chulalongkorn University launched Siam Quantum Square on 26 January 2026, described as the largest quantum centre in Thailand, with plans to expand into quantum cryptography research. It offers a Master of Science in Quantum Technology and has announced Thailand's first trapped-ion quantum computer. It also signed a five-year agreement with Japan's AIST G-QuAT to build curricula and workforce capability, and its Faculty of Science held a public seminar on post-quantum security in August 2026. NCSA's QUANTA platform provides free education material that courses can use.
For a university deciding whether to offer technical courses, or to open a Centre of Excellence or a quantum research lab, a workable path looks like this:
Check programme approval, funding and accreditation requirements with the relevant Thai authorities before launching, because we found no published funding call specific to PQC teaching labs. Institutions exploring industry partnerships can look at QNu Academy as one route.
Thailand's plan begins with a survey of assets and risk, and the question underneath is the same everywhere: where does your cryptography actually live? QShield 2.0 is QNu Labs' sovereign post-quantum platform built around it. Its Quantum Readiness Risk Assessment module discovers certificates, keys and algorithms across an estate and builds the cryptographic bill of materials, then classifies exposure, ranks migration order and keeps checking as standards change. It can run on-premises or air-gapped, and it is designed so algorithms can change without rebuilding the systems above them.
Watch the QShield 2.0 launch video for a short overview, see how the platform has grown in QShield vs. QShield 2.0, or request a demo.
