14 OCT 2026 — Singapore has told organisations exposed to quantum computing risks to have a plan for switching to quantum-safe encryption by the end of 2027, and to complete the move by 2035. Operators of critical information infrastructure have a tighter deadline of 2031. The Cyber Security Agency of Singapore (CSA) set out the timeline on 14 October, a day after the government launched a new national cybersecurity strategy.
The target for most organisations is a recommendation, not a legal requirement. It comes with a new grant to help them start.
Why the deadlines matter now
Much of today's encryption, including RSA and the elliptic-curve signatures used across the internet, relies on maths problems that a large enough quantum computer could solve quickly. CSA's advisory says experts estimate such a machine "could arrive within 5 – 10 years", though the timing is uncertain and it could come sooner.
The risk is already present. CSA warns that attackers are expected to be stealing encrypted data now, intending to decrypt it once quantum computers are capable enough. That puts data that must stay confidential for years, such as medical records and trade secrets, at risk today.
Who the guidance covers
According to CSA's announcement, the 2035 target applies to organisations that hold information needing long-term confidentiality, and to those providing services such as communications and digital transactions. CSA says the dates match timelines emerging among governments internationally. Owners of critical information infrastructure received separate guidance in June with the 2031 date.
The advisory asks for less than its deadlines might suggest. Its first step is triage. An organisation does not need to audit everything at once, CSA says, and should begin with whatever is most exposed, such as data that must stay secret for years or equipment that is hard to update. Vendors matter as much as in-house work, because an organisation's readiness depends on theirs. CSA also warns that some quantum-safe algorithms use larger keys and can slow systems down, so they should be tested before they go live.
A grant to get started
The new Quantum-Safe Kickstarter Grant will fund pilots from 1 November 2026 to 31 October 2027, each lasting up to six months. It is open to all organisations, with priority for critical infrastructure owners. Projects that tackle common obstacles get priority, such as working out where cryptography is used in the first place, or moving legacy and operational technology systems. Digital Development and Information Minister Josephine Teo announced the grant at Singapore International Cyber Week.
The wider strategy
The day before, Senior Minister K Shanmugam launched Singapore's Cybersecurity Strategy 2026, the third since the first in 2016. Its four pillars run from defending critical infrastructure to international partnerships, and AI and quantum computing get a pillar of their own. Efforts to grow the local cybersecurity industry and workforce support it.
CSA says the strategy responds to advanced persistent threat groups increasingly targeting critical infrastructure, and to frontier AI "transforming cyber offence and defence". It follows earlier moves to tighten the rules for critical infrastructure boards. The government will implement the strategy over the next five years.
What organisations should do
For most firms the immediate task is not new technology but an inventory of where they rely on vulnerable encryption, and a conversation with vendors. CSA's argument for starting now is that a plan in place by the end of 2027 leaves room to make the change in an orderly way, rather than in a scramble once the threat is close.
