Singapore targets 2031 to shield critical infrastructure from quantum computers

October 14, the second day of Singapore International Cyber Week, was marked by a post-quantum announcement. Minister for Digital Development Josephine Teo unveiled a grant to help organizations test migration to quantum-resistant algorithms. The same day, Singapore's Cyber Security Agency (CSA) published an advisory setting a timeline for the whole country.

In short: migration completed by 2031 for critical infrastructure, and by 2035 for other exposed organizations. But these dates are targets, not legal obligations.

Three milestones for critical operators

The deadlines for critical information infrastructure (CII) operators appear in the migration guide the CSA published on July 16, 2026. According to that document, as summarized by the specialist site PostQuantum.com, these operators should:

• submit a migration plan to the CSA by March 31, 2027;
• from January 1, 2028, buy only systems that support post-quantum algorithms or are ready to do so;
• complete the migration, with no vulnerable cryptography left, by December 31, 2031.

The October 14 press release only says that migration of critical systems “should” be completed in 2031. The guide itself states that it is neither mandatory nor prescriptive. In Singapore, obligations for critical operators normally come through codes of practice or directions from the Commissioner of Cybersecurity. In early August, PostQuantum.com had found no such text reflecting these dates.

What about other companies?

The CSA advisory encourages organizations exposed to quantum risk to have a migration plan by the end of 2027 and to finish by 2035. It justifies the urgency with two arguments. First, a quantum computer capable of breaking RSA, ECDSA or DSA could appear within 5 to 10 years, even though the timing remains uncertain. Second, attackers can already collect encrypted data today to decrypt it later.

The “Quantum-Safe Kickstarter” grant is open from November 1, 2026 to October 31, 2027. It funds pilot projects lasting up to six months, with three priorities: migrating an application end to end, taking inventory of the cryptography in use, and handling industrial or legacy systems. The amount has not been published. Critical operators get priority, and each pilot must deliver a report.

What Singapore's approach teaches Europeans

The dates look a lot like Europe's. The European roadmap targets 2030 for high-risk systems and 2035 for the rest. Germany has just aligned with it, as have the Netherlands for their public systems.

The steps the CSA recommends also apply to a French company:

• identify data that must stay confidential for a long time, services exposed to the Internet, and long-lived equipment;
• appoint a person in charge of the project;
• test solutions before deploying them, since larger keys can slow down exchanges;
• ask suppliers for their post-quantum roadmap and factor it in when renewing contracts;
• avoid hard-coded algorithms, so they can be changed later.

Next thing to watch: will Singapore turn these milestones into obligations for its critical operators before the March 2027 deadline?