The regulators' clock: where Brazil sits on the post-quantum transition map

Where the numbers come from

The IEQ is the index GWK uses to measure, organization by organization, how much encrypted information remains exposed to the quantum computer and for how long that matters. The collection observes only what each organization already exposes on the internet: it connects to the main domain like any visitor, reads the cryptography negotiated in the handshake, and uses no agent, credential or access to internal systems. The October 2026 edition, with collection on September 2, covers 80,182 organizations in several countries; this analysis uses the 74,831 with a recognized sector.

The result combines three dimensions: the vulnerability of the cryptography in use, the observable exposure of the surface, and the secrecy horizon of the sector. The methodology is public, with the formal basis in a preprint on arXiv, and the public catalog shows an anonymized sample of each organization's signals. The analysis looks at countries and sectors, never at companies. No organization is named.

Two numbers for the world

Almost all published timelines converge on two years: 2030 for what is critical and 2035 for the rest. The European Union asks that high-risk cases be migrated by the end of 2030 and the rest by the end of 2035. The United Kingdom and Canada use 2031 for priorities and 2035 for the end. Australia has the shortest deadline: it recommends abandoning vulnerable classical cryptography by the end of 2030.

Most of these milestones are recommendations. The only binding deadline with a date, for now, applies to US federal agencies, which must migrate the key exchange of critical systems by December 31, 2030 and signatures in 2031. NIST's 2030 and 2035 pair, often cited as a legal deadline, remains a draft since November 2024. For the financial sector, the G7 published in January 2026 a reference of 2030 to 2032 for critical systems.

Brazil on the map

On January 30, 2026, Normative Instruction ITI No. 35 added the internationally standardized post-quantum algorithms, ML-DSA and ML-KEM, to the ICP-Brasil standards. The country's public key infrastructure now admits post-quantum cryptography. The rule, however, sets no deadline to migrate, neither in ICP-Brasil nor in any sector.

The Central Bank addressed the topic in March as "an emerging issue" that it is "studying". If it follows the G7, the Brazilian financial system will have 2030 to 2032 as a reference for critical systems. Until then, among the jurisdictions on this map, only Brazil and China have not set a deadline.

What the base shows

The difference shows up on the network. In the IEQ base, Australia, the US, Canada and the United Kingdom lead in hybrid key exchange. Having a timeline, however, is not enough: France, Germany, Italy, Spain and the Netherlands, covered by the European roadmap, fall below Brazil. One hypothesis is that adoption depends more on the default configuration of CDNs and hosting providers than on regulation. Brazil is below the base average of 19.4%.

The other side is the classical cryptography still in use. Among Brazilian organizations with a reading, 2,902 (89.8%) accept a key exchange that a sufficiently capable quantum computer could break. It is the highest share among the countries with the most organizations in the IEQ base, against 84.0% overall. The two numbers describe different things and coexist on the same server: accepting classical exchange is what the server still allows, and negotiating hybrid exchange is what it chooses when the visitor offers that option.

Sector by sector

The cut by sector shows where the delay weighs most. Government in Brazil has the lowest adoption in the country: 45 of 415 organizations with a reading (10.8%), against 14.8% in the rest of the base. Healthcare, energy and retail also fall below. Finance (22.6% against 19.9%), Real estate (28.8% against 23.7%) and Legal (33.7% against 25.0%) are above the rest of the base.

The data clock

This is where the third dimension of the IEQ comes in. The threat has a name, harvest now, decrypt later, and it only matters while the data is still worth something. That is why the index assigns each sector a secrecy horizon, TD: for how many years the information representative of that sector remains valuable to whoever captures it. Healthcare, government, defense and real estate work with 20 years, anchored in the legal retention of medical records and public registries. Critical industry, with 15. Finance, payments and energy, with 10. Retail, with 5, the retention period for consumer records under the LGPD and the Consumer Code.

Added to the year of capture, this horizon says until when the harvested data stays useful to whoever kept it. An organization that meets the 2030 target will still have carried, up to the eve of migration, information that is worth another 5 to 20 years.

The European roadmap itself uses this criterion to measure risk: it gives an impact score of 3 to data whose confidentiality must last beyond 2035, which raises the risk to the "high" level. By the IEQ's sector secrecy horizons, 47,484 organizations in the base (63.5%) already produce information in that range today. Considering migration in 2030, they are 59,329 (79.3%). In the scenario of migration at the end of 2030, only legal and retail end the window within 2035.

A map that Brazil can still draw

The Brazilian deadline has yet to be written, and whoever writes it will need evidence from the sector itself. GWK produces cuts of the IEQ base by sector and by country, with the same method as this analysis, for sector associations, regulators and research groups that want to measure where their sector stands before setting a date. For an organization, the path is the Exposure Report, which reads its own domain against the sector, or an authorized assessment inside the environment, where the information that the public surface does not show comes through. The products are at gwksecurity.com/en/produtos.