Google sets a 2029 target for post-quantum cryptography migration

What happened

On March 25, 2026, Google published a concrete post-quantum cryptography timeline and said it is now targeting 2029 to migrate critical systems toward PQC. The company tied that schedule to recent progress in quantum hardware development, quantum error correction, and updated resource estimates for quantum factoring attacks.

The central message is that the industry should stop treating a cryptographically relevant quantum computer as a distant abstraction. Google argues the threat is already operational because attackers can capture encrypted traffic today and hold it for a future "store now, decrypt later" scenario. That makes long-lived secrets, identity systems, and digital signatures more urgent than a generic wait-and-see posture.

Key details

• Google said it has updated its internal threat model to prioritize authentication services and digital-signature migration.
• The company pointed to Android 17's planned ML-DSA integration as one example of putting NIST-aligned PQC protection into shipping platforms.
• The new timeline builds on earlier PQC work across Chrome, Google Cloud, and Google's own infrastructure.
• Google is effectively asking the wider ecosystem to start inventorying legacy cryptography and building migration plans now, not after another standards cycle.

This matters because Google is moving the conversation from research and policy into execution. The company is one of the largest operators of internet-scale identity, cloud, browser, and mobile platforms, so a 2029 target functions as a public signal to vendors, governments, and enterprises that the migration window is narrowing.

Why it matters

The story is bigger than quantum specialists. AI services, developer platforms, cloud APIs, financial systems, and enterprise identity stacks all rely on the same cryptographic foundation. If that foundation needs to change, teams building AI products will need crypto agility, upgradeable authentication flows, and clearer vendor commitments alongside their model and infrastructure roadmaps.

For Insights readers, the practical takeaway is that PQC is becoming an operational planning problem. As frontier AI systems handle more regulated data and more persistent state, post-quantum readiness will increasingly become part of mainstream platform strategy rather than a niche research topic.