India's Final Quantum-Safe Roadmap Is Out. For Banks and Insurers the Dates Are 2027, 2028 and 2029.
· Compliance · 6 min read
The final report replaces the February draft
In February 2026 a task force under India's National Quantum Mission circulated a draft roadmap for a quantum-safe ecosystem. The final version, "Report on Quantum-Safe Ecosystem in India – Roadmap to Quantum Resiliency", is dated May 2026 and has been on the Department of Science and Technology's website since July. It is a 140-page document, and it is the one to cite from now on.
It is a set of recommendations, not a regulation. Enforcement still sits with sector regulators, which is why it matters what IRDAI, RBI and SEBI do with it.
BFSI is on the fast track
The final report is explicit about who counts as Critical Information Infrastructure: government, strategic, defence, power, telecom, transport, and banking, financial services and insurance (BFSI). Those sectors follow the accelerated timeline:
| Milestone | CII, including BFSI | Other enterprises |
|---|---|---|
| 1. Build foundations | 31 Dec 2027 | 31 Dec 2028 |
| 2. Migrate high-priority systems | 31 Dec 2028 | 31 Dec 2030 |
| 3. Full PQC adoption | 31 Dec 2029 | 31 Dec 2033 |
What each milestone asks for
Foundations (2027 for BFSI). Governance and cross-functional quantum risk management; a cryptographic inventory and quantum risk assessment; pilots and early migration of high-priority systems; PQC or hybrid signatures for critical software; PQC readiness in procurement, with Cryptographic Bills of Materials phased in. Crypto-agility becomes a guiding principle, and CBOM submissions from vendors become mandatory from FY 2027-28.
High-priority migration (2028). Pilots become programmes with KPIs. No new classical-only deployments. PKI, HSMs, key management and libraries move to PQC-ready versions, digital signatures must be PQC-capable, and systems that cannot migrate yet are contained in controlled enclaves.
Full adoption (2029). PQC or hybrid across the enterprise, PQC-only trust chains, every digital signature quantum-safe, and continuing vendor oversight and algorithm updates.
Three things the final version changes for a bank or insurer
- The vendor question has a date. From FY 2027-28 your suppliers are expected to hand you a CBOM. If your own inventory cannot take one in, it cannot check one either.
- "No new classical-only deployments" by 2028 means procurement decisions made in 2027 already have to account for PQC. A core system bought then without a PQC path is a system you will have to contain or replace.
- The end-state is PQC-only trust chains by 2029 for BFSI, four years ahead of other enterprises and six years ahead of the 2035 date most international guidance uses.
How it fits with the binding rules
- IRDAI already requires insurers, intermediaries and the Insurance Information Bureau to keep an up-to-date inventory of cryptographic assets (Control 110 of its 2026 guidelines).
- SEBI's CSCRF lists a prioritised cryptographic inventory and crypto-agility among its indicative PQC measures.
- RBI's Q-SAFE expert committee, set up in May 2026, has not reported yet. Its report is the most likely route for these dates to become supervisory expectations for banks.
- CERT-In's BOM guidelines define what a CBOM should contain, and say public-sector and essential-services organisations should require one in procurement.
The inventory is the first step in every one of them. It is also the one that takes longest to do well.
Qypher builds the cryptographic inventory across your public perimeter, code, cloud and binaries, generates a CycloneDX CBOM, and maps each finding to IRDAI, SEBI, CERT-In and the DST milestones. Run a free scan →
Sources: DST / National Quantum Mission, "Report on Quantum-Safe Ecosystem in India – Roadmap to Quantum Resiliency" (May 2026); IRDAI Information and Cyber Security Guidelines, 2026; SEBI CSCRF (20 Aug 2024); RBI press release on Q-SAFE (25 May 2026); CERT-In Technical Guidelines on SBOM, QBOM & CBOM (v2.0).