What should a company in Latin America prepare today for post-quantum cryptography?

As of October 12, 2026, no financial regulator in Latin America has published a post-quantum migration deadline: a dated compilation checked Colombia’s SFC, Mexico’s CNBV and Banxico, Chile’s CMF and Brazil’s central bank and found none (AndesQubit, September 23, 2026), and Rosetta Quantum’s own scan of the public record today found none either. Meanwhile the clocks set elsewhere already reach the region — NIST will deprecate RSA and ECC after 2030 and plans to disallow them after 2035 (NIST IR 8547, November 2024), the US executive order fixes December 31, 2030 for encryption and December 31, 2031 for signatures on high-impact federal systems (EO 14412, June 22, 2026), and ≈67% of human HTTPS traffic on Cloudflare’s network already negotiates post-quantum encryption (Cloudflare Radar, April 15, 2026). What a company in the region should prepare this year costs inventory and contract language, not hardware: five steps, each with its source, below.

Status as of: October 12, 2026. Every number in this post carries its source and date beside it. Six earlier Rosetta Quantum posts are cross-linked below and not re-litigated here.

What is post-quantum cryptography, and which standards already exist?

Post-quantum cryptography (PQC) is classical software — new mathematical problems for key exchange and signatures that run on today’s computers and are designed to resist attack by a future quantum computer. It is not quantum hardware, and it is not QKD: our QKD post recorded that 0 of 6 security agencies surveyed recommend QKD as a primary control, and that verdict is unchanged here. The standards already exist: NIST finalized FIPS 203 (ML-KEM, key exchange), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, signatures) on August 13, 2024 (NIST), and selected HQC as a backup key-exchange algorithm on March 11, 2025 (The Quantum Insider). The algorithms RSA and ECC — what almost everything uses today — are the ones a large fault-tolerant quantum computer would break via Shor’s algorithm; our RSA-2048 post and our Bitcoin post carry those numbers and are not re-litigated here. «Waiting for the standards» stopped being a reason in August 2024.

How much time is there, by what can be measured?

Measured today: 0 RSA-2048 keys have been broken by a quantum computer in the public record (our usage map, October 6, 2026). Rosetta Quantum’s own pre-registered Q-Day bet — sealed with hash before publication on October 9, 2026 — declares a floor of no qualifying break before January 1, 2031 and a central window of 2033–2039 (the bet and its refutation conditions); that is a declared judgment with a refutation condition, not a measurement. But the regulators’ clocks do not wait for Q-Day, because migration itself takes years: NIST’s draft timeline will deprecate quantum-vulnerable RSA/ECC after 2030 and disallow them after 2035 (NIST IR 8547, November 2024); the US executive order will require post-quantum key establishment on federal High Value Assets by December 31, 2030 and post-quantum signatures by December 31, 2031, and will reach federal contractors through PQC-inclusive FIPS compliance by the end of 2030 (Cloudflare’s analysis of EO 14412, June 23, 2026; OMB M-26-15); the UK NCSC guidance sets discovery by 2028, highest-priority migrations by 2031 and full migration by 2035 (our QKD post carries the NCSC clock); and the G7 Cyber Expert Group published a coordinated — and explicitly non-binding — PQC roadmap for the financial sector on January 13, 2026 (gov.uk).

What is «harvest now, decrypt later», and which data does it already touch?

Harvest now, decrypt later (HNDL) is the attack that makes the timing question concrete: traffic encrypted with RSA/ECC can be recorded today and decrypted years later, once a capable machine exists — so for long-lived secrets, the relevant date is not Q-Day but today minus nothing. The standard way to reason about it is Mosca’s inequality (Mosca, IACR ePrint 2015/1075): if x is how long your data must stay secret and y is how long your migration will take, you are already late whenever x + y exceeds the time to a cryptographically relevant quantum computer. Under our own bet’s floor (no break before 2031, window 2033–2039, sealed October 9, 2026), any data that must stay confidential into the mid-2030s — medical records, civil registries, banking and tax records, state archives, long-term contracts — is already inside the HNDL window if it crosses the network under classical key exchange. That arithmetic is the reason every deadline in the table below lands in 2030–2035 even though no quantum computer has broken anything yet (0 broken keys, our usage map).

Which deadlines has a Latin American regulator set?

None that the public record shows. A dated compilation published September 23, 2026 checked Colombia’s Superintendencia Financiera, Mexico’s CNBV and Banxico, Chile’s CMF and Brazil’s Banco Central and found no post-quantum deadline from any of them (AndesQubit); Rosetta Quantum’s own search of the public record on October 12, 2026 found none either — a zero with its test attached: two independent scans, dated, of published regulation. What does exist in the region is study and scaffolding, in the future tense. Brazil’s central bank, asked in March 2026, said quantum-era cryptography regulation is under study: «É um assunto emergente, o Banco Central está estudando» (Finsiders Brasil, March 26, 2026) — and its 2022 feasibility study of a post-quantum signature for Pix concluded verbatim that «o algoritmo Picnic ainda é incompatível com as demandas atuais do Pix» (Microsoft News Brasil, May 11, 2022). Colombia’s national digital security strategy 2025–2027 includes an action to develop post-quantum capabilities, without its own deadline (Observatorio Quantum Safe, October 7, 2026). In Mexico, a Consejo Consultivo Quantum Safe was created on September 22, 2026 — an advisory body that will issue recommendations, not deadlines (reported by AndesQubit; we found no second source for it this run and flag that). The deadlines that do bind companies in the region today come from outside it, through vendors, US federal contract chains and G7 counterparties.

What does the freshest measurement in the region say?

That the gap is operational, not rhetorical. On October 7, 2026 the Observatorio Quantum Safe — an initiative of the vendor Cyte with professors from Universidad de los Andes; the report itself declares that its publisher sells related products, and we repeat that declaration here — published a measurement, not a survey: on September 18, 2026 it probed the 5,143 active services of a census covering 5,142 Colombian organizations and scored 4,110 of them (Observatorio Quantum Safe, October 7, 2026). Measured: 52% (1,913 of 3,679) do not negotiate post-quantum key exchange in the hybrid groups tested; 15.2% (559 of 3,679) have the protection only because a foreign edge provider switched it on for its whole network; government services run 81.5% without post-quantum key exchange (542 of 665), the financial sector 40% (360 of 899); 75.6% of the 4,110 carry signature debt (RSA of 2,048 bits or less, weak DKIM keys, or SHA-1 in DNSSEC); and only 1.5% of zones (61 of 4,110) have validatable DNSSEC. The report warns its numbers describe that census and should not be extrapolated to the country, and we carry the warning. Two readings matter for a decision-maker: the 52% says most of the measured gap is a configuration gap, not a procurement gap — and the 15.2% says post-quantum protection is already arriving by vendor default, which means it can also leave by vendor default. That is what the 67% global figure measures too (Cloudflare Radar, April 15, 2026): adoption that rode browser and CDN defaults, not corporate migration plans.

What can a company do this year without buying anything?

Five steps, every one of them paperwork or configuration. First: build a cryptographic inventory (CBOM) — where RSA/ECC lives, in which protocols, certificates, VPNs, signatures and vendor dependencies; it is the precondition every roadmap starts with, from the G7 statement (gov.uk, January 13, 2026) to the Colombian report’s recommendations (Observatorio, October 7, 2026). Second: turn on hybrid post-quantum key exchange where your software already supports it — ML-KEM hybrids ship today in mainstream browsers, servers and CDNs, which is precisely what the ≈67% of human HTTPS traffic on Cloudflare measures (Cloudflare Radar, April 15, 2026); for most organizations this will be a configuration change, not a purchase. Third: classify data by secrecy lifetime using Mosca’s x + y > z (IACR ePrint 2015/1075): anything that must stay secret past the early 2030s goes first, under the floor and window of our sealed bet. Fourth: put PQC in contracts — ask edge, email, CA and core-banking vendors for their post-quantum plan in writing, as the Colombian report recommends verbatim for its own audience (Observatorio); if you sell into US federal chains, the contractor FIPS deadline of end-2030 will already be yours (Cloudflare on EO 14412). Fifth: put the external clocks on your own calendar — TLS certificate lifetimes will drop to 100 days in March 2027 and 47 days in March 2029 under the CA/Browser Forum schedule (cited in the Observatorio report), so certificate-renewal automation built this year will be post-quantum readiness in disguise. Rosetta Quantum will re-run the regional deadline scan when a regulator in the region publishes one, same slug, dated.

What we don’t know

We don’t know whether any Latin American regulator has an unpublished internal PQC timeline: our zero reads only the public record, and both scans that produced it are dated (September 23 and October 12, 2026). We don’t know whether the Colombian census generalizes to the region — its authors warn against extrapolating, it is the only measurement of its kind we found for any Latin American country, and its publisher sells related services (declared in the report and here). We don’t know the exact timeline language inside the G7 CEG statement’s PDF: we verified its existence, title and date on gov.uk, and the 2030–2032 reading circulating comes from a dated secondary we cite as such. We don’t know whether the Mexican advisory council’s creation date holds: it rests on a single dated secondary this run. We don’t know what share of Latin American traffic the ≈67% represents: it is measured on one global network, not regionally. And we don’t know when a cryptographically relevant quantum computer will arrive: our own bet (floor 2031, window 2033–2039) is a sealed, refutable judgment — not a measurement — and the record it reads still shows 0 broken keys.

Sources

• NIST — releases first 3 finalized post-quantum encryption standards (2024-08-13)
• NIST IR 8547 (initial public draft, 2024-11) — Transition to Post-Quantum Cryptography Standards
• The Quantum Insider — NIST selects HQC as fifth algorithm (2025-03-11)
• Cloudflare — The White House’s post-quantum executive order (2026-06-23)
• OMB M-26-15 — Execution of the Migration to Post-Quantum Cryptography (2026-06)
• Cloudflare Radar (X) — ≈67% of human HTTPS traffic post-quantum secured (2026-04-15)
• AndesQubit — Post-quantum migration deadlines: US, EU, UK, G7 and LatAm (2026-09-23)
• Observatorio Quantum Safe — Estado de la criptografía quantum-safe en Colombia 2026 (2026-10-07)
• gov.uk — G7 Cyber Expert Group statement on PQC in the financial sector (2026-01-13)
• Finsiders Brasil — BC estuda regulação para IA e criptografia quântica (2026-03-26)
• Microsoft News Brasil — estudo de criptografia pós-quântica no Pix (2022-05-11)
• Mosca — Cybersecurity in an era with quantum computers: will we be ready? (IACR ePrint 2015/1075)
• Rosetta Quantum — What is QKD and does your company need it?
• Rosetta Quantum — When is Q-Day coming, based on what can be measured today?
• Rosetta Quantum — How many qubits does it take to break RSA-2048?
• Rosetta Quantum — Can a quantum computer break Bitcoin?
• Rosetta Quantum — What is quantum computing used for today?
• Rosetta Quantum — The PQC standards clock

Rosetta Quantum publishes verdicts with raw, reproducible data. This is educational content, not a product claim.