BRICS Post-Quantum Readiness 2026: Why Cryptographic Fragmentation Matters
SITG-Consulting’s BRICS Post-Quantum Cryptography Readiness 2026 report is now available on Zenodo. It examines publicly verifiable preparation for post-quantum migration across eleven states. None reached Tier 1, the threshold for a national PQC migration programme with implementation under way.
The report follows our publications on Europe, Africa, the United Kingdom and ASEAN. Together, the five publications cover 99 unique states, with overlapping countries counted once. The Africa report is the precursor to the locked-method series, a distinction retained in the BRICS report’s comparisons.
For SITG-Consulting, BRICS is our most consequential report to date.
Its significance extends beyond the readiness classifications. It examines a strategic problem for organisations operating internationally: post-quantum migration may take place across competing cryptographic ecosystems, rather than towards a common global destination.
DOI: 10.5281/zenodo.23568223
What the BRICS post-quantum readiness report found
The report applies a five-tier framework to publicly verifiable national preparation for replacing quantum-vulnerable public-key cryptography.
The distribution is:
Classification | States | Number |
Tier 1: National PQC migration programme, implementation under way | None | 0 |
Tier 2: Active national PQC development, structured government preparation | Brazil, India, Indonesia, Iran, Saudi Arabia, United Arab Emirates | 6 |
Tier 3: PQC research and structured awareness | China, Ethiopia, Russia | 3 |
Tier 4: Limited PQC evidence | Egypt, South Africa | 2 |
Tier 5: No sufficient public PQC evidence identified | None | 0 |
Six of eleven states, or 54.5%, demonstrate structured government preparation. None crosses the report’s Tier 1 boundary on the public evidence assessed.
These are classifications of migration machinery, not measurements of how much vulnerable cryptography has already been replaced. A lower tier does not establish that a state lacks technical capability or that unpublished activity does not exist.
Why BRICS presents a different governance problem
BRICS has no supranational regulator or shared regulatory harmonisation mechanism that converts collective statements into national post-quantum migration obligations.
Each state’s trajectory therefore depends on its own authorities, instruments, standards and implementation arrangements. BRICS-level cooperation provides context, but the report does not credit it as national implementation.
For an organisation operating across these jurisdictions, a regional label offers little assurance about the obligations it will encounter.
The relevant questions are national and operational:
Which authority sets the requirements?
Which entities and systems fall within scope?
Are the requirements binding or advisory?
Which algorithms and standards are accepted?
What dates apply?
How must progress be demonstrated?
The report’s findings show why these questions cannot be answered by reference to economic weight, quantum investment or general cybersecurity maturity alone.
Cryptographic capability is not migration governance
China and Russia both sit at Tier 3.
That finding does not dismiss their cryptographic institutions, research or technical capacity. It reflects the absence of demonstrable national migration machinery meeting the higher-tier tests on the record examined.
China has a national algorithm competition, government-funded post-quantum research and banking pilots. Russia has a dedicated post-quantum working group within its national cryptographic standards committee, published research and a central bank draft policy direction addressing preparation for transition.
Those activities matter. They do not, by themselves, establish an operating programme for replacing the installed cryptographic estate.
A national algorithm programme is not a national migration programme.
The distinction concerns what happens after technical development: who must identify vulnerable systems, who must change them, by when, under whose authority, and through what reporting or supervisory mechanism.
Why the UAE and Saudi Arabia are closest to Tier 1
The two states nearest the Tier 1 boundary are the United Arab Emirates and Saudi Arabia. Their remaining gaps differ
United Arab Emirates: a mandatory control without a compliance date
The UAE’s Information Assurance Standard contains a post-quantum control requiring covered entities to maintain an inventory of systems and applications using public-key cryptography.
The control applies by default, with exclusions requiring justification to the national Cyber Security Council. However, no compliance date attaches to it, and no entity’s execution was observable through the published evidence examined. The operative text of the linked National Encryption Policy also remained unread because retrieval attempts failed.
The report therefore retains Tier 2 conservatively. It does not claim that implementation cannot exist.
Saudi Arabia: dated financial-sector obligations without national scope
Saudi Arabia’s central bank has issued a binding instrument requiring supervised financial institutions to ensure the accuracy and comprehensiveness of their cryptographic inventory procedures by the end of the fourth quarter of 2026.
It also requires a quantum-risk assessment with action plans by the end of the first quarter of 2027.
The distinction is important: the first obligation concerns inventory procedures, not delivery of a completed inventory.
The instrument remains sector-specific, requires no submission to the central bank, and its first deadline falls after the report’s evidence cut-off. The national cryptographic standard that could extend post-quantum requirements to government and critical infrastructure remained a consultation draft on the record examined.
India demonstrates the difference between a roadmap and a mandate
India sits at Tier 2 with a dated national roadmap and substantive official preparation.
Its roadmap specifies milestones but explicitly states that the framework is not itself a regulatory mandate. Enforcement depends on sectoral authorities translating the roadmap into applicable requirements.
That does not mean India has no binding PQC-related requirements. The report identifies securities-regulator requirements addressing post-quantum risk assessment, alongside telecommunications standards and other official preparation.
The unresolved issue is whether the national roadmap’s dates have become enforceable migration duties for the populations concerned.
For enterprises, this is a practical distinction. A published target, a product standard and a regulatory obligation are different instruments. They create different responsibilities and require different evidence of compliance.
Cryptographic fragmentation changes the enterprise risk
China’s national competition excludes algorithms whose standardisation has already been advanced or completed by an international body, country or region, together with unmodified variants of those algorithms.
The report identifies the consequence: algorithms emerging from that competition will not simply reproduce the NIST-standardised set. Russia’s development of Russian-origin mechanisms adds a further reason not to assume universal convergence.
This does not establish that future systems will be incompatible. It establishes that a common algorithmic destination cannot be taken for granted.
For cross-border organisations, the planning implications extend beyond selecting a quantum-resistant algorithm:
Cryptographic inventories need to identify jurisdictional and supplier dependencies.
Procurement needs to establish which standards a product supports, not merely whether it carries a “quantum-safe” label.
System owners need to understand where certificates, trust services and cryptographic products cross regulatory boundaries.
Migration plans need to account for algorithm diversity and future replacement.
Governance needs to distinguish technical support from national approval or acceptance.
These are enterprise implications drawn from the report’s findings, not predictions that every jurisdiction will impose a separate cryptographic regime.
What boards and security leaders should do with the findings
The report’s practical starting point is the cryptographic estate: what exists, who owns it, how long it must remain secure, and which dependencies constrain its replacement.
Establish an accountable inventory
Identify systems, applications and dependencies using quantum-vulnerable public-key cryptography. Assign owners capable of validating the record and driving change.
Prioritise by consequence
Assess data confidentiality lifetimes, system criticality and exposure to harvest-now-decrypt-later risk. A migration sequence needs a risk basis, not simply a list of available products.
Separate obligations from announcements
Record whether each relevant instrument is a binding requirement, a roadmap, a consultation, a technical standard or a research programme. Do not treat them as interchangeable.
Make delivery observable
Define milestones, accountable authorities and evidence requirements. Progress should be capable of being reported, challenged and audited.
These priorities reflect the report’s central governance argument: recognising quantum risk is not the same as operating machinery to resolve it.
What this report does not claim
The evidence cut-off is 27 September 2026. The report is not a live register of subsequent developments.
Its public-source method cannot establish the absence of unpublished, classified or unlocated activity. Publication cultures, inaccessible documents and procurement opacity affect what can be verified.
The classifications do not measure completed deployment, prove that a particular state is safer than another, or predict when a cryptographically relevant quantum computer will exist.
Saudi Arabia is included because BRICS lists it as a member. The report explicitly discloses that formal Saudi acceptance of membership was not publicly confirmed on the record examined.
Those qualifications define the findings’ scope. They also make the classifications open to challenge through new evidence.
Five reports, 99 states, one continuing governance question
Our published work now spans Europe, Africa, the United Kingdom, ASEAN and BRICS.
Across those five publications, 99 unique states have been examined. The BRICS report carries forward the distinction between the Africa precursor and the later locked-method reports rather than presenting every publication as methodologically identical.
BRICS adds a further dimension to the research.
Organisations must consider not only whether migration is governed, but whether their systems will need to operate across different cryptographic destinations.
An organisation can prepare for quantum risk and still be unprepared for cryptographic fragmentation.
That is the enterprise consequence this report brings into focus.
Read the full BRICS-11 report
BRICS Post-Quantum Cryptography Readiness 2026: An Empirical Assessment of the BRICS-11
Author: Brian Couzens, SITG-ConsultingEvidence cut-off: 27 September 2026Licence: Creative Commons Attribution 4.0 International, CC BY 4.0DOI: 10.5281/zenodo.23568223
About the author
Brian Couzens is CEO and Managing Partner of SITG-Consulting. His work focuses on post-quantum cryptography, cryptographic governance, quantum risk and enterprise cryptographic transformation.
Comments