#

Key takeaways

• Google Cloud published an updated post-quantum cryptography roadmap.

• The roadmap targets full readiness by 2029.

• It includes milestones for 2027 and 2028.

• Google Cloud API endpoints already use NIST-standardized ML-KEM in hybrid mode.

• Cloud KMS has general availability for NIST-standardized PQC algorithms.

What the roadmap says

SecurityWeek reported on August 14, 2026 that Google Cloud published an updated post-quantum cryptography roadmap. The roadmap targets full readiness by 2029. It also sets milestones for 2027 and 2028.

The report says Google Cloud API endpoints already use NIST-standardized ML-KEM in hybrid mode. It also says Cloud KMS has general availability for NIST-standardized PQC algorithms. Those details show that the roadmap is not only a future plan. It also includes current product changes.

Why the update matters

Post-quantum cryptography is about preparing for a future where current cryptographic methods may need replacement. In this report, Google Cloud is signaling a staged transition rather than a single switch. That matters because security changes often take time across systems, services, and teams.

The roadmap gives a timeline. It also gives a sense of sequence. First come the intermediate milestones, then full readiness by 2029. For organizations that depend on cloud security features, that kind of roadmap can help with planning.

What is already available

The report highlights two current points. First, Google Cloud API endpoints already use ML-KEM in hybrid mode. Second, Cloud KMS has general availability for NIST-standardized PQC algorithms.

These details suggest that some post-quantum capabilities are already in place. They do not mean every system is fully migrated. They do show that Google Cloud is moving from planning to implementation.

Operational considerations

A roadmap like this can affect how teams think about long-lived data protection. If data must remain protected for many years, cryptographic planning becomes more important. That is especially true when systems are expected to stay in use across multiple upgrade cycles.

The report does not provide implementation guidance. It does not describe migration steps, compatibility issues, or customer obligations. So the safest reading is that organizations should treat this as a signal to review their own security timelines, not as a complete action plan.

Governance and risk

The main risk in any cryptographic transition is delay. If systems rely on older methods for too long, teams may face rushed changes later. A staged roadmap can reduce that pressure, but only if planning starts early.

The report also implies a mixed environment. Hybrid mode means new and existing approaches can coexist during transition. That can be useful, but it can also add complexity. Teams may need to track which services use which protections.

Morocco relevance

The source reports no Morocco-specific Google Cloud commitment. For readers in Morocco, the global lesson is simple: if your systems store data for the long term, track vendor cryptography roadmaps early.

Bottom line

Google Cloud's updated roadmap sets a clear direction. It points to milestones in 2027 and 2028, with full readiness by 2029. It also shows that some post-quantum features are already available in Google Cloud products.

For readers following cloud security, the key point is timing. The transition is underway, but it is still staged. That makes planning, inventory, and vendor monitoring more important than waiting for a final deadline.