ZTC RESEARCH

Mexico and the Post-Quantum Transition 2026

A baseline of observable post-quantum transition built from public evidence, explicit attribution, and a traceable methodology.

ZTC RESEARCH · 2026 REPORT

Executive summary

2026

What can responsibly be stated about observable post-quantum transition in Mexico from public evidence.

CENTRAL FINDING

The evidence reveals dependencies; it does not yet support ranking organizations.

Cryptographic dependencies relevant to an eventual transition are widely observable. However, locally attributable public evidence of post-quantum transition still does not reach sufficient coverage to estimate organizational maturity responsibly.

50analytical units

500entity-dimension decisions

4estimable dimension decisions

0partial or complete ORS

FIVE PRINCIPAL FINDINGS

Dependencies are visible; transition is far less observable

Conventional cryptographic dependencies —including HSM, KMS, PKI, TLS, encryption, or tokenization— were identified in 30 of 50 units, while locally estimable PQC evidence appears in only four entity-dimension decisions.

Cloud provides the clearest locally attributable technical evidence

AWS Mexico Central and Google Cloud Querétaro contain the only technically estimable, locally attributable dimensions in the panel. The result describes specific dimensions, not aggregate organizational maturity.

Global capability is not automatically inherited by Mexico

A group, product, or provider capability does not by itself demonstrate local adoption. The protocol requires an explicit attribution and applicability link for the Mexican unit.

A signal is not the same as demonstrated maturity

Local PQC-related signals were identified, but a mention, initiative, or public context is not enough to adjudicate a dimension without sufficient evidence.

Mexico shows technical capacity, but no comparable national transition instrument at cutoff

The corpus includes academic and R&D activity in PQC. At the cutoff, no national transition instrument comparable to the more structured public frameworks in the international corpus was identified.

What this means for executive decisions

The priority is not to “buy PQC” immediately. It is to know what cryptography exists, which data must remain protected for years, which dependencies are controlled by third parties, and how long migration will take. Inventory, prioritization, crypto-agility, testing, and governance are the starting point.

DOCUMENTS

ZTC RESEARCH