Governments are not waiting for a cryptographically relevant quantum computer to appear. The policy direction is clear: treat post-quantum cryptography (PQC) as a migration programme now, driven by harvest-now-decrypt-later risk and the long life of sensitive state and defence data.