Start with an inventory: where does your company use cryptography, and how long must the protected data stay confidential?
The EU timeline
- June 2025: The NIS Cooperation Group published a coordinated roadmap for the transition to post-quantum cryptography.
- End of 2026: Member States should have national roadmaps and first steps in place, such as inventories, risk analyses and pilots.
- End of 2030: Use cases with high risk, including critical infrastructure, should be protected.
- End of 2035: The transition should be complete for as many systems as feasible.
One example: Germany
On 12 October 2026, the German BSI, BMI and BMDS published a joint guideline that applies the roadmap to authorities and companies. It recommends clear responsibilities with binding deadlines, quantum risk in risk management, early involvement of manufacturers and supply chains, and hybrid approaches.
Please note: The roadmap is a recommendation to Member States, not a law for companies. Binding effects arise through national law and NIS2.
Three questions for your next review
- Inventory: Where do we use cryptography, for example certificates, VPN, signatures and archives?
- Risk: Which data must stay confidential beyond 2030?
- Suppliers: Which vendors have a plan for the transition, and who owns ours?
Source: NIS Cooperation Group, BSI, BMI, BMDS
Research as of: October 18, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
