QuantumSafeQuantumSafe
Regulation

Regulation & guidance

Standards are final, roadmaps have deadlines and regulators expect a plan. Here is what the main publications say, and what they mean for your organisation.

Key dates

The transition has a timeline

2024

NIST publishes the first three finalized post-quantum standards: FIPS 203, 204 and 205.

End 2026

EU coordinated roadmap: member states start the transition to post-quantum cryptography.

2030

EU: high-risk use cases protected. NIST draft guidance: quantum-vulnerable algorithms such as RSA and ECC deprecated.

2035

EU: as many systems as feasible migrated. NIST draft guidance: quantum-vulnerable algorithms disallowed.

Sources: NIST, NIST IR 8547 (initial public draft), EU coordinated implementation roadmap for the transition to PQC (June 2025).

Key publications

From standards to national guidance

Over the past two years the focus has shifted from "which algorithms?" to "how do we migrate, and by when?".

Dates refer to publication. Several documents are guidance or recommendations rather than binding law; we help you separate what is mandatory from what is good practice.

  1. April 2024 · EU

    Commission Recommendation on a PQC roadmap

    The European Commission recommends a coordinated implementation roadmap for the transition to post-quantum cryptography across member states.

  2. August 2024 · US

    NIST finalizes FIPS 203, 204 and 205

    ML-KEM for key encapsulation, ML-DSA for digital signatures and SLH-DSA for hash-based signatures become the first finalized PQC standards.

  3. June 2025 · EU

    Coordinated implementation roadmap

    Concrete milestones for member states: start by end of 2026, protect high-risk use cases by end of 2030, migrate as many systems as feasible by 2035.

  4. G7

    Preparing for the Post-Quantum Era: A Call to Action

    The G7 Cybersecurity Working Group calls for treating quantum as a near-term threat across all sectors, not just critical infrastructure.

  5. 2026 · Netherlands

    Wet weerbaarheid kritieke entiteiten

    The Dutch implementation of the EU CER directive is published in the Staatsblad (2026, 188).

  6. July 2026 · Singapore

    CSA Quantum-Safe Handbook and Quantum Readiness Index

    Singapore's Cyber Security Agency publishes practical guidance and a readiness index, an international benchmark for migration planning.

By jurisdiction

Who says what

European Union

The Commission Recommendation of 11 April 2024 set out a coordinated approach to the PQC transition. The coordinated roadmap of June 2025 turned this into milestones: start by end of 2026, high-risk use cases by end of 2030, as many systems as feasible by 2035.

NIS2 requires state-of-the-art security and risk management, which increasingly includes quantum risk. The CER directive adds resilience obligations for critical entities.

European Commission: Recommendation (EU) 2024/1101 · EU PQC roadmap (June 2025)

Netherlands

AIVD, NCSC, TNO and CWI published the PQC-migratiehandboek. The AIVD and NCSC guide Maak je organisatie quantumveilig helps CIOs, CTOs and CISOs with risk analysis, an inventory of crypto assets, risk assessment, a migration plan and "no-regret" measures. According to that guide, experts expect quantum computers able to break widely used cryptography likely between 2030 and 2040.

The Wwke, the Dutch implementation of the CER directive, applies to organisations designated by the NCTV.

Staatsblad 2026, 188 · NCTV: organisations designated under the Wwke

United States

NIST's FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) are the reference standards worldwide. NIST's transition guidance, IR 8547 (draft), proposes deprecating quantum-vulnerable algorithms such as RSA and ECC by 2030 and disallowing them by 2035.

NIST: first 3 finalized post-quantum encryption standards

International

The G7 Cybersecurity Working Group calls the quantum threat a near-term risk for every sector, not just critical infrastructure. It frames the transition as a collective effort that needs early, coordinated planning across the public and private sectors.

Europol and UC3M examined "harvest now, decrypt later": encrypted data intercepted today can be decrypted once a quantum computer is available, which puts long-lived sensitive data at risk already.

G7: Call to Action · Europol: Harvest now, decrypt later

What this means for you

Who should act now

Migration takes years. Organisations that start with an inventory today keep their options open; those that wait inherit someone else's deadline.

Readiness assessment Governance & roadmap
  • Critical entities under the Wwke / CER: resilience obligations for essential services, which rely on cryptography that must stay trustworthy.
  • NIS2 entities: state-of-the-art security and risk management, which increasingly includes quantum risk.
  • Financial institutions: sector bodies are setting migration timelines, and long-lived transaction and customer data is a "harvest now, decrypt later" target.
  • Government and public sector: national guidance and the EU roadmap set the expectation to start by end of 2026.
  • Anyone with long-lived sensitive data: health records, intellectual property and other information that must stay confidential beyond 2030.

Not sure which obligations apply to you?

Ask our specialists