European Union

Executing
European Commission (DG CNECT) · NIS Cooperation Group · ENISA

Commission Recommendation (EU) 2024/1101 of 11 April 2024 invited Member States to build a coordinated roadmap. The NIS Cooperation Group's 'Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography' was adopted on 23 June 2025: Member States should start the transition by the end of 2026, protect high-risk use cases as soon as possible and no later than the end of 2030, and complete the transition of remaining systems as far as possible by 2035.

Recommendations and roadmaps are not directly binding. The binding layer is NIS2 as transposed by each Member State, so the real obligation depends on the country and the sector supervisor.

Scope

Member State public administrations, and — through NIS2 risk-management obligations — essential and important entities in the covered sectors

Band rationale

A coordinated roadmap rather than a single PQC regulation; enforcement comes from national law and NIS2.

Readiness dimensions
Policy
Deadline maturity
Technical standards
Execution evidence
Supply-chain enablement
Evidence confidence
Milestones
  1. 2024-04-11

    Commission Recommendation (EU) 2024/1101

    Calls for a coordinated implementation roadmap across Member States.

    Bindingness · policy roadmap
  2. 2025-06-23

    Coordinated Implementation Roadmap published

    NIS Cooperation Group PQC workstream roadmap (Part 1) published by the Commission.

    Bindingness · policy roadmap
  3. 2026-12

    Transition starts

    Member States should have started the national transition to post-quantum cryptography.

    Bindingness · policy roadmap
  4. 2030-12

    High-risk use cases migrated

    High-risk cryptographic use cases protected at the latest by end-2030.

    Bindingness · policy roadmap
  5. 2035-12

    Remaining transition

    Transition of the remaining systems as far as possible by 2035.

    Bindingness · policy roadmap
Why it matters

The EU milestone set is the reference point most European sector regulators — financial, energy, telecom — will align their own expectations to.

Migration implications
  • ·Check the Member State transposition and sector supervisor, not only the EU roadmap
  • ·High-risk classification drives sequencing and is defined nationally
  • ·Expect supervisors to ask for a cryptographic inventory first
Evidence
Compare with United StatesCompare with United KingdomCompare with FranceCompare with NetherlandsCompare with Canada