Compliance calendar: dated obligations and milestones
Not legal advice. This calendar lists dates as each official source states them on the date read, and which organisation types and sectors a date affects is the portal’s editorial reading, not a legal qualification. Whether and how a rule applies to an organisation depends on the legal text, national law and the facts of each case: check the official source and seek qualified advice.
Dated obligations and milestones for organisations working with quantum and post-quantum technology: post-quantum migration deadlines, Cyber Resilience Act and NIS2 dates, standards milestones, public dates of the EU dual-use control list, Quantum Act procedure stages and policy changes noted by the editors. Filter by organisation type and sector; each date shows its source, the date it was read and the organisation types it affects.
Calendar feed (iCal) of these dates · Download these dates as CSV · What is due when: PQC and standards deadlines · EU legislation and consultation tracker · Post-quantum cryptography guide · EU legal acts
81 dates · Last 12 months and upcoming
2025
Dual-use items: the 2025 update of the EU control list enters into force · EU legal act
Dual-use export controls (public dates only) · Enters into force · European Union
Commission Delegated Regulation (EU) 2025/2003 replaces Annex I to Regulation (EU) 2021/821; the controls themselves are on the official text and, for detail, on the restricted export-control pages.
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Commission Delegated Regulation (EU) 2025/2003, Official Journal text, Publications Office copy of CELEX 32025R2003 (read 2026-10-28) · Official Journal header L series 2025/2003, 14.11.2025; Article 2
Quantum Act: Call for evidence for an impact assessment closes · Legislation tracker
Quantum Act procedure · Consultation closes · European Union · Partly verified
Affects: Manufacturer of products with digital elements, Public body, Research organisation, SME (micro, small or medium-sized enterprise). Sectors: All sectors.
Source: Have your say: EU Quantum Act (initiative 15512) (read 2026-10-25) · Read through the public API https://ec.europa.eu/info/law/better-regulation/brpapi/groupInitiatives/15512: dg, foreseenActType, publications 20957 (INIT_PLANNED), 20961 (CFE_IMPACT_ASSESS: publishedDate, endDate, totalFeedback, receivingFeedbackStatus), 20959 (PROP_REG: plannedPeriod, plannedStartDate, plannedEndDate, status UPCOMING)
Quantum Act: Call for evidence closed (216 contributions recorded) · Legislation tracker
Quantum Act procedure · Procedure step · European Union · Partly verified
Affects: Manufacturer of products with digital elements, Public body, Research organisation, SME (micro, small or medium-sized enterprise). Sectors: All sectors.
Source: Have your say: EU Quantum Act (initiative 15512) (read 2026-10-25) · Read through the public API https://ec.europa.eu/info/law/better-regulation/brpapi/groupInitiatives/15512: dg, foreseenActType, publications 20957 (INIT_PLANNED), 20961 (CFE_IMPACT_ASSESS: publishedDate, endDate, totalFeedback, receivingFeedbackStatus), 20959 (PROP_REG: plannedPeriod, plannedStartDate, plannedEndDate, status UPCOMING)
Phase 2: hybridation mandatory, post-quantum security claims possible in visas: ANSSI PQC position paper (2022) and follow-up (2023) · Standards tracker
Post-quantum cryptography migration · Target date · France
ANSSI views on the Post-Quantum Cryptography transition / Avis de l'ANSSI sur la migration vers la cryptographie post-quantique (suivi 2023)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ANSSI (MesServicesCyber): ANSSI views on the Post-Quantum Cryptography transition (EN) (read 2026-10-25) · Transition plan phases 1-3 and security visa phases
2026
NIS2 targeted amendment (2026/0012(COD)): Commission adopted the proposal as part of the cybersecurity package (OEIL lists the proposal under 14/01/2026; the document is dated 20.1.2026) · Legislation tracker
NIS2 · Procedure step · European Union · Partly verified
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: COM(2026) 13 final (Publications Office item, CELEX 52026PC0013) (read 2026-10-25) · Cover (Strasbourg, 20.1.2026; 2026/0012 (COD)); explanatory memorandum list of measures ('policies for the migration to post-quantum cryptography'); recital 8; amending point inserting Article 7(2)(k)
V1.2.2 published: ETSI TS 103 744 · Standards tracker
Standards milestones · Publication · International
Cyber Security (CYBER); Quantum-Safe Cryptography (QSC); Quantum-safe Hybrid Key Establishment
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ETSI Work Programme: work item plan, CYBER QSC (read 2026-10-25) · Row for ETSI TS 103 744
Evaluation of the Dual-Use Regulation: Evaluation initiative published on Have your say (planning stage) · Legislation tracker
Dual-use export controls (public dates only) · Procedure step · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Have your say: Evaluation of Regulation (EU) 2021/821 (initiative 17172) (read 2026-10-25) · Read through the public API (brpapi/groupInitiatives/17172): dg, foreseenActType, publications 22443, 25506, 25527 (publishedDate, endDate, totalFeedback), 22446 (plannedStartDate, plannedEndDate)
NIS2 targeted amendment (2026/0012(COD)): Referral to the ITRE committee announced in Parliament plenary (first reading) · Legislation tracker
NIS2 · Procedure step · European Union · Partly verified
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: OEIL procedure file 2026/0012(COD) (read 2026-10-25) · Key players, Key events, Documentation gateway
RFC published: RFC 9935 · Standards tracker
Standards milestones · Publication · International
Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: IETF Datatracker: draft-ietf-lamps-kyber-certificates (RFC 9935) (read 2026-10-25) · Document header
RFC published: RFC 9936 · Standards tracker
Standards milestones · Publication · International
Use of ML-KEM in the Cryptographic Message Syntax (CMS)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: IETF Datatracker: draft-ietf-lamps-cms-kyber (RFC 9936) (read 2026-10-25) · Document header
Phase 1 departmental and SSC PQC migration plans; annual progress reporting begins: TBS Security Policy Implementation Notice (SPIN) on PQC migration · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice
Affects: Public body. Sectors: Public administration.
Source: Government of Canada (TBS): Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice (read 2026-10-25) · Section 1 effective date; sections 6.1-6.3 requirements
PQC procurement clauses in contracts for digital components entered after this date (Procurement): TBS Security Policy Implementation Notice (SPIN) on PQC migration · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice
Affects: Public body. Sectors: Public administration.
Source: Government of Canada (TBS): Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice (read 2026-10-25) · Section 1 effective date; sections 6.1-6.3 requirements
Version -19 posted: draft-ietf-lamps-pq-composite-sigs-19 · Standards tracker
Standards milestones · Publication · International
Composite Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for use in X.509 Public Key Infrastructure
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: IETF Datatracker: draft-ietf-lamps-pq-composite-sigs (read 2026-10-25) · Document header (IESG state, RFC Editor state, intended status, dates)
NIS2 targeted amendment (2026/0012(COD)): European Economic and Social Committee opinion (CES0075/2026) · Legislation tracker
NIS2 · Procedure step · European Union · Partly verified
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: OEIL procedure file 2026/0012(COD) (read 2026-10-25) · Key players, Key events, Documentation gateway
Develop an initial departmental PQC migration plan: ITSM.40.001 · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)
Affects: Public body. Sectors: Public administration.
Source: Canadian Centre for Cyber Security: Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001) (read 2026-10-25) · Overview; Section 4 milestones; Effective date and Revision history; Footnote 1
Report on PQC migration progress (annual): ITSM.40.001 · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)
Affects: Public body. Sectors: Public administration.
Source: Canadian Centre for Cyber Security: Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001) (read 2026-10-25) · Overview; Section 4 milestones; Effective date and Revision history; Footnote 1
NIS2 targeted amendment (2026/0012(COD)): Feedback on the Commission proposals (COM(2026) 11 and COM(2026) 13) closes · Legislation tracker
NIS2 · Consultation closes · European Union · Partly verified
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: Have your say: The EU Cybersecurity Act (initiative 14578) (read 2026-10-25) · Read through the public API: publication PROP_DIR, reference COM(2026)13, feedback end 2026-05-12
Round 2 status report; round 3 candidates announced: NIST IR 8610 · Standards tracker
Standards milestones · Publication · United States
Status Report on the Second Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NIST CSRC: NIST IR 8610 (read 2026-10-25) · Header, document history and abstract
Version 3 draft for public review posted: ECCG Agreed Cryptographic Mechanisms v3 (draft) · Standards tracker
Standards milestones · Publication · European Union
ECCG Agreed Cryptographic Mechanisms - version 3 - draft for public review
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ENISA EU Cybersecurity Certification: EUCC Guidelines on Cryptography (read 2026-10-25) · Introductory text and section 'Draft for public review'
Cyber Resilience Act: rules on notifying conformity assessment bodies apply · EU legal act
Cyber Resilience Act · Applies from · European Union
Chapter IV (Articles 35 to 51), on notifying authorities and the notification of conformity assessment bodies, applies from this date.
Affects: Public body, Conformity assessment body. Sectors: All sectors.
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text, Publications Office copy of CELEX 32024R2847 (read 2026-10-28) · Article 71(2), second sentence; recital 126
V1.1.1 published: ETSI GS QKD 020 · Standards tracker
Standards milestones · Publication · International
Quantum Key Distribution (QKD); Protocol and data format of REST-based Interoperable Key Management System API
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Research organisation. Sectors: All sectors.
Source: ETSI Work Programme: DGS/QKD-020_InteropKMS work item (read 2026-10-25) · Title and milestone table (publication 2026-06-29)
Latest group publication (GS QKD 020): ETSI ISG QKD · Standards tracker
Standards milestones · Publication · International
Quantum Key Distribution (QKD)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Research organisation. Sectors: All sectors.
Source: ETSI: Quantum Key Distribution (QKD) committee page (read 2026-10-25) · Recent publications list
RFC published: RFC 9980 · Standards tracker
Standards milestones · Publication · International
Post-Quantum Cryptography in OpenPGP
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: IETF Datatracker: draft-ietf-openpgp-pqc (RFC 9980) (read 2026-10-25) · Document header
Evaluation of the Dual-Use Regulation: Call for evidence and public consultation opened · Legislation tracker
Dual-use export controls (public dates only) · Procedure step · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Have your say: Evaluation of Regulation (EU) 2021/821 (initiative 17172) (read 2026-10-25) · Read through the public API (brpapi/groupInitiatives/17172): dg, foreseenActType, publications 22443, 25506, 25527 (publishedDate, endDate, totalFeedback), 22446 (plannedStartDate, plannedEndDate)
Public review closed: ECCG Agreed Cryptographic Mechanisms v3 (draft) · Standards tracker
Standards milestones · Comment period closes · European Union
ECCG Agreed Cryptographic Mechanisms - version 3 - draft for public review
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ENISA EU Cybersecurity Certification: EUCC Guidelines on Cryptography (read 2026-10-25) · Introductory text and section 'Draft for public review'
Published: EAS 18433:2026 · Standards tracker
Standards milestones · Publication · European Union
Quantum Computing - High-Level Programming Language
Affects: Manufacturer of products with digital elements, Research organisation. Sectors: All sectors.
Source: CEN-CENELEC: CEN/CLC/JTC 22 published standards (read 2026-10-25) · Row EAS 18433:2026
Published: EAS 18434:2026 · Standards tracker
Standards milestones · Publication · European Union
Quantum Computing - Roadmap for Post-Processing Software in Space
Affects: Manufacturer of products with digital elements, Research organisation. Sectors: All sectors.
Source: CEN-CENELEC: CEN/CLC/JTC 22 published standards (read 2026-10-25) · Row EAS 18434:2026
Published: EAS 18435-1:2026 · Standards tracker
Standards milestones · Publication · European Union
Quantum Computing - Hardware Abstraction Layer - Part 1: Descriptions and functional requirements
Affects: Manufacturer of products with digital elements, Research organisation. Sectors: All sectors.
Source: CEN-CENELEC: CEN/CLC/JTC 22 published standards (read 2026-10-25) · Row EAS 18435-1:2026
RFC published: RFC 10024 · Standards tracker
Standards milestones · Publication · International
Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: IETF Datatracker: RFC 10024 (read 2026-10-25) · Document header (type, status, date, replaced draft)
Cyber Resilience Act: reporting of actively exploited vulnerabilities and severe incidents applies · EU legal act
Cyber Resilience Act · Applies from · European Union
Article 14 reporting obligations of manufacturers apply from this date; Article 64(10), point (a), exempts microenterprises and small enterprises from administrative fines for missing the 24-hour early-warning deadline.
Affects: Manufacturer of products with digital elements, SME (micro, small or medium-sized enterprise). Sectors: All sectors.
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text, Publications Office copy of CELEX 32024R2847 (read 2026-10-28) · Article 71(2), second sentence; Article 14; Article 64(10), point (a)
Germany's national implementation of the EU PQC roadmap: Leitlinie zur Umstellung auf PQC (BMI/BMDS/BSI, Artikelnummer BMI26024) · Standards tracker
Standards milestones · Publication · Germany
Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: BSI: Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (download page) (read 2026-10-21) · Download page: title, joint guideline of BMDS, BMI and BSI, date 12.10.2026
Evaluation of the Dual-Use Regulation: Commission adopted the 2026 Delegated Regulation updating the Annex I control list · Legislation tracker
Dual-use export controls (public dates only) · Procedure step · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: DG TRADE: Exporting dual-use items (read 2026-10-25) · News entry of 14 September 2026 on the Delegated Regulation updating Annex I
Version -11 posted: draft-ietf-tls-mlkem-11 · Standards tracker
Standards milestones · Publication · International
ML-KEM Post-Quantum Key Agreement for TLS 1.3
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: IETF Datatracker: draft-ietf-tls-mlkem (read 2026-10-25) · Document header (WG state, IESG state, RFC Editor state, intended RFC status, dates)
NIS2 targeted amendment (2026/0012(COD)): ITRE draft report tabled (PE792.221) · Legislation tracker
NIS2 · Procedure step · European Union · Partly verified
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: OEIL procedure file 2026/0012(COD) (read 2026-10-25) · Key players, Key events, Documentation gateway
NIS2 targeted amendment (2026/0012(COD)): Amendments tabled in ITRE committee (PE796.471) · Legislation tracker
NIS2 · Procedure step · European Union · Partly verified
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: OEIL procedure file 2026/0012(COD) (read 2026-10-25) · Key players, Key events, Documentation gateway
CRA presumption of conformity via the EUCC: Initiative published on Have your say (planning stage); a draft act for feedback is announced as upcoming · Legislation tracker
Cyber Resilience Act · Procedure step · European Union · Partly verified
Affects: Manufacturer of products with digital elements, Conformity assessment body. Sectors: All sectors.
Source: European Commission, Have your say: Presumption of conformity with the Cyber Resilience Act via the EUCC (initiative 19480) (read 2026-10-27) · Initiative data (public API): summary, publication 26251 of 15 October 2026, draft delegated act upcoming, adoption planned Q1 2027
Evaluation of the Dual-Use Regulation: Call for evidence for an evaluation closes · Legislation tracker
Dual-use export controls (public dates only) · Consultation closes · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Have your say: Evaluation of Regulation (EU) 2021/821 (initiative 17172) (read 2026-10-25) · Read through the public API (brpapi/groupInitiatives/17172): dg, foreseenActType, publications 22443, 25506, 25527 (publishedDate, endDate, totalFeedback), 22446 (plannedStartDate, plannedEndDate)
Evaluation of the Dual-Use Regulation: Public consultation closes · Legislation tracker
Dual-use export controls (public dates only) · Consultation closes · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Have your say: Evaluation of Regulation (EU) 2021/821 (initiative 17172) (read 2026-10-25) · Read through the public API (brpapi/groupInitiatives/17172): dg, foreseenActType, publications 22443, 25506, 25527 (publishedDate, endDate, totalFeedback), 22446 (plannedStartDate, plannedEndDate)
Evaluation of the Dual-Use Regulation: Call for evidence (54 responses) and public consultation (86 responses) closed · Legislation tracker
Dual-use export controls (public dates only) · Procedure step · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Have your say: Evaluation of Regulation (EU) 2021/821 (initiative 17172) (read 2026-10-25) · Read through the public API (brpapi/groupInitiatives/17172): dg, foreseenActType, publications 22443, 25506, 25527 (publishedDate, endDate, totalFeedback), 22446 (plannedStartDate, plannedEndDate)
next from today
Quantum Act: Commission proposal for a regulation · Legislation tracker
Quantum Act procedure · Expected (as its source states it) · European Union · Partly verified
Affects: Manufacturer of products with digital elements, Public body, Research organisation, SME (micro, small or medium-sized enterprise). Sectors: All sectors.
Source: Have your say: EU Quantum Act (initiative 15512) (read 2026-10-25) · Read through the public API https://ec.europa.eu/info/law/better-regulation/brpapi/groupInitiatives/15512: dg, foreseenActType, publications 20957 (INIT_PLANNED), 20961 (CFE_IMPACT_ASSESS: publishedDate, endDate, totalFeedback, receivingFeedbackStatus), 20959 (PROP_REG: plannedPeriod, plannedStartDate, plannedEndDate, status UPCOMING)
Initial preparation and planning phase (PQC readiness) complete and first migration steps started: Leitlinie zur Umstellung auf PQC (BMI/BMDS/BSI, Artikelnummer BMI26024) · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: BSI: Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (PDF) (read 2026-10-25) · Header (11. September 2026); section 3 Zeitplan; section 4 intro; 4.1 Fristen verbindlich machen; inventory subsection; Impressum (Stand August 2026)
Initial cryptographic inventory complete: Leitlinie zur Umstellung auf PQC (BMI/BMDS/BSI, Artikelnummer BMI26024) · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: BSI: Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (PDF) (read 2026-10-25) · Header (11. September 2026); section 3 Zeitplan; section 4 intro; 4.1 Fristen verbindlich machen; inventory subsection; Impressum (Stand August 2026)
Responsible bodies (e.g. IT-Planungsrat, UP KRITIS) adopt the deadlines as binding where possible: Leitlinie zur Umstellung auf PQC (BMI/BMDS/BSI, Artikelnummer BMI26024) · Standards tracker
Post-quantum cryptography migration · Target date · Germany
Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: BSI: Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (PDF) (read 2026-10-25) · Header (11. September 2026); section 3 Zeitplan; section 4 intro; 4.1 Fristen verbindlich machen; inventory subsection; Impressum (Stand August 2026)
PAR expires: IEEE P7130 · Standards tracker
Standards milestones · Review date · International
IEEE Draft Standard for Quantum Technologies Definitions
Affects: Manufacturer of products with digital elements, Research organisation. Sectors: All sectors.
Source: IEEE SA: SASB Meeting Minutes 10 December 2025 (PDF) (read 2026-10-25) · 3.2.3 NesCom Recommendations, Extension Requests, P7130
Quantum risk in risk management; own cryptography policy per Rijksbreed Beleidskader Cryptografie: Rijksbrede Quantumstrategie (2026), PQC-migratie tijdpad · Standards tracker
Post-quantum cryptography migration · Target date · Netherlands
Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbinden
Affects: Public body. Sectors: Public administration.
Source: Rijksoverheid (open.overheid.nl): Rijksbrede Quantumstrategie (PDF) (read 2026-10-25) · Section 4.1.1 Voorbereiden van de Rijksoverheid op de quantumdreiging, box 'PQC-migratie tijdpad voor de Nederlandse Rijksoverheid' (page 36)
EU roadmap milestone 1: first steps and national roadmaps: EU PQC Coordinated Implementation Roadmap (Part 1) · Standards tracker
Post-quantum cryptography migration · Target date · European Union
A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body. Sectors: All sectors.
Source: NIS Cooperation Group: A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, Part 1, version 1.1 (read 2026-10-21) · Section 4.1, timeline for the transition to PQC, point 1 (by 31.12.2026); section 4.2, box Milestone 1
2027
CRA presumption of conformity via the EUCC: Commission adoption of the delegated regulation · Legislation tracker
Cyber Resilience Act · Expected (as its source states it) · European Union · Partly verified
Affects: Manufacturer of products with digital elements, Conformity assessment body. Sectors: All sectors.
Source: European Commission, Have your say: Presumption of conformity with the Cyber Resilience Act via the EUCC (initiative 19480) (read 2026-10-27) · Initiative data (public API): summary, publication 26251 of 15 October 2026, draft delegated act upcoming, adoption planned Q1 2027
Evaluation of the Dual-Use Regulation: Commission evaluation (staff working document) · Legislation tracker
Dual-use export controls (public dates only) · Expected (as its source states it) · European Union
Affects: Manufacturer of products with digital elements, Research organisation, SME (micro, small or medium-sized enterprise), Exporter of dual-use items. Sectors: All sectors.
Source: Have your say: Evaluation of Regulation (EU) 2021/821 (initiative 17172) (read 2026-10-25) · Read through the public API (brpapi/groupInitiatives/17172): dg, foreseenActType, publications 22443, 25506, 25527 (publishedDate, endDate, totalFeedback), 22446 (plannedStartDate, plannedEndDate)
Plans updated to guide Phase 2: TBS Security Policy Implementation Notice (SPIN) on PQC migration · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice
Affects: Public body. Sectors: Public administration.
Source: Government of Canada (TBS): Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice (read 2026-10-25) · Section 1 effective date; sections 6.1-6.3 requirements
Assessment of the PQC Recommendation due: Commission Recommendation (EU) 2024/1101 · Standards tracker
Post-quantum cryptography migration · Target date · European Union
Commission Recommendation (EU) 2024/1101 of 11 April 2024 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography
Affects: Public body. Sectors: Public administration.
Source: EUR-Lex: Commission Recommendation (EU) 2024/1101, document information and text (read 2026-10-21) · Document information, dates: deadline 12/04/2027, review at the latest, see point 11; point (11) of the text
NIS2: Commission review of the functioning of the Directive · EU legal act
NIS2 · Review date · European Union
The Commission reviews the functioning of the Directive and reports to the European Parliament and the Council, assessing in particular the size of the entities and the sectors covered.
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: Energy, Transport, Banking and financial market infrastructure, Health, Drinking water and waste water, Digital infrastructure and telecommunications, ICT service management and digital providers, Public administration, Space, Manufacturing, Research, Other NIS2 sectors (postal and courier, waste, chemicals, food).
Source: Directive (EU) 2022/2555 (NIS2), Official Journal text, Publications Office copy of CELEX 32022L2555 (read 2026-10-28) · Article 40
Products designed to the essential cybersecurity requirements · PQC guide
Cyber Resilience Act · Applies from · European Union
Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 13(1), Article 71(2) and Annex I, Part I, point (2)(e) and (f)
Affects: Manufacturer of products with digital elements, SME (micro, small or medium-sized enterprise). Sectors: All sectors.
Source: EUR-Lex: Regulation (EU) 2024/2847 (Cyber Resilience Act) (read 2026-10-21) · Article 13(1); Article 71(2), first subparagraph; Annex I, Part I, point (2), points (e) and (f)
Final HQC standard expected: HQC (planned FIPS) · Standards tracker
Standards milestones · Expected (as its source states it) · United States · Partly verified
HQC selected for standardization (NIST IR 8545 rationale)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NIST: NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption (read 2026-10-25) · Body text on draft timing, 90-day comment period and 2027 finalization
HNDL mitigations; (draft) PQC migration planning and pilots; crypto asset management; staffing and budget insight: Rijksbrede Quantumstrategie (2026), PQC-migratie tijdpad · Standards tracker
Post-quantum cryptography migration · Target date · Netherlands
Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbinden
Affects: Public body. Sectors: Public administration.
Source: Rijksoverheid (open.overheid.nl): Rijksbrede Quantumstrategie (PDF) (read 2026-10-25) · Section 4.1.1 Voorbereiden van de Rijksoverheid op de quantumdreiging, box 'PQC-migratie tijdpad voor de Nederlandse Rijksoverheid' (page 36)
2028
System records updated, high-priority systems identified, Phase 3 plans, transition of systems begins: TBS Security Policy Implementation Notice (SPIN) on PQC migration · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice
Affects: Public body. Sectors: Public administration.
Source: Government of Canada (TBS): Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice (read 2026-10-25) · Section 1 effective date; sections 6.1-6.3 requirements
Define migration goals, complete discovery and assessment, build initial migration plan: NCSC guidance: PQC migration timelines · Standards tracker
Post-quantum cryptography migration · Target date · United Kingdom
Timelines for migration to post-quantum cryptography
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NCSC: Timelines for migration to post-quantum cryptography (read 2026-10-25) · Page header (published/reviewed dates) and migration timeline milestones section
PQC requirements in procurement; guidance and policy for essential entities: Rijksbrede Quantumstrategie (2026), PQC-migratie tijdpad · Standards tracker
Post-quantum cryptography migration · Target date · Netherlands
Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbinden
Affects: Public body. Sectors: Public administration.
Source: Rijksoverheid (open.overheid.nl): Rijksbrede Quantumstrategie (PDF) (read 2026-10-25) · Section 4.1.1 Voorbereiden van de Rijksoverheid op de quantumdreiging, box 'PQC-migratie tijdpad voor de Nederlandse Rijksoverheid' (page 36)
2030
Aim for post-quantum security for mechanisms used beyond this date or exposed to retroactive attack (RecoSécuLongTerme): ANSSI-PG-083 v3.00 · Standards tracker
Post-quantum cryptography migration · Target date · France
Règles et recommandations concernant le choix et le dimensionnement des mécanismes cryptographiques
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ANSSI: ANSSI-PG-083 Règles et recommandations concernant le choix et le dimensionnement des mécanismes cryptographiques (read 2026-10-25) · Cover (ANSSI-PG-083 2026-03-20); chapter 2 'Règles et recommandations', RecoSécuLongTerme; section 2.2.1.1 Factorisation, RègleFactorisation items 1-2
Protect the most sensitive use cases · PQC guide
Post-quantum cryptography migration · Target date · European Union
Securing Tomorrow, Today: Transitioning to Post-Quantum Cryptography (27.11.2024, reissued 27.06.2025)
Affects: All organisation types. Sectors: All sectors.
Source: BSI: Securing Tomorrow, Today: Transitioning to Post-Quantum Cryptography (joint statement, 27.11.2024) (read 2026-10-21) · Page 1, addressees of the call to transition; page 2, paragraph on protecting the most sensitive use cases by the end of 2030
2048-bit minimum modulus acceptable only for use up to end of 2030; 3072 bits from 2031 (RSA factorisation and finite-field discrete-log moduli (RègleFactorisation)): ANSSI-PG-083 v3.00 · Standards tracker
Post-quantum cryptography migration · Deadline · France
Règles et recommandations concernant le choix et le dimensionnement des mécanismes cryptographiques
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ANSSI: ANSSI-PG-083 Règles et recommandations concernant le choix et le dimensionnement des mécanismes cryptographiques (read 2026-10-25) · Cover (ANSSI-PG-083 2026-03-20); chapter 2 'Règles et recommandations', RecoSécuLongTerme; section 2.2.1.1 Factorisation, RègleFactorisation items 1-2
Phase 3: standalone post-quantum cryptography becomes optional: ANSSI PQC position paper (2022) and follow-up (2023) · Standards tracker
Post-quantum cryptography migration · Target date · France
ANSSI views on the Post-Quantum Cryptography transition / Avis de l'ANSSI sur la migration vers la cryptographie post-quantique (suivi 2023)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ANSSI (MesServicesCyber): ANSSI views on the Post-Quantum Cryptography transition (EN) (read 2026-10-25) · Transition plan phases 1-3 and security visa phases
ANSSI position: hybrid PQC for products protecting confidentiality beyond 2030 or used after 2030: ANSSI PQC position paper (2022) and follow-up (2023) · Standards tracker
Post-quantum cryptography migration · Target date · France
ANSSI views on the Post-Quantum Cryptography transition / Avis de l'ANSSI sur la migration vers la cryptographie post-quantique (suivi 2023)
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: ANSSI (MesServicesCyber): Avis de l'ANSSI sur la migration vers la cryptographie post-quantique (suivi 2023) (read 2026-10-25) · Opening summary and section on the three-phase visa roadmap
High-risk use cases quantum-safe (High risk): Leitlinie zur Umstellung auf PQC (BMI/BMDS/BSI, Artikelnummer BMI26024) · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: BSI: Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (PDF) (read 2026-10-25) · Header (11. September 2026); section 3 Zeitplan; section 4 intro; 4.1 Fristen verbindlich machen; inventory subsection; Impressum (Stand August 2026)
Switch to quantum-safe key agreement for very high protection needs (Applications with very high protection needs): BSI TR-02102-1 Version 2026-01 · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
Kryptographische Verfahren: Empfehlungen und Schlüssellängen
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: BSI: TR-02102-1 Kryptographische Verfahren: Empfehlungen und Schlüssellängen (PDF) (read 2026-10-25) · Cover and version table (2026-01, 23.01.2026); section 2.1 Einsatz quantensicherer Verfahren; section 2.3 Klassische asymmetrische Verfahren
Quantum-resistant IT security products available for VS-NfD protection (Classified information (VS-NfD) products): BSI VS-IT PQC transition deadlines · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
VS-IT: Umstellungsfristen für Post-Quanten-Kryptografie vereinbart
Affects: Manufacturer of products with digital elements, Public body. Sectors: Public administration, Defence and security.
Source: BSI: Presse - VS-IT: Umstellungsfristen für Post-Quanten-Kryptografie vereinbart (read 2026-10-25) · News item dated 31.10.2025, body text
Proposed (draft, not final): quantum-vulnerable algorithms at 112-bit strength deprecated (112-bit security strength (RSA, ECDSA, finite-field and EC DH/MQV)): NIST IR 8547 ipd · Standards tracker
Post-quantum cryptography migration · Target date · United States
Transition to Post-Quantum Cryptography Standards
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NIST: NIST IR 8547 ipd (PDF) (read 2026-10-25) · Section 4.1.1 Table 2 (signatures) and Section 4.1.2 Table 4 (key establishment)
PQC migration of high-risk use cases completed; software and firmware quantum-safe by default (High risk): Rijksbrede Quantumstrategie (2026), PQC-migratie tijdpad · Standards tracker
Post-quantum cryptography migration · Deadline · Netherlands
Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbinden
Affects: Public body. Sectors: Public administration.
Source: Rijksoverheid (open.overheid.nl): Rijksbrede Quantumstrategie (PDF) (read 2026-10-25) · Section 4.1.1 Voorbereiden van de Rijksoverheid op de quantumdreiging, box 'PQC-migratie tijdpad voor de Nederlandse Rijksoverheid' (page 36)
EU roadmap milestone 2: high-risk use cases migrated: EU PQC Coordinated Implementation Roadmap (Part 1) · Standards tracker
Post-quantum cryptography migration · Target date · European Union
A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body. Sectors: All sectors.
Source: NIS Cooperation Group: A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, Part 1, version 1.1 (read 2026-10-21) · Section 4.1, timeline for the transition to PQC, point 2 (by 31.12.2030); section 4.2, box Milestone 2
2031
End of the period in which the guideline lists classical key agreement on its own; hybrid with a PQC KEM afterwards (Key agreement / encryption): BSI TR-02102-1 Version 2026-01 · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
Kryptographische Verfahren: Empfehlungen und Schlüssellängen
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: BSI: TR-02102-1 Kryptographische Verfahren: Empfehlungen und Schlüssellängen (PDF) (read 2026-10-25) · Cover and version table (2026-01, 23.01.2026); section 2.1 Einsatz quantensicherer Verfahren; section 2.3 Klassische asymmetrische Verfahren
PQC migration of high-priority systems complete (High priority systems): TBS Security Policy Implementation Notice (SPIN) on PQC migration · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice
Affects: Public body. Sectors: Public administration.
Source: Government of Canada (TBS): Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice (read 2026-10-25) · Section 1 effective date; sections 6.1-6.3 requirements
Completion of PQC migration of high priority systems (High priority systems): ITSM.40.001 · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)
Affects: Public body. Sectors: Public administration.
Source: Canadian Centre for Cyber Security: Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001) (read 2026-10-25) · Overview; Section 4 milestones; Effective date and Revision history; Footnote 1
Complete highest-priority migration activities and refine plan: NCSC guidance: PQC migration timelines · Standards tracker
Post-quantum cryptography migration · Target date · United Kingdom
Timelines for migration to post-quantum cryptography
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NCSC: Timelines for migration to post-quantum cryptography (read 2026-10-25) · Page header (published/reviewed dates) and migration timeline milestones section
2035
Medium-risk use cases quantum-safe; transition largely complete for nearly all systems (Medium risk): Leitlinie zur Umstellung auf PQC (BMI/BMDS/BSI, Artikelnummer BMI26024) · Standards tracker
Post-quantum cryptography migration · Deadline · Germany
Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie
Affects: Operator of essential services (NIS2 essential or important entity), Public body. Sectors: All sectors.
Source: BSI: Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (PDF) (read 2026-10-25) · Header (11. September 2026); section 3 Zeitplan; section 4 intro; 4.1 Fristen verbindlich machen; inventory subsection; Impressum (Stand August 2026)
Classical signature schemes expected to remain in the guideline only until the end of 2035 (Signatures): BSI TR-02102-1 Version 2026-01 · Standards tracker
Post-quantum cryptography migration · Target date · Germany
Kryptographische Verfahren: Empfehlungen und Schlüssellängen
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: BSI: TR-02102-1 Kryptographische Verfahren: Empfehlungen und Schlüssellängen (PDF) (read 2026-10-25) · Cover and version table (2026-01, 23.01.2026); section 2.1 Einsatz quantensicherer Verfahren; section 2.3 Klassische asymmetrische Verfahren
PQC migration of remaining systems complete (Remaining systems): TBS Security Policy Implementation Notice (SPIN) on PQC migration · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice
Affects: Public body. Sectors: Public administration.
Source: Government of Canada (TBS): Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice (read 2026-10-25) · Section 1 effective date; sections 6.1-6.3 requirements
Completion of PQC migration of remaining systems (Remaining systems): ITSM.40.001 · Standards tracker
Post-quantum cryptography migration · Deadline · Canada
Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)
Affects: Public body. Sectors: Public administration.
Source: Canadian Centre for Cyber Security: Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001) (read 2026-10-25) · Overview; Section 4 milestones; Effective date and Revision history; Footnote 1
Complete migration of all systems, services and products to PQC: NCSC guidance: PQC migration timelines · Standards tracker
Post-quantum cryptography migration · Target date · United Kingdom
Timelines for migration to post-quantum cryptography
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NCSC: Timelines for migration to post-quantum cryptography (read 2026-10-25) · Page header (published/reviewed dates) and migration timeline milestones section
Proposed (draft, not final): quantum-vulnerable signature and key-establishment algorithms disallowed (All security strengths (RSA, ECDSA, EdDSA, DH, MQV)): NIST IR 8547 ipd · Standards tracker
Post-quantum cryptography migration · Target date · United States
Transition to Post-Quantum Cryptography Standards
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body, Financial entity (DORA). Sectors: All sectors.
Source: NIST: NIST IR 8547 ipd (PDF) (read 2026-10-25) · Section 4.1.1 Table 2 (signatures) and Section 4.1.2 Table 4 (key establishment)
PQC migration of medium-risk use cases completed (Medium risk): Rijksbrede Quantumstrategie (2026), PQC-migratie tijdpad · Standards tracker
Post-quantum cryptography migration · Deadline · Netherlands
Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbinden
Affects: Public body. Sectors: Public administration.
Source: Rijksoverheid (open.overheid.nl): Rijksbrede Quantumstrategie (PDF) (read 2026-10-25) · Section 4.1.1 Voorbereiden van de Rijksoverheid op de quantumdreiging, box 'PQC-migratie tijdpad voor de Nederlandse Rijksoverheid' (page 36)
PQC migration of low-risk use cases completed as far as possible (Low risk): Rijksbrede Quantumstrategie (2026), PQC-migratie tijdpad · Standards tracker
Post-quantum cryptography migration · Target date · Netherlands
Rijksbrede Quantumstrategie: Kansen benutten, belangen beschermen, integraal verbinden
Affects: Public body. Sectors: Public administration.
Source: Rijksoverheid (open.overheid.nl): Rijksbrede Quantumstrategie (PDF) (read 2026-10-25) · Section 4.1.1 Voorbereiden van de Rijksoverheid op de quantumdreiging, box 'PQC-migratie tijdpad voor de Nederlandse Rijksoverheid' (page 36)
EU roadmap milestone 3: medium-risk use cases migrated: EU PQC Coordinated Implementation Roadmap (Part 1) · Standards tracker
Post-quantum cryptography migration · Target date · European Union
A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
Affects: Operator of essential services (NIS2 essential or important entity), Manufacturer of products with digital elements, Public body. Sectors: All sectors.
Source: NIS Cooperation Group: A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, Part 1, version 1.1 (read 2026-10-21) · Section 4.1, timeline for the transition to PQC, point 3 (by 31.12.2035); section 4.2, point 3
How the dates were checked
The Cyber Resilience Act, NIS2 and dual-use list dates that this calendar adds were each read on the official text before they were added; compiled 2026-10-28. Every other date is read from the portal’s trackers, each with its own sources and review, and policy changes are shown only after an editor marked them as relevant.
- : Cyber Resilience Act enters into force; Cyber Resilience Act: rules on notifying conformity assessment bodies apply; Cyber Resilience Act: reporting of actively exploited vulnerabilities and severe incidents applies. Read on https://publications.europa.eu/resource/celex/32024R2847. Article 71(1) and (2), Article 14, Article 64(10) and the Official Journal date 20.11.2024 read on the Official Journal text; dates match. The same text confirms 11 December 2027, the general date of application taken from the PQC guide.
- : NIS2: Member States adopt and publish their transposition measures; NIS2: Member States establish the list of essential and important entities; NIS2: Commission review of the functioning of the Directive. Read on https://publications.europa.eu/resource/celex/32022L2555. Article 41(1), Article 3(3) and Article 40 read on the Official Journal text; dates match. The same text confirms 18 October 2024, the date of application taken from the PQC guide.
- : Dual-use items: the 2025 update of the EU control list enters into force. Read on https://publications.europa.eu/resource/celex/32025R2003. Official Journal header (14.11.2025) and Article 2 (entry into force on the day following publication) read; 15 November 2025 matches the date in force of the EU legal acts registry.