Dated milestones and deadlines of the transition to post-quantum cryptography that apply in Europe: the EU recommendation and roadmap, standards, and guidance from EU and national agencies, each stating only what its source says. Targets that still lie ahead are marked as upcoming.
This page: the milestones of each EU and national authority, as its source states them. The other post-quantum pages: Guide: what post-quantum cryptography is and what to do first; What is due when: everything due in the next 12 to 60 months, in date order, with a calendar feed; Compliance calendar: dated obligations and milestones beyond post-quantum; Standards deadline tracker: every standard, committee and deadline with its status and next milestone.
Milestones of the post-quantum cryptography transition that apply in Europe, compiled from the official pages and documents of the European Commission, EUR-Lex, the NIS Cooperation Group, ENISA, national agencies, NIST, ETSI and the IETF on the date shown; each locator says where the fact was read. Dates and targets are as the sources state them; summaries are the portal's own wording and quote no text. A target is listed only when a published document sets it. Not compliance advice: check the publisher for the authoritative current version. Pending editorial review. Compiled 2026-10-27.
23 milestones, 4 upcoming
2020
ETSI report on migration strategies to quantum-safe schemes
Institution
ETSI (Technical Committee CYBER)
Type
Guidance or report
Status
Published
Summary
ETSI published TR 103 619 V1.1.1, a technical report on strategies and recommendations for migrating to quantum-safe cryptographic schemes.
ENISA study on integrating post-quantum cryptography
Institution
European Union Agency for Cybersecurity (ENISA)
Type
Guidance or report
Status
Published
Summary
ENISA published a study of the challenges of integrating post-quantum cryptography into existing protocols and systems, following its 2021 report on the state of post-quantum cryptography.
Commission Recommendation on a coordinated PQC roadmap
Institution
European Commission
Type
EU recommendation
Status
Adopted
Summary
Commission Recommendation (EU) 2024/1101 invited Member States to form a post-quantum cryptography sub-group of the NIS Cooperation Group and to have a coordinated implementation roadmap two years after its publication, followed by national transition plans.
National Institute of Standards and Technology (NIST)
Type
Standard or specification
Status
Published
Summary
NIST published its first three post-quantum cryptography standards, FIPS 203 for key encapsulation (ML-KEM) and FIPS 204 and FIPS 205 for digital signatures (ML-DSA and SLH-DSA).
On this portal
FIPS 203 (Standards and guidance); FIPS 204 (Standards and guidance); FIPS 205 (Standards and guidance); nist-fips-203 (Standards and PQC deadline tracker); nist-fips-204 (Standards and PQC deadline tracker); nist-fips-205 (Standards and PQC deadline tracker)
Joint statement of national agencies: protect the most sensitive use cases by 2030
Institution
Cybersecurity agencies of 18 EU Member States, including BSI, ANSSI and the Netherlands National Communication Security Agency
Type
Guidance or report
Status
Published
Summary
Agencies of 18 Member States urged organisations to start the transition now and recommended protecting the most sensitive use cases against store-now-decrypt-later attacks by the end of 2030 at the latest; partners from 21 European states reissued it in June 2025.
National Institute of Standards and Technology (NIST)
Type
Standard or specification
Status
Published
Summary
NIST selected HQC, an algorithm based on error-correcting codes, as a second key-encapsulation mechanism to back up ML-KEM, expecting a draft standard in about a year and a final standard in 2027.
EU agreed cryptographic mechanisms add post-quantum schemes
Institution
European Cybersecurity Certification Group (ECCG), sub-group on cryptography
Type
Guidance or report
Status
Published
Summary
Version 2 of the agreed cryptographic mechanisms for EU cybersecurity certification lists post-quantum schemes such as ML-KEM, FrodoKEM, ML-DSA and SLH-DSA as agreed and recommends hybrid deployment where confidentiality must last.
Coordinated implementation roadmap for the transition to PQC
Institution
NIS Cooperation Group (EU Member States, supported by the European Commission)
Type
Roadmap or transition plan
Status
Published
Summary
The NIS Cooperation Group's work stream on post-quantum cryptography published the first part of the coordinated roadmap, with milestones at the end of 2026, 2030 and 2035 and a recommendation to use standardised hybrid solutions where feasible.
BSI sets end dates for classical key agreement used alone
Institution
Federal Office for Information Security (BSI), Germany
Type
Guidance or report
Status
Published
Summary
Version 2026-01 of BSI technical guideline TR-02102-1 recommends that classical key agreement no longer be used on its own after the end of 2031, or 2030 for very high protection needs, and combined with post-quantum schemes instead.
RFC 9935 and RFC 9936, both Proposed Standards, define how ML-KEM keys appear in X.509 certificates and how ML-KEM is used in the Cryptographic Message Syntax.
Version 3.00 of the ANSSI guide on the choice and sizing of cryptographic mechanisms asks for post-quantum security for mechanisms used beyond 1 January 2030 and limits 2048-bit RSA moduli to use until the end of 2030.
RFC Editor: RFC 9980 (retrieved 2026-10-27; Information page: title Post-Quantum Cryptography in OpenPGP, status Proposed Standard, publication date June 2026)
Draft version 3 of the EU agreed cryptographic mechanisms
Institution
European Cybersecurity Certification Group (ECCG), sub-group on cryptography
Type
Guidance or report
Status
Published
Summary
The ECCG sub-group on cryptography put a draft version 3 of the agreed cryptographic mechanisms for EU certification to public review until the end of July 2026, with a change log.
ENISA certification: EUCC guidelines on cryptography (retrieved 2026-10-27; Introductory text (public review until the end of July 2026) and section Draft for public review (version 3 draft and change log, 2 June 2026))
IETF standardises hybrid ML-KEM key agreement for TLS 1.3
Institution
Internet Engineering Task Force (IETF)
Type
Standard or specification
Status
Published
Summary
RFC 10024, a Standards Track RFC, defines three hybrid key agreement mechanisms for TLS 1.3 that combine ML-KEM with an elliptic-curve Diffie-Hellman exchange.
Germany's national implementation of the EU PQC roadmap
Institution
Federal Office for Information Security (BSI), with the German federal ministries BMDS and BMI
Type
Roadmap or transition plan
Status
Published
Summary
A joint guideline of BMDS, BMI and BSI sets a German timeline aligned with the EU roadmap: preparation and planning by the end of 2026, high-risk use cases quantum-safe by the end of 2030 and medium-risk use cases by the end of 2035.
The Dutch government-wide quantum strategy sets a PQC migration timetable for central government, with high-risk use cases migrated by the end of 2030 and medium-risk ones by the end of 2035.
EU roadmap milestone 1: first steps and national roadmaps
Institution
NIS Cooperation Group (EU Member States)
Type
Deadline or target date
Status
Target set by a published document
Summary
By the end of 2026 all Member States should have implemented at least the roadmap's first steps, established initial national transition roadmaps and started planning and pilots for high- and medium-risk use cases.
Member States should work with the Commission to assess the effects of Recommendation (EU) 2024/1101 at the latest three years after its publication, a review deadline that EUR-Lex records as 12 April 2027.
EU roadmap milestone 2: high-risk use cases migrated
Institution
NIS Cooperation Group (EU Member States)
Type
Deadline or target date
Status
Target set by a published document
Summary
By the end of 2030 the roadmap's next steps should be implemented, high-risk use cases moved to post-quantum cryptography, planning and pilots for medium-risk use cases completed and quantum-safe software and firmware upgrades enabled by default.