EU Commission Roadmap Targets 2030 for Post-Quantum Cryptography Transition

On June 23, 2025, the European Commission and EU Member States unveiled a coordinated roadmap to transition Europe’s digital infrastructure to post-quantum cryptography (PQC). This plan lays out a clear timeline for moving to quantum-resistant encryption, recognizing the urgent threat that future quantum computers pose to classical cryptography. PQC is seen as a key measure to deflect advanced cyber threats in the coming “quantum era.” The roadmap’s recommendations aim to synchronize efforts across all member states so that Europe’s data and communications remain secure against quantum-enabled attackers.

Key milestones in the EU’s PQC transition timeline include:

• By end of 2026: All EU Member States should start transitioning to PQC by initiating national strategies and “first steps” in the migration. This means beginning assessments, awareness campaigns, and cryptographic inventories no later than 2026.
• By end of 2030: High-risk systems – notably critical infrastructure and other vital sectors – must be secured with post-quantum cryptography “as soon as possible, no later than” 2030. In practice, this refers to utilities, telecom, finance, government and other critical applications that are most vulnerable to quantum threats.
• By 2035: The transition to PQC should be completed for as many systems as practically feasible across Europe. This ambitious 2035 goal acknowledges that some legacy or lower-risk systems may take longer, but they should be quantum-safe by then to the greatest extent possible.

The high-level roadmap was developed by the EU’s NIS Cooperation Group following the Commission’s recommendation in April 2024, reflecting a growing urgency as quantum computing advances. Importantly, the plan is not just aspirational – it comes with political backing to ensure all member states move in step.

Analysis: 2030 Isn’t Far Away

This European roadmap aligns with a view I have strongly advocated: we don’t have the luxury of waiting until 2035 to be quantum-safe. In fact, I recently published a detailed analysis arguing that around 2030 is the likely “Q-Day” – the year a cryptographically relevant quantum computer (CRQC) could break RSA-2048 encryption. The latest research developments have only sharpened this timeline, bringing the fall of classical encryption into the plausible timeframe of around 2030. In other words, the quantum threat isn’t some distant, hazy prospect; it’s rapidly becoming a clear and present danger for this decade.

With that in mind, I have been skeptical of the more relaxed timelines some regulators initially floated. For example, the U.S. government’s National Security Memorandum #10 set 2035 as the target for completing the transition to quantum-safe encryption in federal systems. To make matters worse, on June 6, 2025, President Donald Trump signed a new cybersecurity executive order that rolled back several forward-looking security mandates from the previous administration – notably those related to post-quantum encryption (Ridiculous!). Likewise, even the EU roadmap itself notes 2035 as the point by which “as many systems as feasible” should be transitioned. From my perspective, aiming to finish by 2035 felt too slow and risky – if a CRQC arrives by 2030, waiting until 2035 to wrap up remediation could leave a dangerous window. It’s encouraging, therefore, to see the European Commission now pulling the deadline forward for high-priority cases and urging that critical infrastructures be quantum-proof by 2030. This is a much more prudent stance that acknowledges the reality of the threat timeline.

What counts as “high-risk” systems? Primarily, we’re talking about critical national infrastructure – power grids, telecommunications, transportation, defense, and the financial sector (major banks and payment systems). These are the systems an adversary would love to target, and whose compromise would be most devastating to security and economy. The EU’s guidance explicitly calls out critical infrastructure as needing priority PQC upgrades by 2030, and a recent joint statement by 18 EU member states similarly urged that “the most sensitive use cases” migrate to PQC “as soon as possible, ideally by 2030 at the latest”. In practice, this means any organization in a high-impact sector should already be deep into planning (if not executing) their post-quantum migration.

From experience, I can attest that such a transition cannot happen overnight – or even over a single budget cycle. Just imagine: every application, device, and module in a critical system contains multiple layers of cryptography (protocols, certificates, key exchanges, signatures, firmware, TPM, etc.) Each one of those cryptographic instances must be identified, assessed, and eventually upgraded or mitigated in some way to be quantum-safe. The EU roadmap highlights the need for detailed cryptographic inventories and “crypto agility” precisely because this is a massive undertaking. In complex environments (say, a national banking system or a military communications network), the migration touches so many components that past cryptographic transitions I’ve been involved with have taken on the order of 10 years and are still going on. In short, transitioning to PQC is like changing the engines on an airplane mid-flight – extremely challenging and requiring careful coordination.

The bottom line is clear: if you haven’t started your PQC migration project yet, you’re already late. Five years might sound like a long time, but in the context of overhauling enterprise and national-level cryptography, it’s a blink of an eye. Implementing PQC will likely be five (or more) years of hard work, long hours, and inevitable complexities to retrofit or replace cryptographic schemes across all your systems. See my old article “Ready for Quantum: Practical Steps for Cybersecurity Teams” for some ideas on what such program might look like.