NATO’s First Quantum Roadmap: Sea Trials, a PQC Pilot and No Public Date for Its Own PQC Migration

September 29, 2026 – NATO published a public summary of its first Quantum Technology Roadmap, a plan to carry out the Alliance’s 2023 quantum strategy through dated activities in quantum computing, quantum communication and quantum sensing. Allies approved the roadmap on July 30, NATO said in its announcement.

NATO said the roadmap is meant to make the Alliance “quantum-ready” by accelerating the understanding, adoption and integration of quantum technologies across NATO and Allied armed forces. NATO said its work will also examine how quantum technologies interact with artificial intelligence, space and next-generation communication networks.

The public deadlines run from 2026 to the third quarter of 2029. NATO said it had selected certain activities for public release.

The roadmap implements NATO’s first quantum strategy, which NATO foreign ministers approved on November 28, 2023. In a summary of the strategy published in January 2024, NATO listed as one desired outcome that “NATO has transitioned its cryptographic systems to quantum-safe cryptography.” NATO attached no date to that outcome.

Deadlines in the roadmap’s five lines of effort

NATO organized the roadmap into five lines of effort. These are the activities with timelines in the public summary:

• Identifying use cases. Annual horizon-scanning reports on the maturity and potential impact of quantum technologies, an initial repository of military and industry use cases within 12 months, and a first version of NATO’s Quantum Assessment Criteria by the second quarter of 2027.
• Testing, developing and adopting quantum-enabled solutions. Regular prototyping through the NATO Digital Foundry, the Defence Innovation Accelerator for the North Atlantic (DIANA) and possibly NATO Innovation Ranges. A first pilot evaluation report is due in the first quarter of 2027 and initial comparative assessments in the fourth quarter. QUESTOR sea trials in 2026 and 2027, run with NATO’s Centre for Maritime Research and Experimentation (CMRE), test quantum sensors for positioning, navigation and timing where satellite signals are unavailable. A concept for an “Allied Quantum Computing Access Network” is due in the fourth quarter of 2027.
• Standardization and interoperability. A Quantum Standardisation Specialist Team at the NATO Science and Technology Organization (STO) by the third quarter of 2027, an STO-led Alliance quantum standards roadmap by the third quarter of 2029, and the Quantum Zero Beacon Project (QZBP), a pilot between Supreme Headquarters Allied Powers Europe (SHAPE) in Mons and NATO Headquarters in Brussels, by the fourth quarter of 2027. NATO marked the adoption and implementation of post-quantum cryptography (PQC) standards as ongoing, with no date.
• Safeguarding NATO against quantum risks and threats. The next update of the Action Plan for NATO’s Response to the Quantum Threat to Cryptography in the third quarter of 2027, and a NATO Industrial Advisory Group study, “Assessing Industry Readiness for Quantum-Resistant Cryptographic Solutions,” in the second quarter of 2027.
• Quantum training and education. Initial training modules within 12 months.

NATO said the roadmap follows a phased approach that runs from identification and experimentation to capability development and operational adoption. Later versions will focus more on the later phases, depending on technological progress and the outcomes of this first iteration, NATO said.

Who implements the roadmap

NATO’s Digital Policy Committee is responsible for implementing the roadmap. The Cyber and Digital Transformation Division at NATO Headquarters is responsible for quantum strategy and policy and oversees the roadmap, according to the summary.

NATO named seven contributors and implementers. They are the Transatlantic Quantum Community (TQC), Allied Command Transformation (ACT), the NATO Communications and Information Agency (NCIA), Allied Command Operations, the STO, the Cryptographic Services Capability Team, and NATO’s innovation initiatives and entities, which include the NATO Innovation Ranges, DIANA and the NATO Innovation Fund.

ACT will pilot and validate use cases with industry, and Allied Command Operations will shape the operational requirements for adopting quantum technologies, NATO said. NCIA will assess options for a secure environment for quantum experimentation through the NATO Digital Foundry, which NCIA launched in The Hague in December 2025.

The STO runs research, experimentation and testing, and NATO said its activities are driven mainly by the priorities and funding of member nations. The Cryptographic Services Capability Team will implement the cryptographic elements of the roadmap.

Belgium and Bulgaria join the Transatlantic Quantum Community

The TQC, an informal and non-binding community of quantum experts from governments, industry, academia, funding bodies and research institutions, met in Washington, D.C., on September 24–25. NATO said Belgium and Bulgaria had joined 22 other Allies and six partner nations in the community.

Participants in Washington discussed how advances in quantum computing could affect secure communications, critical infrastructure, intelligence, strategic stability and crisis decision-making, according to NATO. They also discussed the convergence of AI and quantum technologies, and quantum sensing for positioning and navigation after Questor 26, an experimentation campaign that CMRE and the TQC Industry Network ran in La Spezia, Italy, in early September.

The TQC held its inaugural meeting on July 2, 2024, with Denmark as the first chair. The United Kingdom succeeded Denmark in May 2025, and the Netherlands took over the chair on May 12, 2026, with Canada as vice-chair.

NATO said in May that the TQC Industry Network had grown to more than 240 stakeholders across 17 Allied nations and three partner countries. In the roadmap, NATO marked six activities for possible involvement by the TQC or its Industry Network.

HQ SACT’s procurement notice for the Quantum Zero Beacon Project

On September 4, Headquarters Supreme Allied Commander Transformation (HQ SACT), ACT’s headquarters in Norfolk, Virginia, published a notification of procurement opportunity for contractor support to QZBP. HQ SACT wrote that the pilot, between two NATO enclaves at NATO Headquarters and SHAPE, is meant to demonstrate a practical route for moving NATO to quantum-resilient communications.

HQ SACT said it wants a contractor that can deliver, within one year, a limited-scale deployment of quantum-safe cryptography inside NATO operational networks, using mature PQC solutions. According to the notice, the project will provide operational evidence, technical lessons and a transition roadmap “to support broader NATO adoption of quantum-safe cryptography before 2030.”

The contractor’s scope also covers security accreditation, migration roadmaps and policy recommendations, and assessments of quantum threat vulnerability, interoperability and migration, HQ SACT said. It estimated the value of the fixed-price contract at €8 million for a 12-month base period, with work at NATO Headquarters, SHAPE, NCIA in The Hague and possibly the contractor’s own facility.

Bidders must come from NATO member nations and hold at least a NATO SECRET facility security clearance by the start of the contract, a requirement HQ SACT applied to consortium partners and subcontractors as well as prime contractors. Declarations of Eligibility from vendors’ national authorities were due on September 25.

HQ SACT planned to release the solicitation on September 28, with the link sent by email to registered vendors, and to award the contract on November 30, after bids close on November 2. As of October 2, ACT’s contracting page still showed only the pre-solicitation notice.

My Analysis

Two of the activities in NATO’s quantum roadmap are dated field or network work: the QUESTOR sea trials of quantum sensors, and a pilot deployment of post-quantum cryptography between NATO’s political headquarters in Brussels and its military headquarters in Mons.

NATO now has a dated quantum plan, but most of its dates through 2027 are for reports, criteria and concepts, and the public roadmap sets no date for moving NATO’s own networks to PQC. The only year I have found attached to that migration appears in a separate HQ SACT procurement notice, which ties the Brussels–Mons pilot to broader adoption of quantum-safe cryptography before 2030. The US Department of War, the defense ministry of NATO’s largest member, has required all of its systems to support PQC or be phased out by the end of 2030, and to use PQC by the end of 2031 unless otherwise noted.

I don’t hold the roadmap’s caution against NATO. Allies approved a first iteration, and NATO wrote into it that later versions will focus more on capability development and operational adoption. Of the activities NATO chose to publish, though, two are field or network work. Most of the others produce reports, criteria, plans or training modules, and the line for NATO’s own cryptographic migration has no date.

Most dated deliverables through 2027 are studies and plans

NATO’s public summary lists 15 activities across the five lines of effort. Two are the field and network work described above. Most of the others have deadlines for reports, assessment criteria, a use-case repository, a concept, an industry study or training, and one creates a specialist team. Three have no deadline. Prototyping happens regularly, while engagement with industry and academia and the adoption of PQC standards are both ongoing.

The stated aim is to accelerate the understanding, adoption and integration of quantum technologies across NATO and Allied armed forces. NATO dated adoption work only for the QUESTOR trials and the Brussels–Mons pilot, and most of the other work it dated through 2027 is about understanding.

Allies approved the roadmap on July 30 and NATO published the summary on September 29. In between, on September 4, HQ SACT published the QZBP procurement notice and wrote into it the only PQC target year I have found in NATO’s public documents.

NATO has also run PQC experiments that are not on the published list. At the Istanbul event that closed ACT’s 2025 Innovation Continuum in October 2025, NATO ran an experiment that used PQC to secure identification-friend-or-foe communication for tactical drones. NATO said it had selected only certain roadmap activities for public release. Suppliers working from the summary therefore lack a complete picture of the migration schedule, and NATO wants those suppliers in the TQC Industry Network and in its pilots.

The Quantum Zero Beacon pilot and its before-2030 goal

QZBP is the only dated activity in the roadmap that changes cryptography on NATO’s own networks. The link between NATO’s political headquarters and SHAPE is a credible place to test protection for information that has to stay confidential for a long time. If that link relies anywhere on public-key key establishment that a quantum computer could break, an adversary could record its traffic today and decrypt it later, the harvest-now, decrypt-later problem. HQ SACT’s notice doesn’t describe the link’s current cryptography, and the NCIA researchers who presented NATO’s PQC planning in 2023 noted that a number of NATO systems are based on symmetric cryptography.

HQ SACT asked for a limited-scale deployment inside NATO’s operational networks within a year, using PQC that is already mature, as part of NATO’s move toward quantum-safe and crypto-agile capabilities. HQ SACT also wrote that QZBP should inform future NATO-wide capability development and implementation, and the contractor’s scope includes migration roadmaps and policy recommendations as well as engineering.

The before-2030 goal appears in HQ SACT’s notice and nowhere in the roadmap. A procurement notice states what one contract is for, and it doesn’t commit Allies to a migration date. HQ SACT also didn’t define the goal’s scope. The notice names no systems, classification levels or completion criterion for the broader adoption it wants before 2030, and it’s still the only public statement I’ve found that ties NATO’s wider use of quantum-safe cryptography to a year.

If HQ SACT awards the contract on November 30 as planned, the 12-month pilot ends at about the end of November 2027, in line with the fourth-quarter date in the roadmap. That is about two years before the end of 2029. NATO hasn’t published how much wider migration will run in parallel with the pilot, or which deployment decisions will wait for its results. If most of those decisions wait, two years is tight. Security accreditation, which HQ SACT put in the contractor’s scope, is the schedule risk I’d watch.

NATO scheduled the update of its cryptography action plan for the third quarter of 2027. QZBP is due to finish in the fourth quarter of 2027. Unless NATO moves one of the two dates, that update can draw only on the pilot’s interim findings, and NATO hasn’t said how the final results will feed into later deployment decisions.

The United States ordered a similar pilot on the same timetable. Executive Order 14412, which President Trump signed on June 22, directs the Secretary of Commerce, through NIST, to run a PQC migration pilot on a subset of NIST’s own systems and finish it by December 31, 2027. The United States also set fixed dates for its most sensitive systems. NATO’s public entry for its own migration has none.

HQ SACT’s clearance requirement narrows the field of bidders. HQ SACT requires primes, consortium partners and subcontractors alike to hold a NATO SECRET facility clearance by the start of the contract. A PQC specialist without one can’t join the contract team, even as a subcontractor, however good its technology.

No Alliance-wide PQC deadline while the US sets 2030 and 2031

NATO named a transitioned cryptographic estate as a desired outcome in its strategy summary in January 2024, without a date. In January 2026, NATO wrote into its Alliance Digital Strategy that NATO “shall accelerate the adoption of post-quantum cryptography,” again without a date. In the roadmap, NATO marked PQC standards adoption as ongoing, the same word it used for engaging industry and academia.

PQC planning at NATO predates the strategy. At an ETSI quantum-safe cryptography event in February 2023, NCIA’s Joanna Sliwa, Konrad Wrona and colleagues presented the NATO Response to the Quantum Threat to Cryptography as the document that defines NATO’s action plan for protecting information against the quantum threat. NATO has scheduled that plan’s next update for the third quarter of 2027. So NATO has had a PQC action plan since at least February 2023, and none of the public documents I have found gives a date for completing the migration.

Allies have published dates of their own. Executive Order 14412 directs the Office of Management and Budget to require federal agencies to move their high-value assets and high-impact systems, excluding national security systems, to PQC for key establishment by December 31, 2030. The deadline for digital signatures is December 31, 2031. The order also directs the FAR Council to propose a rule requiring covered contractors to comply by December 31, 2030, with NIST’s Federal Information Processing Standards, including those for PQC. I covered the order and its implementing memo in my guide to the US federal PQC mandate.

Under the Department of War’s PQC strategy, released on June 23, the day after President Trump signed the order, all DoW systems must support PQC or be phased out by December 31, 2030. They must use PQC by December 31, 2031, unless otherwise noted. National security systems must support NSA’s CNSA 2.0 algorithms. I went through the strategy when it came out.

In Europe, EU member states issued a coordinated implementation roadmap in June 2025, as I reported at the time. In it, they recommend that by the end of 2026 each member state has completed a set of first steps and set up an initial national transition roadmap, with planning and pilots under way for high- and medium-risk use cases. By the end of 2030, they recommend completing the transition of high-risk use cases. Twenty-three of NATO’s 32 Allies are EU members. The UK’s National Cyber Security Centre set targets of 2028 for discovery and planning, 2031 for priority migrations and 2035 for completion, which I covered when the NCSC published them. I track the other national deadlines in the Global PQC Migration Clock.

The Department of War set its 2030 and 2031 dates for all its systems, including those that connect to NATO. In its strategy, the department counts a mission thread as quantum resistant only when no vulnerable algorithm or protocol protects its critical data anywhere along the data pathway. It also requires networking equipment at both ends to support the same PQC algorithms and protocols. The department lists participation in NATO’s standards body among its steps to ensure interoperability. Under its own definition, the department would not count a US mission thread that crosses a NATO network without PQC as quantum resistant. A hybrid key exchange adds post-quantum protection only when both endpoints run the post-quantum component. If Allies adopted the before-2030 goal from HQ SACT’s notice, wider NATO adoption would come ahead of the US and EU end-2030 milestones, although the scopes differ.

In the public summary, NATO doesn’t specify the algorithm and protocol profiles, the hybrid policy or the assurance requirements that would make its migration interoperable. Allied agencies don’t agree on hybrid deployment, a split I examined in May. EU member states, for their part, recommend standardized and tested hybrid solutions wherever feasible and suitable. Executive Order 14412 also directs the Secretary of State, working with NIST, the Secretary of War and others, to encourage foreign governments to move to PQC algorithms standardized by NIST. Suppliers preparing deployment-ready products for NATO networks need those details, and NATO hasn’t said publicly how the STO standardization team due in the third quarter of 2027 will connect to the bodies that set NATO’s cryptographic requirements.

The NIAG study due in the second quarter of 2027 should give NATO a view of how ready industry is for quantum-resistant cryptography. My advice to companies selling into NATO is to plan now to the national dates that already apply to their products and customers, and to expect any NATO requirement to differ from them in scope, algorithm profile, assurance or timing. These preparations are useful whatever NATO decides:

• Document crypto-agility and the PQC profiles each product supports.
• Prepare interoperability and assurance evidence that an evaluator can check.
• Set up the national-authority route, including facility clearances, that NATO procurements such as QZBP require.

As I argued in Forget Q-Day Predictions, boards fund obligations that come with dates, and Allied governments have now set them. The PQC migration those dates require takes years whichever date NATO picks.

QUESTOR sea trials for quantum navigation

CMRE, the STO’s maritime research center in La Spezia, set up a quantum technology program of work in 2019 and began quantum navigation research in 2022 using quantum magnetometers. In 2024 it took part in the MAG24 sea trial and led the QUESTOR24 mission aboard the coastal research vessel Leonardo. Its first quantum navigation trials, with the Dutch research organization TNO and the University of Pisa, collected magnetic-map data with quantum sensors.

CMRE researchers and their co-authors described the method in a November 2024 paper for SPIE. Their system pairs optically pumped quantum magnetometers with fluxgate sensors. By matching the readings against a magnetic map surveyed in advance, the system corrects the drift that builds up in an inertial navigation system when satellite signals are jammed or spoofed.

Pietro Paglierani, a senior scientist at CMRE, assessed the field in 2025. He described quantum positioning, navigation and timing as possibly the quantum technology closest to practical deployment, and wrote that quantum sensors are expected within five to ten years to let submarines, autonomous vehicles and crewed platforms navigate accurately without external signals.

Questor 26 ran in La Spezia in early September with the TQC Industry Network, and I found no public results report from it. A published evaluation of the QUESTOR trials would show how the sensors performed outside the laboratory. NATO hasn’t said whether the first pilot evaluation report, due in the first quarter of 2027, will cover those trials or be released publicly.

Of the quantum technologies in the roadmap, quantum sensing is the one NATO is already testing under operational conditions, and I think NATO has the order right. I expect deployable quantum navigation to reach Allied forces before quantum computing gives them a broad operational advantage. The method CMRE described also depends on suitable magnetic reference maps of the waters where it will be used, so map coverage and quality are deployment questions alongside the sensors.

An access concept and a classical-baseline study for quantum computing

NATO gave the Allied Quantum Computing Access Network a name and a fourth-quarter 2027 date for its concept, and nothing else in public. NATO hasn’t said whose machines the network would use, who would host them, or whether classified work is in scope.

In a separate quantum tender this year, HQ SACT set terms I would like to see in every quantum procurement. In its FAASQ request for proposals, for a study of where quantum computing could help NATO modeling and simulation, HQ SACT required bidders to compare each quantum approach against strong classical baselines. On its 15-point criterion for classical baselines and comparative assessment, out of 100 points in total, HQ SACT reserved the top band for frameworks that resist unsupported claims of quantum advantage. The final report, due December 31, must sort problem areas into those where quantum computing looks promising, premature or unsuitable, and those that need more evidence.

Bidding closed on September 23, and the contract ends on December 31, 2026. HQ SACT excluded PQC, QKD and quantum sensing from the study. Vendors pitching quantum advantage to NATO can still read in its scoring rules what evidence HQ SACT asked for in this study.

TQC participants in Washington also discussed how quantum computing could affect intelligence, strategic stability and crisis decision-making. A cryptographically relevant quantum computer in an adversary’s hands could do serious damage in all three areas, and protecting them depends on a PQC migration for which NATO has published no date.

Funding and participation depend on individual Allies

The public summary contains no budget. HQ SACT’s €8 million estimate for QZBP is the only public figure I have found attached to a roadmap activity, and it covers one pilot contract. NATO wrote that the STO’s work depends mainly on the priorities and funding of member nations.

Participation in the TQC is voluntary. The community is informal and non-binding, and with Belgium and Bulgaria it includes 24 of NATO’s 32 Allies. NATO didn’t list the other eight Allies in its September announcement. An Ally outside the TQC can still take part in STO work, NATO procurement and its own cryptographic migration.

NATO’s innovation bodies have also backed quantum companies. Six of the 44 companies in DIANA’s first cohort specialized in quantum, and the NATO Innovation Fund made its first quantum investment in September 2024, leading a €5 million seed round for the UK quantum sensing company Aquark Technologies.

Delivery depends on national contributions to the STO and the TQC, and on NATO bodies turning experiments such as QUESTOR and QZBP into funded, approved capabilities.

NATO quantum dates to watch through 2029

• November 30, 2026. Planned award of the QZBP contract.
• December 31, 2026. Final report of HQ SACT’s study of quantum computing for modeling and simulation.
• First quarter of 2027. First pilot evaluation report.
• Second quarter of 2027. NATO Quantum Assessment Criteria and the NIAG study on industry readiness for quantum-resistant cryptography.
• Third quarter of 2027. Update of the Action Plan for NATO’s Response to the Quantum Threat to Cryptography, and the STO Quantum Standardisation Specialist Team.
• Fourth quarter of 2027. QZBP pilot, the Allied Quantum Computing Access Network concept and initial comparative assessments.
• Third quarter of 2029. STO-led Alliance quantum standards roadmap.
• Before 2030. Broader NATO adoption of quantum-safe cryptography, a goal HQ SACT stated in its notice without defining its scope.

NATO also promised an initial use-case repository and training modules within 12 months without saying when the 12 months started, and the QUESTOR trials continue in 2027.

The action plan update in the third quarter of 2027 is the next scheduled point in the public roadmap at which NATO could clarify its migration milestones, although NATO can act earlier through other documents. Before then, I’ll be watching who wins the QZBP contract in November and what NATO’s industrial advisers report on supplier readiness in the NIAG study. For QZBP itself, I’ll judge success by whether its specifications, test evidence and accreditation material shorten the deployments that follow it.