Germany Sets a 2030 Post-Quantum Target for High-Risk Systems in Government, Business and Critical Infrastructure

October 12, 2026 – Germany’s interior and digital ministries and its federal cybersecurity agency published a joint guideline for moving public administrations and companies to post-quantum cryptography (PQC). In the ten-page document, the Federal Ministry of the Interior (BMI), the Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) implement the EU’s June 2025 Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography and adopt its timelines without change.

The guideline is addressed to federal, state and municipal administrations and to organizations and companies, in particular operators of critical infrastructure, known in Germany as KRITIS. Organizations should move high-risk use cases to quantum-safe cryptography as soon as possible and no later than the end of 2030, and should largely complete the transition by 2035, the BSI said in its announcement.

For the organizations it addresses, the first date in the guideline is 31 December 2026. By then the three bodies expect each organization to have completed its initial preparation and planning phase and begun migrating. Responsibilities and binding implementation plans with deadlines should be set, and a first cryptographic inventory should be complete.

The BSI announced the guideline from Bonn. The BMI also lists it on its publications page. The PDF’s cover is dated 11 September 2026 and its imprint “August 2026”.

Germany’s Timeline and Risk Categories

Following the EU roadmap, the guideline recommends a risk-based migration. Organizations classify each use case, an application or a system, as high, medium or low quantum risk and migrate the high-risk ones to quantum-safe cryptography first, by the end of 2030. They should migrate medium-risk use cases by the end of 2035. In the guideline’s milestone chart, low-risk use cases have a softer aim for 2035: migration completed as far as possible.

The same chart contains a procurement milestone for the end of 2030: new purchases should, where possible, include only quantum-safe products, and at a minimum ones that can be updated in a quantum-safe way.

For the risk assessment, the guideline suggests the method in the PQC Migration Handbook, whose second edition the Dutch intelligence and security service AIVD, the national research institute for mathematics and computer science CWI and the research organization TNO published in December 2024. In that method, a use case’s risk level depends on three factors: how vulnerable its cryptography is, the expected damage, such as a loss of confidentiality, and the estimated time and effort needed to migrate it. The handbook also has an “acute” risk level. The German authors left it out, writing that three levels are enough for their purposes.

According to the guideline, organizations that meet the recommended dates should have adequate protection for most applications and avoid a chaotic transition, in which insufficiently tested solutions could introduce new vulnerabilities. Organizations that cannot meet them must assess their individual risk.

Owners, Inventory and Binding Dates by the End of 2026

Every organization should name at least one unit responsible for the migration. Sectors or large organizations may also set up a coordinating body. Its tasks include the implementation plan and priorities, progress monitoring and exchange with industry, research and other authorities. The guideline says enough staff and money must be planned for these tasks.

Each organization should also build an overview of its cryptographic components, modeled on the crypto register (Krypto-Kataster) described in requirement CON.1.A19 of the BSI’s IT-Grundschutz Compendium. Inventory tools, repository scans and cryptographic bills of materials (CBOMs), for example in the CycloneDX format, can help. The first inventory should be complete by the end of 2026.

Where no register of sufficient quality exists, the guideline suggests starting from a prioritized list of business processes and recording the IT components and crypto modules they use, along with the damage a decryption would cause. Organizations should also map internal and external dependencies. A card reader and its cards, the guideline notes, must both implement quantum-safe schemes before the communication between them is quantum-safe.

The three bodies describe their dates as urgent recommendations and want them made binding for the federal administration, the states and municipalities, and critical infrastructure. They name two bodies that should adopt the dates “as bindingly as possible” by the end of 2026: the IT-Planungsrat, where the federal government and the 16 states coordinate IT in public administration, and UP KRITIS, the public-private partnership of critical-infrastructure operators, their associations and government agencies.

For IT security products approved for classified information, the BSI has already set binding deadlines for completing the transition in the classified domain by 2030. For all other products, the guideline refers to dates in the BSI’s Technical Guideline TR-02102 that it describes as compatible with the roadmap.

State of the Art, Hybrid Cryptography and Suppliers

Cryptographic applications must meet the state of the art (Stand der Technik), for example by following TR-02102, which sets out the schemes the BSI considers quantum-safe and how to use them. The BSI recommends hybrid schemes that combine a classical algorithm with a post-quantum one.

The guideline adds that essential and important entities, the two categories of organizations regulated under the EU’s NIS2 directive, are obliged by Section 30 of the BSI Act to follow the state of the art for cryptography in line with their risk management. Section 30 itself says an entity’s risk-management measures should meet the state of the art and must include concepts and processes for the use of cryptography. Section 28 exempts some entities from Section 30, among them operators of public telecommunications networks and services, certain energy operators and financial entities covered by the EU’s DORA regulation, which follow their sector rules instead.

According to the guideline, each organization should make quantum risk assessment part of its regular risk management and record mitigation deadlines there.

On the supply chain, the guideline calls early coordination with manufacturers, IT service providers and communication partners essential for compatibility and interoperability. CBOMs make it easier to compare cryptographic capabilities along the supply chain, and their delivery can be written into contracts. In new developments, only quantum-safe cryptography should be used. In procurement, buyers should apply TR-02102’s requirements for post-quantum cryptography and crypto-agility by default.

Organizations should also plan the migration into product lifecycles. In some cases they can wait to replace a product until a PQC-capable successor exists; in others they need to replace it early.

Threat Assessment and the Emergency Plan

The guideline says there is currently no evidence that quantum computers can already break cryptographic schemes. It cites the 2025 update of the BSI’s study on the state of quantum computer development, summarizing it as finding a cryptographically relevant quantum computer likely within at most 15 years, meaning by 2040 or earlier. The guideline says the basic assumptions of quantum error correction were fully verified in 2024, and that further progress in error correction could shorten that period considerably.

A footnote quotes a February 2025 answer by the federal government to a parliamentary question, which says the government works in the high-security area under the hypothesis that cryptographically relevant quantum computers will be available at the beginning of the 2030s. The transition in the classified domain has been under way for many years, in line with NATO and other international organizations, according to the guideline.

The guideline gives “store now, decrypt later” as one reason for urgency: adversaries can store encrypted data now and decrypt it once a quantum computer is available, an attack also known as harvest now, decrypt later. The other reason is time, because complex systems and devices with long lifespans take years to migrate.

On the basis of an individual risk analysis, organizations must set clear priorities and develop an emergency plan. The guideline says organizations should cover quantum-safe software-update mechanisms, quantum-safe key agreement for high-risk use cases and early build-out of suitable public-key infrastructures in that plan.

Outside regulated sectors, according to the guideline, organizations have yet to recognize that using outdated or vulnerable cryptography can be judged negligent regardless of the quantum threat. It cites a 2023 BSI market survey of 28 companies and organizations, conducted with KPMG, in which almost 90% of participants estimated that they could not counter the quantum threat to cryptography in time.

Crypto-Agility and AI in the BSI Announcement

In its press release, the BSI gives crypto-agility (Kryptoagilität) more prominence than the guideline does. It says system architectures, procurement processes and risk management should be designed so that cryptographic schemes or their settings, such as key lengths, can be replaced quickly and in a controlled way when new findings or changed threats require it.

The BSI ties this to artificial intelligence, saying AI is speeding up security research and, increasingly, methods for attacking cryptographic schemes. The guideline itself mentions crypto-agility once, in its procurement requirement, and makes no reference to AI.

Bitkom’s Reaction

Bitkom, the German digital industry association, welcomed the publication. “The transition to quantum-safe methods takes years and must begin today,” Bitkom President Ralf Wintergerst said in a statement. He said government and business now need to back the roadmap with responsibilities, priorities and timelines.

Bitkom cited its own survey of 607 companies with at least 100 employees, conducted by telephone in late 2025, in which 43% said quantum computing poses a major risk to their IT security.

My Analysis

What Germany Added to the EU Roadmap

The 2030 and 2035 dates are the EU’s, and the guideline says so. The end-2026 date is the EU’s too: member states agreed in the EU roadmap to take first steps by then, including national planning and the start of cryptographic inventories. What BMI, BMDS and BSI added is the detail for each organization: a named owner with staff and budget, an implementation plan with deadlines, a first inventory by the end of 2026, quantum risk in the risk register with mitigation dates, and the first migration steps.

They also named two routes for making the dates binding, and pointed to a legal duty that already applies to most NIS2-regulated entities in Germany.

Eleven Weeks to Build a First Cryptographic Inventory

The guideline appeared on 12 October and asks for a first inventory by 31 December, eleven weeks that include the Christmas holidays. Federal bodies get help: IT-Grundschutz already describes a Krypto-Kataster, and the guideline says the BSI is supporting the federal administration with inventory and prioritization. The guideline mentions no comparable support for municipalities or companies.

Two weeks ago I called the Saudi central bank’s 31 December inventory deadline too tight for banks starting from zero. US auditors, in work completed in September 2025, found that one of 24 federal agencies had a complete inventory of its priority systems, more than two years after the May 2023 deadline. Organizations underestimate how much work a full cryptographic inventory is, and so do the regulators that set the deadlines. In my experience, the usual result is a checkbox inventory assembled from interviews.

The guideline offers a fallback for organizations without a register: start from prioritized business processes, record the components and crypto modules each one uses, and estimate the damage a decryption would cause. It is close to the Minimum Viable CBOM in my PQC Migration Framework, a bounded first record that starts with the systems and data flows that matter most. It is also the route I would take by 31 December.

A first inventory of the most consequential business processes and their dependencies, with its coverage gaps written down and dates set for extending it, is more useful at the end of 2026 than a complete one in 2028. It is also how an organization finds out which of its use cases are high-risk. Those are the ones the 2030 date covers.

Several regulators I talk to are preparing to test the quality of inventories, including their coverage and the CBOMs firms receive from vendors, instead of only asking whether one exists.

Which Parts of the Guideline Can Become Binding

The press release lists binding deadlines among the measures the guideline recommends. The guideline’s own dates are recommendations. The two bodies it asks to make them binding cover different audiences.

Under the IT-Staatsvertrag, the IT-Planungsrat can adopt binding IT security standards where they are needed for data exchange between federal and state administrations or with citizens and businesses. Such a decision requires the agreement of the federal government and 11 states representing at least two-thirds of the states’ financing shares. The federal government and the states then implement it in their own administrations by deadlines the council sets. The guideline itself notes that BSI requirements are often only advisory for state and municipal administrations, so of the routes the document names, only a council decision would bind them.

The guideline does not explain what binding adoption by UP KRITIS would look like. UP KRITIS brings operators, associations and authorities together. The guideline describes no mechanism through which a UP KRITIS decision would bind an operator.

For entities subject to Section 30 of the BSI Act, the duty with legal force already exists; the telecommunications, energy and financial entities exempted under Section 28 follow their sector rules instead. The guideline’s authors place post-quantum cryptography, as TR-02102 describes it, under the state of the art that Section 30 measures should meet, though they stop short of saying that a system without PQC already falls below that standard.

The dates are in the current TR-02102-1, version 2026-01. Classical key agreement on its own is no longer recommended after 2031, or after 2030 for the most sensitive applications, and classical-only signatures are planned to end by 2035.

A medium-risk use case has until 2035 under the guideline. If it relies on classical-only key agreement, the BSI stops recommending that mechanism after 2031.

My reading is that a supervisor reviewing the cryptography concept of an entity subject to Section 30 can already ask whether quantum risk is in the risk register with mitigation dates, because the guideline asks for exactly that. From 2032, classical-only key exchange will be outside the BSI’s recommendation, so an entity still using it will have to explain why its cryptography meets the state of the art.

The BSI Press Release Adds AI as a Reason for Crypto-Agility

The guideline, dated August and September, does not mention AI; its one reference to crypto-agility is the procurement requirement. The AI sentence appears only in the BSI’s press release of 12 October.

Between the cover date and publication, the BSI dealt with the kind of event its press release describes, though it did not name the case in the release. On 1 October it advised against Classic McEliece in new developments, a scheme it had recommended since 2020 and that ISO standardized in June 2026, after researchers published key-recovery cost estimates below the scheme’s claimed security levels. The authors of two of the papers disclosed AI assistance. The BSI said no practical attack exists against the parameter sets it recommends, so it changed its advice before any attack worked.

In July, the designers of HAWK, a candidate in NIST’s process for additional signature schemes, withdrew it a day after an AI-assisted attack went public.

I made the same argument in my 3 October piece on crypto-agility. AI speeds up cryptanalysis, so the post-quantum algorithms will not be the last ones organizations have to replace. AI also helps defenders, cutting the effort of finding cryptography in code, writing the changes and testing them. With both true, I keep returning to crypto-agility, the ability to change an algorithm on a date you choose. Any organization that deployed Classic McEliece on the BSI’s earlier recommendation now needs that ability.

Buyers can enforce crypto-agility through the guideline’s procurement recommendation, which is to apply TR-02102’s PQC and crypto-agility requirements to purchases by default. I would also make suitable CBOM delivery and a dated supplier migration roadmap contractual requirements in every new contract from now on. Products bought in 2027 will still be running in 2035.

A Technical Estimate and a Planning Hypothesis for a Cryptographically Relevant Quantum Computer

In the main text, the authors rely on the BSI study, a technical estimate: a cryptographically relevant quantum computer likely within at most 15 years, by 2040 or earlier. The study’s own page adds that new results on qLDPC codes could shorten that to about ten years. The footnote gives a different kind of assessment, the federal government’s working hypothesis for managing risk in its high-security systems: the beginning of the 2030s. In the strategy I covered on 5 October, the Dutch cabinet expects one between 2029 and 2035.

Outside the classified domain, I don’t think organizations need to decide whether the BSI study’s estimate or the government’s early-2030s hypothesis is right. The dates German organizations are asked to meet are already set: 2030 for high-risk use cases and 2035 for medium-risk ones, the same as in the Netherlands.

I would use the early-2030s hypothesis to decide what to migrate first. If it is right, there is little or no margin between the 2030 date for high-risk use cases and the arrival of a cryptographically relevant quantum computer. The emergency plan the guideline asks for would then become the migration plan. For data that must stay confidential into the 2030s, a migration finished in 2030 is already too late for anything harvested before then. For that data, the deadline that counts is the guideline’s “as soon as possible”, not 2030.

Of the emergency plan’s three items, I would start with quantum-safe software-update mechanisms. The guideline’s milestone chart has a related target for the end of 2030: new purchases should include at least quantum-safe update capability. A device whose update authenticity depends only on a quantum-vulnerable signature may lose its trusted path for remote migration once an attacker can forge that signature, which is the Trust Now, Forge Later risk in its most direct form. Some devices bought today will check their firmware against the same embedded keys well into the 2030s. The question to ask a supplier is whether the product has a tested, quantum-safe way to update its own trust anchors.

Germany and the Netherlands Applied the Same EU Roadmap Differently

Germany, France and the Netherlands co-chaired the EU work stream that produced the roadmap. Germany and the Netherlands then published their national versions a week apart, the Netherlands on 5 October and Germany on the 12th. Both kept the 2030 and 2035 dates. They differ in scope, in the first checkpoint and in the legal hook.

Germany kept the EU’s end-2026 milestone and gave it content. The Dutch cabinet asks for quantum risk management and a cryptography policy by the end of 2026 but leaves the migration plan to 2027, which I criticized on 5 October. The German guideline also covers more ground: companies, KRITIS operators and all three levels of government. The German instrument is weaker: a guideline from two ministries and an agency, with no reporting line to parliament, where the Dutch cabinet has committed to annual reports from 2027. Neither document allocates central funding for the migration.

The Netherlands and Germany both use their NIS2 rules as the legal hook: Article 13 of the Cyberbeveiligingsbesluit and Section 30 of the BSI Act. An entity covered by those provisions in either country should be ready to explain, well before 2030, how it addresses quantum risk in its cryptography policy.

What German Organizations Should Have in Place by 31 December

If your organization is in scope, four things should exist by 31 December:

1. A named owner with a budget. The guideline sets this as the minimum. Someone has to be accountable for every later step.
2. An implementation plan with deadlines, and first migration steps under way. The guideline’s milestone chart lists binding implementation plans with deadlines under 31 December 2026.
3. A first inventory, started from the most consequential business processes. Use CBOM tooling where possible and record each process’s dependencies. Write down what the inventory does not yet cover and set dates for extending it.
4. Quantum risk in the existing risk register. Record a mitigation date for each high-risk use case. For entities subject to Section 30, this is the record a supervisor can check.

From the next purchase on, buyers should apply TR-02102’s PQC and crypto-agility requirements. I would also add suitable CBOM delivery to the contract.

By the end of 2026, the IT-Planungsrat and UP KRITIS are supposed to adopt the dates as bindingly as they can. The IT-Planungsrat can give the timetable binding force within its legal remit. The reach of such a decision would depend on its scope and on how the federal government and the states implement it. Early in 2027, the BSI is due to revise TR-02102-1, the document the guideline cites as its reference for the state of the art. I have added the guideline’s dates to the Global PQC Migration Timeline.

Quotations from German sources were translated with AI assistance.

From the author