The EU PQC roadmap is the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, published by the NIS Cooperation Group in June 2025. It sets three milestones: 31 December 2026, 31 December 2030 and 31 December 2035. The first is now under three months away, and it is often described as an EU deadline for organisations to complete a cryptographic inventory.
That description is not quite right. The 2026 milestone is addressed to Member States, and the roadmap is guidance rather than law. But the roadmap and the NIS Cooperation Group’s own FAQ are clear that organisations in scope of NIS2 are expected to do the groundwork, and a Commission proposal published in January 2026 would write post-quantum migration into the NIS2 Directive itself. This review covers what is actually due at each milestone and from whom, what the NIS2 amendment would change, and what organisations with EU operations, including UK organisations, should do now.
Where the roadmap comes from
- 11 April 2024: the European Commission adopted Recommendation (EU) 2024/1101 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography. It recommended that Member States coordinate through a sub-group of the NIS Cooperation Group, and that the roadmap “should be available after a period of two years following the publication of this Recommendation”.
- June 2025: the NIS Cooperation Group’s PQC work stream published the roadmap as its first deliverable. The document is Part 1, version 1.1, dated 11 June 2025, and the Commission published it on 23 June 2025. It describes itself as “a first high-level paper aimed at the Member States”.
- 20 January 2026: the Commission proposed targeted amendments to the NIS2 Directive, COM(2026) 13, including a requirement for national PQC policies.
- 15 April 2026: the NIS Cooperation Group published “EU Roadmap on PQC – Frequently Asked Questions”, which answers many of the questions organisations ask about the roadmap’s scope.
A Commission Recommendation is not legislation. Under Article 288 of the Treaty on the Functioning of the European Union, “Recommendations and opinions shall have no binding force.” The roadmap’s authority comes from Member State commitment and from its links to binding law such as NIS2, DORA and the Cyber Resilience Act.
The three milestones
By 31 December 2026. The roadmap’s timeline sets three outcomes: “At least the First Steps have been implemented by all Member States”, “Initial national PQC transition roadmaps have been established by all Member States”, and “PQC transition planning and pilots for high- and medium-risk use cases have been initiated.” Its stated aim is “a minimum level of readiness in all Member States by the end of 2026”.
By 31 December 2030. “The PQC transition for high-risk use cases has been completed.” Planning and pilots for medium-risk use cases are complete, and “Quantum-safe software and firmware upgrades are enabled by default.” The roadmap adds that for high-risk use cases, “quantum-vulnerable public-key mechanisms shall not be used stand-alone after the end of 2030”.
By 31 December 2035. “The PQC transition for medium-risk use cases has been completed”, and the transition for low-risk use cases “has been completed as much as feasible”. The roadmap aligns this date with NIST IR 8547 and with the NCSC’s 2035 target.
What the 2026 milestone asks for, and from whom
The First Steps are written as national measures. There are eight: identify and involve stakeholders; support mature cryptographic asset management; create dependency maps; perform quantum risk analysis; include the supply chain; create a national awareness and communication programme; share knowledge with the NIS Cooperation Group work stream; and develop a timeline and an implementation plan.
Several of those steps only work if organisations act. The roadmap describes cryptographic inventories as “A first essential step and ‘no-regret’ move for every entity”, and asks Member States to promote them. The FAQ then answers the scope question directly. It says the term “entity” refers to any organisation, and that “At a minimum, entities in scope of the NIS 2 Directive, including public administration entities and critical infrastructure providers, should create an inventory of cryptographic assets and dependency maps, involve the supply chain, and perform a quantum risk analysis.” It adds that “all organisations are encouraged to undertake these steps.”
So the accurate reading is this. The 31 December 2026 date is a Member State milestone, and no EU instrument makes it a legal deadline for a company. The national roadmaps due by that date are where organisations will meet it: the FAQ says a national roadmap should include a plan to promote and support the creation and maintenance of cryptographic inventories and dependency maps, quantum risk analysis and inclusion of the supply chain. The FAQ tells organisations to “refer to the national roadmaps in conjunction with guidance and advice issued by their National Cyber Security agencies”.
What counts as high risk
The 2030 milestone applies to high-risk use cases, so the definition matters. The roadmap uses the quantum risk score from the PQC Migration Handbook, which combines the quantum weakness of the cryptography, the impact of it being broken, and the effort needed to migrate. Its rough classification for systems that rely on quantum-vulnerable public-key cryptography includes:
- If confidentiality must be protected for at least 10 years, and an attack after 10 years or more would still have significant impact, the risk is high. This is the harvest now, decrypt later case, which the roadmap calls “store now, decrypt later”.
- If migration would take more than 8 years and the impact of an attack is high, the risk is high. The roadmap gives securing software updates as the example.
- If confidentiality must be protected at all, the risk is at least medium.
The FAQ also corrects a common misreading. Asked whether all critical infrastructure systems must be quantum-resilient by 2030, it answers that “A risk-based approach as outlined in the EU Roadmap on PQC is recommended” and that the roadmap “indicates that all high-risk use cases should be transitioned to PQC by the end of 2030”. The 2030 date is set by the risk level of each use case, rather than applying to every critical infrastructure system.
What the NIS2 amendment would change
The Commission’s proposal COM(2026) 13, dated 20 January 2026, would add a new point (k) to Article 7(2) of the NIS2 Directive. Article 7(2) lists the policies Member States “shall in particular adopt” as part of their national cybersecurity strategy. The new point would require policies “for the transition to post-quantum cryptography, taking into account the transition timelines and relevant requirements set out in applicable Union legal acts and policies.”
Recital 8 of the proposal explains the intent. It says such policies should support “the creation of support measures and tools to assess the exposure of cryptographic assets to the risks posed by quantum computers”, help create migration plans, and align with the NIS Cooperation Group roadmap, “thus achieving the migration to PQC by 2030 for critical use cases and by 2035 for medium and low level use cases”. That wording is looser than the roadmap’s, which speaks of high-risk use cases by 2030 and low-risk use cases only “as much as feasible” by 2035.
Three points about status and effect:
- It is a proposal. The European Parliament’s Legislative Observatory lists the procedure, 2026/0012(COD), at first reading, with committee referral announced on 25 March 2026. It has not been adopted.
- It obliges Member States, not entities directly. The new point sits in the national cybersecurity strategy article. Entity obligations remain in Article 21, which already requires “policies and procedures regarding the use of cryptography and, where appropriate, encryption”.
- Transposition would follow adoption. The proposal gives Member States 12 months after entry into force to adopt the necessary national measures.
How DORA and the Cyber Resilience Act connect
The roadmap ties the transition to existing binding law. It notes that NIS2 and DORA require entities in scope to adopt risk-management measures “including on the use of state-of-the-art cryptography”, and that management bodies can be held liable for failing to comply. It also points to the Cyber Resilience Act, which applies horizontal cybersecurity requirements to products with digital elements placed on the EU market from 11 December 2027. For product manufacturers, the roadmap recommends that products with an expected lifetime beyond 2030 “should be upgradable to PQC” and that software and firmware upgrade mechanisms use post-quantum signatures.
What UK organisations with EU operations should note
A UK organisation that operates in the EU may be an essential or important entity under NIS2 in one or more Member States, or a supplier to one. In either case the EU national roadmaps will shape what it is asked for. The good news is that the two regimes point the same way. The NCSC expects discovery, assessment and an initial plan by 2028, the highest-priority migration activities by 2031 and migration complete by 2035. The NIS Cooperation Group’s FAQ itself notes that the NCSC’s 2035 date matches the EU’s. The EU’s 2030 milestone for high-risk use cases is the earlier date to plan around.
Supply chain questions will arrive regardless of jurisdiction. The roadmap’s First Steps say “Every organisation also needs to start the dialogue with product and service suppliers because the transition depends on them”, and the FAQ says the milestones “apply to the deployment of PQC”, which means vendors need to be ahead of them.
How the First Steps map to the ECEM lifecycle
Enterprise Cryptographic Exposure Management (ECEM) describes post-quantum readiness as a continuous six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. The entity-level First Steps map onto it as follows:
- Discover and Inventory correspond to mature cryptographic asset management. The roadmap notes that inventories “can be aided by tools (discovery and asset management tools)” and recommends a standardised format such as a CBOM.
- Assess corresponds to dependency maps and the quantum risk analysis, including the supply chain.
- Prioritise corresponds to sorting use cases into high, medium and low risk against the 2030 and 2035 milestones.
- Transition corresponds to pilots and migration, starting with high-risk use cases and quantum-safe update paths.
- Monitor corresponds to keeping the inventory current. The FAQ notes that maintaining a cryptographic inventory “requires constant review and update”.
The FAQ also removes a common reason for delay. Asked whether an organisation must finish its inventory before planning, it answers: “No, organisations do not need to complete their inventory prior to commencing planning and prioritisation.” An initial inventory, alongside a high-level map of applications and the servers they rely on, is enough to start prioritising high-risk use cases.
Where Quantum Sentinel fits
Quantum Sentinel is built around the ECEM lifecycle and supplies the inventory and risk evidence the First Steps describe:
- Inventory. Discovery covers networks and services, certificates and PKI, key management and HSMs, cloud platforms, databases, applications and source code, endpoints, network security appliances, containers and Kubernetes, operational technology and IoT, and file shares. Every finding lands in a living Enterprise CBOM, exported as CycloneDX 1.7.
- Dependencies. The CBOM records dependency relationships, so the reach of a single key or issuer can be answered.
- Risk. Findings carry a risk classification and harvest-now-decrypt-later exposure informed by how long the data must stay confidential, which is the input the roadmap’s high-risk test needs.
- Readiness, not only weakness. Hybrid post-quantum key exchange is reported by name, and endpoints are checked for whether their cryptographic libraries can perform ML-KEM and ML-DSA today.
- Monitoring. Policy is evaluated continuously, with drift detection and alerting.
Quantum Sentinel does not set an organisation’s risk appetite or replace the guidance of its national cybersecurity authority. It supplies the inventory and evidence that the risk analysis and the national roadmap requests depend on. The cryptographic coverage page lists what is covered in detail.
What to have in place by the end of 2026
- An initial cryptographic inventory, in a standardised format such as a CBOM, with a plan to keep it current.
- A dependency map of applications and platforms, including third-party dependencies.
- A quantum risk analysis that identifies high-risk use cases, especially data that must stay confidential for 10 years or more and software and firmware update signing.
- The quantum threat recorded in top-level risk management, so that it is discussed at board level.
- Written requests to key suppliers for their PQC and cryptographic agility roadmaps.
- A watch on the national roadmap of each Member State in which the organisation operates.
Frequently asked questions
What is due under the EU PQC roadmap by 31 December 2026?
By the end of 2026, all Member States should have implemented at least the roadmap’s First Steps, established initial national PQC transition roadmaps, and initiated transition planning and pilots for high- and medium-risk use cases. The milestone is addressed to Member States rather than to individual organisations.
Is the EU PQC roadmap legally binding?
No. The roadmap was produced by the NIS Cooperation Group in response to Commission Recommendation (EU) 2024/1101, and recommendations have no binding force under Article 288 of the Treaty on the Functioning of the European Union. Binding obligations come from laws such as NIS2, DORA and the Cyber Resilience Act, and from the national measures Member States adopt.
Do organisations need a cryptographic inventory by the end of 2026?
No EU instrument sets that as a legal deadline for organisations. The NIS Cooperation Group’s FAQ says that, at a minimum, entities in scope of NIS2 should create an inventory of cryptographic assets and dependency maps, involve the supply chain and perform a quantum risk analysis, and it encourages all organisations to do the same. National roadmaps, due by the end of 2026, may set specific expectations.
What does the proposed NIS2 amendment say about post-quantum cryptography?
Proposal COM(2026) 13, dated 20 January 2026, would add a point (k) to Article 7(2) of NIS2, requiring Member States to adopt policies for the transition to post-quantum cryptography as part of their national cybersecurity strategy. It is still a proposal at first reading in the European Parliament.
Must all critical infrastructure be quantum-safe by 2030?
No. The roadmap sets the 2030 milestone for high-risk use cases, and the NIS Cooperation Group’s FAQ recommends a risk-based approach. Medium-risk use cases follow by the end of 2035, and low-risk use cases as far as feasible by then.
Sources: NIS Cooperation Group, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, Part 1, version 1.1 (11 June 2025), and EU Roadmap on PQC – Frequently Asked Questions (15 April 2026), both published on that page; European Commission, Recommendation (EU) 2024/1101 (11 April 2024); European Commission, COM(2026) 13, proposal amending Directive (EU) 2022/2555 (20 January 2026); Directive (EU) 2022/2555 (NIS2); European Parliament, Legislative Observatory, procedure 2026/0012(COD).
Further reading: why post-quantum deadlines are really inventory deadlines, what Enterprise Cryptographic Exposure Management is and what the US post-quantum mandate means for suppliers.