Post-quantum cryptography: the 2026, 2030 and 2035 deadlines and which of them are binding

Why the dates are now set

Standardized post-quantum algorithms have existed since August 2024. That month, the US National Institute of Standards and Technology (NIST) published ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures as FIPS 203, 204 and 205. Since then, “we are waiting for standards” is no longer a reason to put off the migration.

There are now dates as well. In June 2025, the EU member states, supported by the European Commission, published a joint roadmap for the transition. EU roadmap In January 2026, the BSI, Germany's Federal Office for Information Security, added migration deadlines to its Technical Guideline TR-02102-1. BSI TR-02102-1 And on 12 October 2026, the BMI (Federal Ministry of the Interior), the BMDS (Federal Ministry for Digital Transformation and Government Modernisation) and the BSI published a joint guideline that adopts the EU dates for Germany. BSI

This article puts the dates from these documents in context. It separates what is recommended from where it becomes an obligation. Many summaries pay too little attention to that distinction.

The deadlines at a glance

End of 2026: inventory, responsibility and plan

The first deadline is not about technology but about organization. For the end of 2026, the EU roadmap lists these first steps, among others: involve stakeholders, build mature management of cryptographic assets, map dependencies, analyze the quantum risk, include the supply chain, and draw up a timeline and implementation plan. Pilot projects for high- and medium-risk use cases should have started by then. EU roadmap, PDF

The national guideline is more specific for Germany. The preparation and planning phase, which the guideline calls “PQC readiness”, should be complete by the end of 2026. Every organization should name at least one responsible function that steers the implementation plan, priorities and progress, and should budget sufficient staff and funding for it. Guideline, PDF

For the inventory, the guideline points to the Krypto-Kataster (crypto inventory) from IT-Grundschutz, the BSI's baseline security methodology: requirement CON.1.A19 in module CON.1 Crypto Concept. Inventory tools, scans of code repositories and a Cryptographic Bill of Materials (CBOM), for example based on the CycloneDX standard, can help. The first version of the inventory should be in place by the end of 2026. It also includes an overview of internal and external dependencies. The guideline's example: a card reader and the card must both support quantum-safe algorithms, otherwise the connection between them is not quantum-safe.

End of 2030: what a high-risk use case is

The most important deadline is the end of 2030. By then, use cases with high quantum risk should be migrated. The EU roadmap puts it plainly: for these use cases, vulnerable public-key algorithms should no longer be used on their own after the end of 2030. The same applies to medium-risk use cases after the end of 2035.

Each organization defines for itself what “high risk” means. The roadmap provides a method and rough rules of thumb for this. The quantum risk of a use case depends on three factors:

• how vulnerable the cryptography in use is,
• what damage results if it is broken,
• how long and how costly the migration to post-quantum cryptography is.

Two of the roadmap's rules of thumb are particularly practical. First: if data must remain confidential for at least ten years and an attack would still have significant consequences after ten years, the risk is high. Attackers can intercept and store such data today in order to decrypt it later (“store now, decrypt later”). Second: if the migration takes more than eight years and the consequences of an attack would be severe, the risk is also high. The roadmap gives securing software updates as an example.

This leads to a second requirement for 2030: quantum-safe software and firmware updates should be enabled by default. Products placed on the market with an expected lifetime beyond 2030 should be upgradable to post-quantum algorithms. The update mechanism itself should use post-quantum signatures for this.

In TR-02102-1, the BSI sets the same date for applications with very high protection requirements: their migration to quantum-safe algorithms should be completed by the end of 2030.

End of 2031 and 2035: what BSI TR-02102-1 recommends

TR-02102-1, version 2026-01 of 23 January 2026, is the BSI's central recommendation on cryptographic algorithms and key lengths. It distinguishes between key establishment and signatures. BSI TR-02102-1, PDF

Key establishment. The BSI recommends classical algorithms such as RSA or elliptic-curve Diffie-Hellman on their own only until the end of 2031. After that, they should only be used together with a quantum-safe KEM. The reason is “store now, decrypt later”: intercepted data is at risk as soon as a sufficiently powerful quantum computer exists, even if the interception happened years earlier.

Signatures. Here the situation is different. A classical signature remains trustworthy as long as there is no cryptographically relevant quantum computer. The BSI therefore follows the EU roadmap and, as things stand, expects to recommend classical signature algorithms until the end of 2035. At the same time, the guideline points out that long migration times are to be expected, especially for signatures within a PKI.

Hybrid instead of replacement. The BSI recommends using post-quantum algorithms in hybrid mode, that is, in combination with a classical algorithm. If one of the two falls, the other continues to protect. The national guideline adopts this recommendation.

2035: NIST IR 8547 and the international framework

In the US, NIST proposed a timeline for phasing out classical public-key algorithms in November 2024 with the draft NIST IR 8547. NIST IR 8547 Algorithms with a 112-bit security level, including RSA-2048, are to be “deprecated” after 2030. After 2035, RSA, ECDSA, EdDSA and classical Diffie-Hellman at all security levels are to be “disallowed”.

Two caveats matter. The document is still a draft (Initial Public Draft) today. And at NIST, “deprecated” does not mean prohibited: an algorithm may still be used if the organization knowingly accepts the risk. It is only definitively excluded once it is “disallowed”.

The EU roadmap deliberately aligned 2035 with this timeline. It refers to NIST IR 8547, to the US goal from National Security Memorandum 10 of mitigating as much quantum risk as possible by 2035, and to the timeline of the UK's NCSC, which also names 2035 as its target. For internationally active companies, that is good news: the major timelines do not contradict each other.

What is mandatory and what is a recommendation

Most summaries talk about “deadlines”. Legally, however, the dates in the EU roadmap and the national guideline are recommendations. The guideline says so itself: the deadlines are “urgent recommendations in view of the acute pressure to act”. To make them binding, the IT-Planungsrat (the IT planning council of the German federal and state governments) and UP KRITIS (the German public-private partnership for critical infrastructure protection) are to adopt them in as binding a form as possible by the end of 2026.

Today, three things in particular are binding:

• Verschlusssachen (classified information). For approved IT security products for classified information, the BSI has set binding deadlines to migrate the classified information domain by 2030.
• NIS2 in Germany. Under § 30 of the BSI Act (BSIG), important and essential entities are required to comply with the state of the art for cryptography. The guideline explicitly names TR-02102 as the benchmark for this. Anyone who ignores the recommendations of TR-02102 without a reasoned risk decision will likely find it hard to demonstrate the state of the art.
• Sector rules. The delegated act on ICT risk management under DORA (Delegated Regulation (EU) 2024/1774, Article 6) requires financial entities to provide in their policy on encryption and cryptographic controls that cryptographic technology is updated or replaced in response to advances in cryptanalysis. Since 31 March 2025, PCI DSS 4.0.1 requirement 12.3.3 has required a documented inventory of the cipher suites and protocols in use, reviewed at least once a year, and a strategy for anticipated vulnerabilities. Neither sets a fixed post-quantum date. But a quantum computer is exactly the kind of development they are meant to respond to.

Both documents, the EU roadmap and the guideline, also contain the same sentence for the case where a date cannot be met: the individual risk must then be assessed. That is not a way out but a duty to document. Anyone who misses 2030 should be able to explain why, and with which compensating measures.

What the timeline means for planning

The EU roadmap also justifies its dates with the duration of the migration. It could easily take five to ten years to fully migrate all relevant systems. The guideline points to earlier cryptographic migrations that also took years.

How well prepared companies are is shown by a market survey that KPMG conducted on behalf of the BSI in 2023: almost 90 percent of participants estimated that they would not be able to counter the threats that quantum computers pose to cryptography in time. BSI market survey

The calculation is simple. Anyone who is supposed to have migrated high-risk use cases by the end of 2030 and needs five years to do so should have started in 2025. For everyone else: the end-of-2026 deadline for inventory, responsibility and plan is the first one that can still realistically be met. And it costs mainly effort, hardly any investment.

At the same time, the EU roadmap and the guideline warn against the other extreme. The timeline is meant to avoid a chaotic transition that creates new vulnerabilities through insufficiently tested solutions. A fast wholesale replacement is therefore not the goal. What is needed is a prioritized, tested and documented migration.

What we take from this at Secani

The guideline calls for integrating quantum risk into regular risk management and anchoring the treatment deadlines there. For an ISMS, this means: quantum risk does not become a special project alongside the register but a risk like any other, linked to the affected assets, applications and suppliers, with a responsible person and a due date. That keeps it traceable which use cases were rated high, why, and when they are to be migrated.

How to manage risks so that they lead to decisions is described in Build a risk register that changes decisions. How to review encryption and key management as a whole is covered in Encryption and key management: verify the protection chain. What research says about when a quantum computer could break RSA is summarized in When will Q-Day come? What research in 2025 and 2026 shows.

Conclusion

The dates for the post-quantum migration are set, and the major timelines from the EU, Germany, the US and the UK fit together: inventory and plan by the end of 2026, high-risk use cases by the end of 2030, the rest by 2035. So far, they are binding mainly for classified information. For NIS2 entities in Germany, they effectively become the benchmark through the state of the art under § 30 BSIG. Anyone starting today should therefore not begin with technology, but with a responsible function, an inventory and a reasoned classification of their own use cases.

Sources

• A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (EU PQC Workstream of the NIS Cooperation Group, Part 1, version 1.1, 11 June 2025, published 23 June 2025)
• Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie (Joint guideline of the BMDS, BMI and BSI, published 12 October 2026)
• Umstellung auf Post-Quanten-Kryptografie: Leitlinie zur nationalen Umsetzung der EU-Roadmap veröffentlicht (BSI, press release, 12 October 2026)
• BSI TR-02102-1: Kryptographische Verfahren: Empfehlungen und Schlüssellängen (version 2026-01, 23 January 2026)
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards (Initial Public Draft, 12 November 2024)
• Marktumfrage Kryptografie und Quantencomputing (KPMG on behalf of the BSI, April 2023)