The G7 Cybersecurity Working Group called on governments and organizations on September 3, 2026, to start moving to post-quantum cryptography (PQC). Post-quantum cryptography is a family of public-key algorithms designed to resist attacks from both conventional and quantum computers. In “Preparing for the Post-Quantum Era: A Call to Action,” the group wrote that “governments and organizations should begin their PQC transition as soon as possible.”
France’s national cybersecurity agency, ANSSI, led the work under France’s 2026 G7 presidency, according to an ANSSI announcement. The European Commission and ENISA, the EU’s cybersecurity agency, took part as guests.
In the document, the agencies warned that organizations that delay their PQC transition “may lose competitive advantage or may be excluded from contracting opportunities, including public procurement.” ANSSI wrote that the call is addressed to public and private decision-makers.
Who issued it
CyberScoop reported that the six other signers were Canada’s Communications Security Establishment, Germany’s Federal Office for Information Security (BSI), Italy’s National Cybersecurity Agency, Japan’s National Cybersecurity Office, the U.K.’s National Cyber Security Centre, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The Canadian Centre for Cyber Security wrote that Canada was joining its working-group partners in releasing the document. Japan’s National Cybersecurity Office posted a notice about the call on September 3.
The risks the agencies described
In its summary of the document, the Cyber Centre wrote that organizations “face immediate risks such as ‘harvest now, decrypt later’ attacks.” In such an attack, an adversary records encrypted data today and stores it until a quantum computer can decrypt it.
The Cyber Centre also wrote that attackers using quantum computers could compromise authentication and “impersonate trusted entities, forge data, and undermine secure communications.” In the document, the agencies described the quantum threat as “a near-term threat that demands action across all sectors, not just critical infrastructure.”
Five priorities
The Cyber Centre listed five priority areas that the agencies set out.
- Raising awareness of quantum-related cybersecurity risks and of the benefits of PQC.
- Developing national strategies to support the adoption and availability of PQC technologies.
- Advancing research and development to support innovation and the practical deployment of PQC.
- Strengthening public-private partnerships to share expertise, resources, and best practices.
- Integrating PQC into cybersecurity requirements.
According to the Cyber Centre, the agencies called on public and private organizations to take a phased, risk-based approach to migration. They recommended an approach that includes inventorying cryptographic assets, identifying critical systems, mapping dependencies, and drawing up transition plans.
The earlier statement
ANSSI wrote that the agencies built the call on an earlier working-group statement on preparing for PQC migration, which the group negotiated and adopted during Canada’s 2025 G7 presidency. In that statement, according to ANSSI, the agencies gave practical recommendations to organizations, “particularly technical leadership.” The agencies wrote it for “technical management of medium-to-large organizations.”
In the earlier statement, the agencies advised organizations to update procurement policies “to require the purchase of products that support PQC.” They also recommended that each organization designate a board member accountable for PQC migration. The agencies advised setting up a team to check that suppliers and service providers are ready for PQC.
The agencies wrote in that statement that migration “is expected to be completed in the private sector during the 2030s” but that specific dates vary by country. They told organizations to refer to their national guidelines for more information.
