Germany’s Federal Ministry of the Interior (BMI), its Federal Ministry for Digital Transformation and Government Modernisation (BMDS), and the Federal Office for Information Security (BSI) published a joint guideline on October 12, 2026, for moving public administrations and companies to post-quantum cryptography (PQC). In the document, the three bodies align Germany’s timelines with the EU’s June 2025 Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography.
Organizations should move high-risk uses of cryptography to quantum-safe methods as soon as possible and no later than the end of 2030, and should largely complete the transition by 2035, the BSI said in its announcement. By the first date, December 31, 2026, each organization should have named who is responsible for the migration, set binding implementation plans with deadlines, and completed a first cryptographic inventory.
The ministries and the BSI issued the dates as recommendations and asked the bodies that coordinate public-sector IT and critical-infrastructure security to adopt them “as bindingly as possible” by the end of 2026.
Who the guideline covers
The guideline is addressed to federal, state, and municipal administrations and to companies, in particular operators of critical infrastructure, known in Germany as KRITIS. The ministries and the BSI describe their dates as urgent recommendations.
The two bodies are the IT-Planungsrat, the council through which the federal government and the 16 states plan public-sector IT together, and UP KRITIS, a voluntary public-private partnership of critical-infrastructure operators, their associations, and government agencies.
Risk levels and dates
Following the EU roadmap, organizations classify each use case, meaning an application or a system, as high, medium, or low quantum risk, and migrate the high-risk ones first. Medium-risk use cases should be migrated by the end of 2035. Low-risk use cases should be migrated as far as possible by the same date.
For the risk assessment, the authors recommend the method in the PQC Migration Handbook that the Dutch intelligence service AIVD and the research organizations CWI and TNO published in December 2024. Under the method, organizations weigh how vulnerable a use case’s cryptography is, the damage a break would cause, and the time needed to migrate. The German authors dropped the handbook’s highest risk level, “acute,” writing that three levels are enough for their purposes.
By the end of 2030, organizations should, where possible, buy only quantum-safe products. At a minimum, the products they buy should be updatable to quantum-safe cryptography.
Inventory, suppliers, and legal duties
Each organization should build an overview of its cryptographic components modeled on the crypto register, or Krypto-Kataster, in requirement CON.1.A19 of the BSI’s IT-Grundschutz Compendium. According to the guideline, organizations can use inventory tools, repository scans, and cryptographic bills of materials to build the overview. Where no register of sufficient quality exists, the authors suggest starting from a prioritized list of business processes and the IT components and crypto modules each one uses.
The authors call early coordination with manufacturers, IT service providers, and communication partners essential. In procurement, buyers should by default apply requirements for post-quantum cryptography and crypto-agility. The BSI’s Technical Guideline TR-02102 lists the schemes the agency considers quantum-safe. The agency recommends hybrid schemes that pair a classical algorithm with a post-quantum one.
The authors note that essential and important entities, the organizations regulated under the EU’s NIS2 directive, must follow the state of the art for cryptography under Section 30 of the BSI Act. Some entities, including financial firms covered by the EU’s DORA regulation, follow their own sector rules instead.
The threat assessment
The guideline says there is currently no evidence that quantum computers can break cryptographic schemes. The authors cite the BSI’s 2025 study on the state of quantum computer development, which estimates that a cryptographically relevant quantum computer could exist in about 15 years. The guideline summarizes that as 2040 or earlier.
In a footnote, the authors quote a February 2025 federal government answer to a parliamentary question. In that answer, the government said that in the high-security area it works on the hypothesis that such machines will be available at the beginning of the 2030s.
The authors give two reasons for urgency. Adversaries can store encrypted data now and decrypt it once a capable quantum computer exists. Complex systems and long-lived devices take years to migrate.
Bitkom, the German digital industry association, welcomed the guideline. “The transition to quantum-safe methods takes years and must begin today,” Bitkom president Ralf Wintergerst said in a statement. In a Bitkom telephone survey of 607 companies with at least 100 employees, conducted in late 2025, 43% of the companies said quantum computing poses a major risk to their IT security.
