Neither the EU’s second Network and Information Security directive (NIS2) nor its Digital Operational Resilience Act (DORA) mentions post-quantum cryptography in its operative text. Under NIS2, essential and important entities must keep cryptography policies as part of security measures chosen with regard to the state of the art, a test that can be read to include preparing for quantum attacks. Under DORA’s technical standard on information and communication technology (ICT) risk management, financial entities must provide for changing their cryptography as cryptanalysis, the study of how ciphers are broken, advances. In September, the EU’s three financial supervisors wrote that “DORA requires FEs to adopt state-of-the-art cryptography against new threats,” using FEs for financial entities.
Post-quantum cryptography (PQC) refers to algorithms designed to resist attack by both conventional and quantum computers. Member states, with the Commission’s support, set the EU’s PQC migration dates in a June 2025 roadmap that answered a 2024 Commission recommendation. Their milestones are a start by the end of 2026, high-risk uses by the end of 2030, and medium-risk uses by the end of 2035, with low-risk uses moved by then only “as much as feasible.” Under EU law, neither the recommendation nor the roadmap is binding on a company.
On the better reading of both laws, a NIS2 or DORA entity already has an enforceable duty to assess quantum risk and to keep its cryptography policy current with it, while the EU’s 2030 and 2035 dates remain recommendations that neither law imposes on a company. How far that duty reaches for a given entity depends on its risk exposure and on the proportionality test in both laws. In January 2026, the Commission proposed writing post-quantum policy into NIS2. Under the proposed text, national governments would have to adopt post-quantum transition policies. As of November 12, 2026, neither the European Parliament nor the Council had adopted a position on the proposal.
What NIS2 requires
NIS2, Directive (EU) 2022/2555, reaches companies through national law. Member states had to adopt and publish their implementing measures by October 17, 2024, and apply them from the next day, under Article 41.
Under Article 21, essential and important entities must take “appropriate and proportionate” technical, operational, and organizational measures to manage the risks to their network and information systems. In choosing those measures, entities must take into account “the state-of-the-art” and reach a level of security “appropriate to the risks posed.” Among the minimum measures in Article 21(2), EU lawmakers included “policies and procedures regarding the use of cryptography and, where appropriate, encryption.”
Under Article 20, each entity’s management body must approve those measures and oversee their implementation, and it can be held liable for infringements. Members of the management body must also follow cybersecurity training under the same article. For breaches of Article 21, member states must provide for maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, whichever is higher, under Article 34. For important entities, the floor for the maximum is €7 million or 1.4% of turnover.
The Commission added detail for one group of entities in Implementing Regulation (EU) 2024/2690, adopted on October 17, 2024. It applied the regulation to DNS service providers, top-level domain registries, cloud and data-center providers, content delivery networks, managed service and managed security service providers, online marketplaces, search engines, social networks, and trust service providers. In its annex, the Commission required these providers to name approved algorithms and usage practices in their cryptography policies, with “a cryptographic agility approach” where appropriate. The providers must review those policies “taking into account the state of the art in cryptography.”
Cryptographic agility is the ability to replace an algorithm without rebuilding the systems that use it. Neither NIS2 nor the implementing regulation mentions quantum computers.
In Germany, lawmakers wrote the state-of-the-art test into Section 30 of the BSI Act, the country’s NIS2 law. Under Section 30(2), the risk-management measures of essential and important entities “sollen den Stand der Technik einhalten,” or should follow the state of the art. Lawmakers listed concepts and processes for the use of “kryptographischen Verfahren,” cryptographic methods, as item 8 of those measures.
On October 12, Germany’s interior and digital ministries and the Federal Office for Information Security (BSI) asked organizations to move high-risk uses of cryptography to quantum-safe methods by the end of 2030. A German NIS2 entity whose policy contains no plan to replace RSA and elliptic-curve keys, the public-key methods a large quantum computer would break, would struggle to show that it follows the state of the art the BSI has described.
What DORA requires
DORA, Regulation (EU) 2022/2554, has applied directly to banks, insurers, investment firms, and other financial entities since January 17, 2025, without national transposition. Where a sector-specific EU act imposes at least equivalent risk-management duties, NIS2’s own provisions do not apply, under its Article 4. Financial entities therefore follow DORA’s cryptography rules instead of NIS2’s.
Under Article 5(2) of DORA, a financial entity’s management body must “define, approve, oversee and be responsible for” its ICT risk-management framework. That duty includes policies on the availability, authenticity, integrity, and confidentiality of data.
The Commission wrote the detailed cryptography rules into the technical standard, Delegated Regulation (EU) 2024/1774, which it adopted on March 13, 2024. Under its Article 6, financial entities must keep a policy on encryption and cryptographic controls. Each entity must write into that policy “provisions for updating or changing, where necessary, the cryptographic technology on the basis of developments in cryptanalysis.”
The Commission used the word “quantum” only once in the technical standard, in Recital 9, part of the explanatory preamble. There it asked financial entities to “remain abreast of relevant developments in cryptanalysis” and to follow a flexible approach to cryptographic threats, “including threats from quantum advancements.” The binding duty is in Article 6(4), which has applied with DORA since January 17, 2025.
In its final transition plan, published on October 27, NIST, the U.S. standards agency, deprecated RSA and elliptic-curve algorithms at every approved key size after 2030, Quantum Observer reported. Under Article 6(3) of the technical standard, financial entities must set criteria for choosing cryptographic techniques “taking into account leading practices, and standards as defined in Article 2, point (1), of Regulation (EU) No 1025/2012.” In that regulation, EU lawmakers defined standards as specifications adopted by recognized standardization bodies, such as ISO and the EU’s standards organizations. NIST’s plan is not such a standard, but the phrase “leading practices” can be read to include it.
An entity that cannot update its cryptography must adopt mitigation and monitoring measures. It must record those measures with “a reasoned explanation.” Under Article 7, entities must “create and maintain a register for all certificates and certificate-storing devices” for at least the ICT assets that support critical or important functions.
A digital certificate ties a public key to an identity. Every certificate built on RSA or elliptic curves will need replacing in a post-quantum migration. A bank planning that migration would start its inventory from the Article 7 register.
Smaller firms that qualify for DORA’s simplified ICT regime fall under Title III of the technical standard instead. In that title, the Commission did not mention encryption or cryptanalysis in its article on data protection.
What supervisors have said
The European Banking Authority, the European Insurance and Occupational Pensions Authority, and the European Securities and Markets Authority published their autumn 2026 risk update on September 23 through their Joint Committee. In it, they wrote that DORA requires financial entities to adopt state-of-the-art cryptography against new threats.
They also warned that quantum threats “could materialise earlier than any viable commercial application” of quantum computers. They urged authorities and institutions to keep planning for the risks of quantum computing but set no date.
The European Central Bank (ECB), which directly supervises the euro area’s largest banks, has gone further in words. On July 7, 2026, Claudia Buch, chair of the ECB’s Supervisory Board, wrote to the chief executives of those banks that the adoption of PQC “must start now and necessitates sustained, strategic investment over time.” She added that the ECB would address the quantum risk to encryption “in a separate letter in due course.”
The ECB had not published that letter on its letters-to-banks page as of November 12. In a September 22 speech in Amsterdam, Buch said banks “need to prepare for the transition to quantum-resistant cryptography well before the risks fully materialise,” without giving a timetable.
Supervisors outside the EU have attached dates to the same work. The Saudi Central Bank gave its banks until the end of 2026 to make their cryptographic inventory procedures accurate and comprehensive. On November 6, the Monetary Authority of Singapore proposed in a consultation paper that financial institutions migrate critical systems by December 31, 2030, and called those timelines indicative and not legally binding. Neither the ECB nor the three EU supervisors had published a comparable date as of November 12.
Where the dates come from
In Recommendation (EU) 2024/1101 of April 11, 2024, the Commission asked member states to build a coordinated roadmap but set no migration dates itself. It wrote that Europe should switch to PQC “as swiftly as possible.” It also wrote that it would assess progress and “determine whether additional actions, including proposing binding acts of Union law, are required.” Under Article 288 of the Treaty on the Functioning of the European Union, recommendations have no binding force.
Member states adopted the Coordinated Implementation Roadmap in June 2025 through the NIS Cooperation Group, the forum of member-state representatives set up under NIS2, with the Commission’s support. According to the Commission’s summary, all member states “should start transitioning to PQC by the end of 2026.” High-risk use cases should move to PQC “as soon as possible, no later than by the end of 2030.”
In the roadmap document itself, the member states set the end of 2035 as the date by which “the PQC transition for medium-risk use cases has been completed.” For low-risk use cases, they asked for completion only “as much as feasible.” The Commission restated the 2035 milestone in its January 2026 proposal for medium- and low-risk uses alike, without that qualifier. On its PQC policy page, the Commission has said that a second deliverable to supplement the roadmap is in progress.
Germany and the Netherlands have written the dates into government policy without legislating them. Germany’s ministries and the BSI asked public bodies and companies to have migration owners, binding plans, and a first cryptographic inventory in place by the end of 2026. They issued the dates as recommendations. On October 5, the Dutch cabinet set the 2030 and 2035 targets for central-government organizations and told ministries to fund the work from existing budgets in the first instance.
The January 2026 proposal
On January 20, 2026, the Commission proposed COM(2026) 13, a directive amending NIS2 “as regards simplification measures and alignment with the Cybersecurity Act 2.” It published the text alongside a proposed regulation to replace the 2019 Cybersecurity Act. In most of the amending directive, the Commission proposed changes to jurisdiction rules, ransomware data collection, and the supervision of cross-border entities.
The Commission also proposed adding a point (k) to Article 7(2), the list of policies that each national cybersecurity strategy must contain. Member states would adopt policies “for the transition to post-quantum cryptography, taking into account the transition timelines and relevant requirements set out in applicable Union legal acts and policies,” according to the text sent to the Council. They would have 12 months after the directive’s entry into force to transpose it.
In Recital 8, the Commission described harvest-now, decrypt-later attacks as “likely occurring already now.” In such an attack, an adversary records encrypted data today to decrypt it once a capable quantum computer exists. The Commission wrote that the national policies should align with the roadmap, “thus achieving the migration to PQC by 2030 for critical use cases and by 2035 for medium and low level use cases.”
Under point (k), only national governments would take on a new duty. The Commission did not propose adding a PQC date to the Article 21 duties of essential and important entities. A country’s supervisors could draw on its national PQC policy, but the legal test for an entity would remain the state of the art under Article 21.
As of November 12, 2026, the proposal, procedure 2026/0012(COD), had passed neither institution. In the European Parliament, the industry committee’s rapporteur, Markéta Gregorová of the Greens/EFA group, issued a draft report dated September 24. Members tabled amendments on October 13. The Parliament’s Legislative Observatory listed no committee vote as of November 12.
In the Council, telecommunications ministers took note of a progress report on June 9. The Irish presidency, which runs until December 31, took over the file in July.
Eurosmart, a Brussels-based association of digital-security companies, has asked lawmakers to go further. In its recommendations on the proposal, the group welcomed point (k) and wrote that the strategy elements “should be better detailed.” It also wrote that it supports “the establishment of migration targets for critical use cases by 2030,” and it backed a 2035 target for remaining use cases. Eurosmart proposed writing both dates into point (k), the clause on member states’ strategies.
Where national law lags
NIS2’s duties reach entities only where national law is in place. On July 8, the Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice for failing to notify full transposition. The Dutch implementing law took effect on August 15, according to the National Cyber Security Centre.
Apart from entities in member states without complete transposition and smaller financial firms under DORA’s simplified regime, every NIS2 or DORA entity is bound by the duties described above today.
Timeline
| Date | Instrument and legal status | What it asks, and of whom | Source |
|---|---|---|---|
| October 17, 2024 (adopted) | Implementing Regulation (EU) 2024/2690 (law) | A cryptography policy with a cryptographic agility approach where appropriate, from DNS, cloud, data-center, managed security and trust service providers and others | Implementing Regulation (EU) 2024/2690 |
| October 18, 2024 | NIS2, Articles 20, 21 and 34 (law, through national transposition) | Cryptography policies within state-of-the-art risk measures, approved and overseen by management, from essential and important entities | Directive (EU) 2022/2555 |
| January 17, 2025 | DORA and its technical standard, Delegated Regulation (EU) 2024/1774, Articles 6 and 7 (law) | Provisions to update cryptography as cryptanalysis develops, and a certificate register, from financial entities outside the simplified regime | Delegated Regulation (EU) 2024/1774 |
| End of 2026 | Coordinated Implementation Roadmap (recommendation) | Start of the PQC transition, by member states | European Commission |
| End of 2026 | German PQC guideline (national recommendation) | Migration owners, plans and a first cryptographic inventory, from public bodies and companies | Quantum Observer |
| End of 2026 | Dutch government quantum strategy (government policy) | Quantum risk in risk management and a cryptography policy, from central-government organizations | Tweede Kamer |
| December 11, 2027 | Cyber Resilience Act, Annex I (law) | Protection of data confidentiality, for example by state-of-the-art encryption, in products with digital elements, from manufacturers | Regulation (EU) 2024/2847 |
| End of 2030 | Coordinated Implementation Roadmap (recommendation) | Transition of high-risk use cases | European Commission |
| End of 2035 | Coordinated Implementation Roadmap (recommendation), restated without the qualifier in Recital 8 of COM(2026) 13 | Transition of medium-risk use cases, and of low-risk use cases as much as feasible | Roadmap, Council document 5627/26 |
| 12 months after entry into force | COM(2026) 13, new Article 7(2)(k) (proposal) | National PQC transition policies, from member states | European Commission |
The case for waiting
A supervisor cannot cite a 2030 deadline that neither law sets. Both laws scale their duties to an entity’s size and risk, and a firm can argue that “state of the art” changes only when certified post-quantum products and settled standards are available for its systems. On that reading, a NIS2 or DORA entity that documents its quantum risk and updates its cryptography policy meets the law and does not have to migrate yet. Quantum Observer found no supervisor, regulator, or industry group that has published this argument in these terms.
The Netherlands Court of Audit reported in February 2026 that 71% of Dutch central-government organizations had not yet begun preparing for the threat quantum computers pose to encryption. The auditors examined only those government bodies.
Against that reading, a bank whose cryptography policy makes no provision for replacing quantum-vulnerable algorithms has a documented gap under Article 6 of DORA’s technical standard. Its supervisor can find that gap in an inspection today.
The EU has not yet decided when an entity must finish its migration. On that question, the 2030 and 2035 dates remain advice to governments.
What would confirm or overturn this reading
The ECB’s promised letter to the banks it supervises directly is the nearest test. If Buch sets dated expectations in that letter, the euro area’s largest banks will have a supervisory timetable without any new law.
Parliament and the Council could also change the legal picture. In their positions on the NIS2 amendment, they could extend point (k) to entities, delete it, or keep it as a duty of governments. The NIS Cooperation Group could narrow what counts as a high-risk use in its second roadmap document.
The Commission could propose binding dates after its assessment under the 2024 recommendation. The Quantum Insider reported on November 10 that under a draft EU Quantum Act it had obtained, which is not a formal proposal, procurement for critical sectors would generally have to be post-quantum-ready and the Commission could set binding migration milestones.
U.S. federal agencies must move their high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, the year the EU roadmap only recommends for high-risk uses, Quantum Observer reported in its companion analysis of U.S. deadlines.
Supervisors would confirm this reading if one of them published a NIS2 or DORA finding against an entity for a missing post-quantum plan. They would overturn it if they stated that PQC is not yet part of the state of the art.
