EU post-quantum roadmap 2030 critical infrastructure dates

The EU post-quantum roadmap is the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (PQC). EU Member States adopted it in June 2025 on the basis of Commission Recommendation C(2024) 2393. It sets three milestones: start the transition by the end of 2026, protect high-risk use cases (critical infrastructure among them) by the end of 2030, and migrate as many of the remaining systems as is feasible by 2035.

For operators of energy grids, water utilities and other OT-heavy infrastructure, the roadmap affects one thing very directly: the encrypted links between substations, pumping stations, control centres, cloud environments and remote engineers. This article explains what the roadmap actually says, what it does not say, and how operators can turn it into a work plan.

What is the EU Coordinated Implementation Roadmap for PQC?

It is a non-binding, high-level plan for Member States. It grew out of a 2024 Commission Recommendation and was drafted by the NIS Cooperation Group. On 11 April 2024, the Commission published a Recommendation on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, and for the development of this Roadmap it recommended establishing a work stream on PQC with the NIS Cooperation Group. In the Official Journal, the Recommendation appears as (EU) 2024/1101. The work stream was co-chaired by Germany, France and the Netherlands.

The Recommendation also gives ENISA a role. It encourages Member States to work at EU-level closely with the Union’s cybersecurity experts, with the NIS Cooperation Group and with ENISA, on the evaluation and selection of the appropriate Post-Quantum Cryptography algorithms. The groundwork goes back further than 2024. Statistic: the Commission has been funding research and development in Post-Quantum Cryptography for over a decade (EUR-Lex, 2024).

When the roadmap was published, Henna Virkkunen, the Commission’s Executive Vice-President for Technological Sovereignty, Security and Democracy, said: “The post-quantum cryptography roadmap provides a clear direction to ensure the robust security of our digital infrastructure.”

What does the EU Coordinated Implementation Roadmap for PQC require by the end of 2026?

By the end of 2026, every Member State should have begun the transition and set up a national PQC roadmap, with planning for high- and medium-risk use cases already in progress. According to the Commission, all Member States should start transitioning to PQC by the end of 2026. A Commission presentation hosted by ENISA spells out the milestone: by 31 December 2026, PQC roadmaps defined in each MS. Planning for high and medium-risk use cases will be underway.

The milestone is aimed at governments, not directly at companies. In practice, though, national roadmaps can only be written with input from operators. Organisations that already know where they use public-key cryptography (VPN tunnels, remote access, certificates on HMIs and historians, cloud connections) will be in a stronger position when their national authority or sector regulator starts asking questions.

The process is still developing. The NIS Cooperation Group consulted stakeholders and then published a FAQ. Statistic: 63 respondents provided feedback on areas of the roadmap seeking further clarification (European Commission, published 2 September 2026). The work stream is now working on a second deliverable to supplement the roadmap.

Which critical infrastructure use cases count as high-risk under the EU PQC roadmap?

High-risk use cases are those in critical entities where a cryptographic failure would have serious effects. The Commission’s own material names water, energy, health care, finance and transportation as examples. The ENISA-hosted presentation lists the 2030 target as high-risk use case migrated: critical infrastructure (eg water, energy, health care, finance and transportation) and high-risk domains. The Commission’s internal security strategy also states that Member States should identify high-risk cases in critical entities and ensure quantum-safe encryption for these high-risk cases as soon as possible and no later than by the end of 2030.

Note the wording “use cases”. Not every system in a utility is automatically high-risk. In an OT setting, these factors usually decide the classification:

• Confidentiality lifetime of the data. Grid topology, protection settings and network diagrams can stay sensitive for decades. Encrypted traffic recorded today could be decrypted once a capable quantum computer exists.
• Asset lifetime. RTUs, PLCs and the links between them often run for 15 years or more. A tunnel set up in 2026 may well still be carrying traffic in 2035.
• Exposure. Links between sites over the public internet or carrier networks are more exposed than links that stay inside one physical perimeter.
• Authenticity of control traffic. Where control commands and firmware updates depend on public-key signatures, a future break would affect integrity as well as confidentiality.

Do energy and water operators have to finish moving to post-quantum encryption by 2030?

Not as a direct legal obligation from the roadmap itself, but the policy expectation is clear: high-risk use cases in energy and water should be protected by the end of 2030 at the latest. The Commission puts it plainly: the protection of critical infrastructures should be transitioned to PQC as soon as possible, no later than by the end of 2030.

Pressure to comply comes through other channels. National roadmaps, sector supervisors and procurement rules will carry the 2030 target into the sector. The Recommendation also keeps the option of legislation open: the Commission will assess progress and determine whether additional actions, including proposing binding acts of Union law, are required.

What happens to medium-risk systems by 2035?

Medium-risk use cases are planned during the 2030 phase and should be migrated by the end of 2035, together with as many other systems as feasible. The Joint Research Centre summarises the roadmap as recommending that member states elaborate transition plans by the end of 2026, with the migration of high-risk systems to be completed by 2030, and as many systems as possible to be migrated by 2035. The ENISA-hosted presentation also lists transition planning for medium-risk ones as part of the 2030 milestone.

For OT, the 2035 group will probably include the most awkward cases, such as legacy controllers whose firmware cannot support new algorithms. A common approach is to protect these assets at the network layer. They stay as they are, and the traffic between sites is wrapped in a quantum-safe tunnel. That way, the device lifecycle and the cryptographic migration are no longer tied together.

Does the EU roadmap recommend hybrid post-quantum schemes?

Yes. The 2024 Recommendation names hybrid schemes explicitly, and the roadmap recommends hybrid and crypto-agile approaches. The Recommendation expects PQC to reach public administration systems and critical infrastructures via hybrid schemes that may combine Post-Quantum Cryptography with existing cryptographic approaches or with Quantum Key Distribution. The JRC notes that the roadmap also recommends hybrid and crypto-agile approaches.

Many national authorities share this position. Statistic: 18 European countries expressed in a joint statement their choice of a hybrid transition from classical to post-quantum cryptosystems (JRC, 2025). The reasoning is that some post-quantum schemes are relatively young and might be vulnerable to as-of-now unknown quantum or classical attacks.

What hybrid looks like on a link between sites

On a site-to-site or remote-access link, “hybrid” usually means a single key agreement in which a classical part and a post-quantum part are combined into one session key. The link stays protected as long as either part holds. Crypto agility means the post-quantum algorithm can be swapped without replacing the hardware. As one example, Quantum Network’s QPN gateway uses this hybrid model: it combines a classical exchange with ML-KEM (FIPS 203), renews both handshakes every two minutes, and encrypts at Layer 3, so no software has to be installed on the OT equipment behind it.

How does the EU PQC roadmap relate to NIS2 and the Cyber Resilience Act?

The roadmap sets the timeline. NIS2 and the Cyber Resilience Act are the binding laws through which cryptographic expectations reach operators and manufacturers. The roadmap does not change either law, but it shapes what “state of the art” in cryptography will be taken to mean.

NIS2 (Directive (EU) 2022/2555)

Article 21(2)(h) of NIS2 requires essential and important entities to have policies and procedures regarding the use of cryptography and, where appropriate, encryption. Implementing Regulation (EU) 2024/2690 adds detail for digital-infrastructure entities. Their cryptographic policy must set out the strength of measures for data at rest and data in transit, and approved algorithms must be chosen following, where appropriate, a cryptographic agility approach. It also requires these policies to be reviewed taking into account the state of the art in cryptography. Once PQC is the EU’s stated direction, a cryptographic policy for a link that must stay confidential until 2035 that ignores it becomes harder to defend.

NIS2 itself is being amended. Statistic: the targeted amendments proposed in January 2026 will ease compliance for 28,700 companies, including 6,200 micro and small-sized enterprises (European Commission via EEAS, January 2026). The cryptography requirement in Article 21 remains part of the framework.

Cyber Resilience Act (Regulation (EU) 2024/2847)

The CRA applies to manufacturers of products with digital elements, including many OT components. The Commission describes a strong hook to the Cyber Resilience Act in the Roadmap. The 2030 milestone includes that quantum-safe software and firmware upgrades are enabled by default. For operators, this is mainly a procurement question: when buying equipment that will still be running in the 2030s, ask suppliers how they will deliver quantum-safe updates and support crypto agility.

How should OT operators sequence the work before 2030?

Start with an inventory of connections, rank them by data lifetime and exposure, and protect the high-risk links first. Then move on to the harder cases at device level. A workable order for organisations that run OT and critical infrastructure:

1. Map every encrypted path. List links between sites, links from edge to cloud and remote-access paths, and record which key exchange each one uses today.
2. Classify by the roadmap’s logic. Mark links as high, medium or low risk based on how long the data stays sensitive, how exposed the link is, and whether the asset sits in a critical entity.
3. Separate network-layer fixes from device fixes. Links can often be made quantum-safe at the network edge long before every controller can be upgraded.
4. Insist on hybrid and agility. Choose solutions that combine classical and post-quantum key exchange and allow algorithms to be replaced as guidance changes.
5. Align documentation. Record these decisions in the cryptographic policy that already exists under NIS2, so the PQC plan and the risk-management records match.