2030 — Prioritise high-risk systems.
The EU's coordinated PQC roadmap aims for post-quantum protection in high-risk use cases by 2030. This is a planning target, not a universal NIS2 deadline.
The European Commission and Member States published a coordinated implementation roadmap in 2025. Its 2030 horizon focuses on high-risk use cases. NIS2 requires appropriate cybersecurity risk-management measures, but does not itself prescribe a blanket PQC conversion date of 2030.
Priority should reflect exposure, the lifetime of protected information and the feasibility of replacing components. A migration date is only meaningful when dependent suppliers, certificates and operating procedures are included.
- 01
Select critical paths
Prioritise exposed communication links, identity services and long-lived confidential records using the risk register.
OUTPUTApproved high-risk system scope - 02
Prove interoperability
Test hybrid and post-quantum mechanisms against real protocol stacks, network constraints, supplier interfaces and failure modes.
OUTPUTInteroperability and rollback test records - 03
Move into operation
Roll out in controlled stages and update certificate lifecycles, monitoring, incident response and key management.
OUTPUTDeployment records and operational acceptance
High-risk use cases have documented post-quantum protection or an explicitly approved, time-bound exception.