2035 — Complete the wider transition.
The EU roadmap targets the remaining systems by 2035 where feasible. NIST's draft transition plan also proposes disallowing quantum-vulnerable public-key algorithms after 2035 for relevant US federal uses. Neither is a blanket EU–NATO mandate.
The European roadmap distinguishes early high-risk deployments from the broader transition by 2035, subject to technical and operational feasibility. NIST's IR 8547 remains a draft transition plan; its proposed deprecation dates must not be presented as enacted rules.
At this stage the measure of progress is not a pilot deployment but sustained coverage: remaining applications, suppliers, archives and recovery environments have been accounted for.
- 01
Resolve the long tail
Address embedded devices, specialist applications, offline archives and suppliers whose upgrade cycles lagged behind the priority systems.
OUTPUTResidual dependency and exception register - 02
Retire vulnerable paths
Remove quantum-vulnerable public-key mechanisms from in-scope workflows once replacements and verification paths are proven.
OUTPUTDecommissioning records and validation results - 03
Maintain adaptability
Keep algorithms, certificates and procurement specifications updateable as standards, threats and supervisory guidance evolve.
OUTPUTOngoing review and change-control plan
The remaining migration scope is complete or carries a documented, owned exception with a scheduled resolution.