Three Authorities, Three Calendars
On 12 October the Federal Ministry of the Interior (BMI), the Federal Ministry for Digital Affairs and State Modernisation (BMDS) and the Federal Office for Information Security (BSI) published a guideline for putting the EU post-quantum roadmap into practice in Germany. It confirms the European timelines and adds a date for the whole transition.
| Authority | Start | High-risk systems | Everything else |
|---|---|---|---|
| EU roadmap (June 2025) | every Member State starts by the end of 2026 | as soon as possible, no later than the end of 2030 | not stated on the Commission page |
| German guideline (12 October 2026) | as early as possible for high-risk use | migration complete by the end of 2030 at the latest | largely complete by 2035 |
| UK NCSC | by 2028: goals, full discovery, initial plan | by 2031: early highest-priority migration | complete by 2035 |
The German text is a guideline, not a statute. The BSI release presents it as a framework for a coordinated transition and mentions no penalties.
What Germany Asks Organisations To Do
The guideline addresses federal, state and local government and organisations and companies, including operators of critical infrastructure. The BSI lists five measures: clear responsibilities and binding deadlines inside the organisation, treating post-quantum cryptography as state of the art, assessing quantum risk systematically within risk management, involving manufacturers and supply chains early and building in crypto-agility.
Crypto-agility means designing systems, procurement and risk management so that cryptographic methods, or settings such as key lengths, can be replaced quickly and in a controlled way. The BSI says it matters more because AI is speeding up security research and, increasingly, methods for attacking cryptography.
Discovery Is The First Dated Step
The UK is the most specific about the first job. By 2028 the NCSC wants goals, a full discovery exercise and an initial plan that names priority activities, supplier and infrastructure dependencies, required investment and any long-lived hardware roots of trust. It asks organisations to map the cryptography, protocols and hardware they depend on, and says this is not meant to be a formal asset register.
Discovery should also record how long each piece of data must stay secret and what it is worth to an adversary. That matters because the Commission says 'store now, decrypt later' attacks are already likely occurring, and that data which must stay confidential for a long time may already be at risk.
The NCSC aims mainly at large organisations, operators of critical national infrastructure and companies with bespoke IT. It expects smaller firms on mainly commodity IT to see a more straightforward migration, largely handled by vendor updates, while custom software follows the same timetable as everyone else's.
A Short List For This Quarter
Start with a list of where your organisation uses public-key cryptography, such as certificates, VPN tunnels and signed firmware, and name one person who owns it. Put a date on it, because the German guideline asks for binding deadlines and the UK asks for discovery by 2028.
Then ask your suppliers for their post-quantum roadmaps, since the BSI wants manufacturers and supply chains involved early, and check whether your systems let you swap algorithms or key lengths without a rebuild. Rank the data that must stay secret longest first.
Read next: 2014 Bugs Still Open Doors For A Chinese Contractor | Iranian Spyware Disguised Itself as Norton Antivirus
