Post-Quantum Requirements in the European Union

EU member states agreed a coordinated post-quantum roadmap in June 2025. Each member state is to start its transition and publish a national plan by the end of 2026. The roadmap sets the end of 2030 as the migration deadline for high-risk use cases and the end of 2035 for medium-risk ones.

EU law already applies to cryptography. Under DORA’s technical standards, financial entities must plan to update their cryptography as cryptanalysis develops, and the recitals name quantum advances. NIS2 requires essential and important entities to have policies on cryptography. The Cyber Resilience Act sets security requirements for products from December 2027. In this course, we cover each instrument, the dates Germany’s BSI and France’s ANSSI add, and the evidence supervisors will ask for.

Course Outline

Module 1. What Regulators Everywhere Ask For (30 minutes)

Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and the cryptographic mechanisms agreed for EU certification. We also compare the EU dates with those in the United States, the UK and Switzerland.

Module 2. EU Requirements in Detail (60 minutes)

We work through the Commission’s 2024 Recommendation and the NIS Cooperation Group roadmap. That covers the 2026 first steps, the 2030 and 2035 milestones, and how the roadmap defines high-risk and medium-risk use cases. We cover DORA’s rules on encryption policy and key management, the NIS2 cryptography measures and the Cyber Resilience Act’s requirements for products. The Commission has also proposed amending NIS2 to write the transition into national strategies. At national level, we cover Germany’s TR-02102-1 dates, France’s announced 2027 requirement for qualified products, the Dutch 2035 target and the 2024 joint statement by 18 member states.

Module 3. Demonstrating Compliance in the EU (30 minutes)

We cover what supervisors and national authorities will ask to see. That includes the encryption policy DORA requires, the cryptographic inventory, the risk classification of use cases and the migration roadmap. It also includes supplier commitments under DORA’s third-party rules and NIS2’s supply chain measures, and progress reports. You map the work to ISO/IEC 27001, DORA’s ICT risk framework and NIS2 audits, and learn to brief your management body.

Prerequisites

None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.

Who this course is for

Compliance officers, CISOs, DORA and NIS2 program leads, risk managers, legal counsel and migration program managers. They work at banks, insurers, market infrastructure, energy, health, transport and digital infrastructure operators, public administrations, and companies selling products under the Cyber Resilience Act.

What you’ll be able to do afterward

• Explain what the coordinated roadmap, DORA, NIS2 and the Cyber Resilience Act require of your organization
• Classify your use cases as high, medium or low risk in the roadmap’s terms
• Apply the national dates set by Germany, France and other member states where you operate
• Write or update the encryption policy DORA requires
• Assemble the evidence supervisors and auditors will ask for
• Brief your management body on obligations and progress

What you leave with

When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the EU and national instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.

Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

Where this course fits

You can take this course on its own. If you also operate outside the EU, add PQC Compliance: Global Overview. Banks and insurers should continue with Quantum-Safe Financial Services. In PQC for GRC Professionals, you map the requirements into controls and audit evidence.

Why we teach this

We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each EU and national instrument as authorities issue it. We revise the course when a regulator issues or changes a rule.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.