Every TLS session, signed release and VPN tunnel your platform runs depends on RSA or elliptic-curve cryptography, and a large enough quantum computer will break both. Nobody knows when that machine will exist, but the standards and deadlines already exist: NIST finalized the first post-quantum algorithms in August 2024, and the EU has set end-2030 as the date by which high-risk systems should be migrated. For engineering leaders in regulated Benelux organizations, post-quantum cryptography is now a delivery program with a due date. Below are the questions teams ask most often when it lands on their desk.
Key takeaways
- The post-quantum standards exist: ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures.
- Harvest now, decrypt later means data that must stay confidential for ten years or more is already at risk today.
- The EU roadmap expects high-risk use cases migrated by the end of 2030 and medium-risk ones by the end of 2035, in line with NIST's draft deprecation dates.
- The first move is a cryptographic inventory, ideally in a machine-readable format such as CBOM, followed by a risk assessment.
- Crypto-agility built into your pipelines and platform matters more than any single algorithm choice.
What is post-quantum cryptography?
Post-quantum cryptography (PQC) is public-key cryptography built on mathematical problems that quantum computers are not known to solve efficiently. It runs on today's hardware and replaces RSA, Diffie-Hellman and elliptic-curve schemes such as ECDSA and EdDSA. Symmetric ciphers such as AES are far less affected. In August 2024 NIST published the first three finalized standards (NIST, August 2024):
- ML-KEM (FIPS 203)
- The main standard for general encryption, used to establish shared keys, for example in a TLS handshake. Formerly CRYSTALS-Kyber.
- ML-DSA (FIPS 204)
- The main standard for digital signatures on certificates, code and documents. Formerly CRYSTALS-Dilithium.
- SLH-DSA (FIPS 205)
- A backup signature standard based on a different mathematical approach than ML-DSA, so a weakness in one does not break both. Formerly SPHINCS+.
NIST used the same announcement to urge administrators to start transitioning as soon as possible.
What is "harvest now, decrypt later," and should you worry?
Encrypted traffic recorded today can be stored and decrypted once a capable quantum computer exists, and interception leaves no trace. The EU roadmap therefore classifies a use case as high-risk if compromising its confidentiality after ten years or more would still cause significant damage, and says such data should be protected against quantum attacks no later than the end of 2030 (EU PQC Workstream, June 2025).
The Dutch PQC migration handbook by AIVD, CWI and TNO frames the timing as Mosca's inequality: with X the time data must stay secure, Y the time migration takes and Z the time until quantum computers break public-key cryptography, you must migrate so that X + Y stays below Z (AIVD, CWI and TNO, December 2024). Long-retention customer, payment and health data usually fail that test first.
When do you need to migrate to post-quantum cryptography?
Two timelines matter for European teams. The EU's coordinated roadmap is addressed to Member States, which will push it down to regulated entities and suppliers. NIST's transition report, still an initial public draft, sets the dates that US-facing products and many vendors will follow (NIST IR 8547 ipd, November 2024). They line up closely:
| Date | EU coordinated roadmap | NIST IR 8547 (draft) |
|---|---|---|
| End of 2026 | First steps done, national roadmaps in place, planning and pilots started for high- and medium-risk use cases | No milestone |
| End of 2030 | High-risk use cases migrated; quantum-safe software and firmware upgrades enabled by default | RSA and ECC at 112-bit security, such as RSA-2048, deprecated |
| End of 2035 | Medium-risk use cases migrated; low-risk ones as far as feasible | Quantum-vulnerable RSA, ECDSA, EdDSA and Diffie-Hellman disallowed |
The roadmap also estimates that fully migrating all relevant systems can easily take five to ten years. Read against a 2030 deadline, that means the planning for anything high-risk should already be underway.
How far along is post-quantum adoption?
Further than most teams assume, at least on the public web. Cloudflare's 2025 Radar review measured the share of human-generated web traffic on its network that is post-quantum encrypted in TLS 1.3 (Cloudflare, December 2025):
29%
of that traffic was post-quantum encrypted at the start of 2025
52%
was post-quantum encrypted by early December 2025
25%+
of iOS requests used post-quantum encryption after the iOS 26 release
Browsers and operating systems are moving without you. The gap is on your side: load balancers, service meshes, internal PKI, HSMs, VPNs and libraries pinned in older services.
Should you deploy hybrid or pure post-quantum algorithms?
Hybrid, for now. A hybrid scheme combines a classical and a post-quantum algorithm, so it stays secure as long as either holds, which also hedges against an undiscovered weakness in the young PQC algorithms. The EU roadmap is direct about it:
"When migrating to post-quantum cryptographic solutions, it is recommended to use standardised and tested hybrid solutions, whenever feasible and suitable."
For TLS, that is the hybrid key exchange Apple's 2025 operating system updates began advertising automatically. The roadmap also notes that for high-risk use cases, quantum-vulnerable public-key mechanisms should not be used on their own after the end of 2030.
How do you build a cryptographic inventory?
Both the EU roadmap and the Dutch handbook call the inventory the first "no-regret" move: it pays off even without a quantum threat, because it speeds up incident response and certificate management. A workable sequence:
Start with your critical services
Systems that hold long-lived confidential data or sign what others trust: customer data, payments, PKI, release signing.
Discover cryptography automatically
Scan TLS endpoints, certificates, key stores, code and dependencies. Cryptography hides deep in libraries, where manual surveys miss it.
Record it in a standard format
The EU roadmap recommends CBOM, the cryptographic bill of materials that extends the CycloneDX SBOM standard. If you already produce SBOMs for supply chain security, extend that pipeline.
Map dependencies, including vendors
Note which components you control and which a supplier controls. Where a vendor has no PQC plan, the handbook's advice is blunt: find another supplier or take over the cryptography yourself.
Score the quantum risk
Combine data lifetime, migration effort and exposure, and fold the result into your existing risk management.
What does crypto-agility mean for your platform?
The handbook defines a crypto-agile organization as one that can quickly change or replace cryptographic primitives without disrupting its processes. This migration will not be the last. For a platform team, that comes down to four properties:
Do DORA and NIS2 require post-quantum cryptography?
Neither names PQC. But the EU roadmap draws the line explicitly, and supervisors will read the two together.
State-of-the-art cryptography is already a legal duty
The EU roadmap points out that NIS2 and DORA require entities in scope to adopt risk-management measures that include the use of state-of-the-art cryptography, and that management bodies can be held liable for failing to comply. Once the roadmap's milestones pass, a quantum-vulnerable high-risk system becomes hard to defend as state of the art.
Where to start
Before the end of 2026, aim for an inventory of your critical services, a risk score per use case and one pilot: hybrid TLS on a real endpoint, measured for latency and compatibility. Add a CBOM step to one pipeline and ask your key vendors for their PQC roadmap in writing. None of this requires betting on when quantum computers arrive, only accepting that the deadlines already have.
Sources
- A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography - NIS Cooperation Group, EU PQC Workstream, European Commission, June 23, 2025
- NIST Releases First 3 Finalized Post-Quantum Encryption Standards - NIST, August 13, 2024
- NIST IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography Standards - NIST, November 12, 2024
- Het PQC-migratie handboek: Richtlijnen voor het migreren naar post-quantumcryptografie (tweede editie) - AIVD, CWI and TNO, December 2024
- The 2025 Cloudflare Radar Year in Review: The rise of AI, post-quantum, and record-breaking DDoS attacks - Cloudflare, December 15, 2025
