Germany wants organizations to start preparing for quantum-era cybersecurity threats before 2026 ends, even though its new post-quantum cryptography deadlines are not yet universally binding.
The Federal Ministry of the Interior (BMI), the Federal Ministry for Digital Affairs and State Modernization (BMDS), and the Federal Office for Information Security (BSI) jointly issued the guideline, which applies the EU’s roadmap for post-quantum cryptography (PQC) to Germany.
High-risk systems should be migrated by the end of 2030 at the latest, and the overall transition should be largely complete by 2035, according to the BSI.
The guideline addresses federal, state, and municipal administrations, along with companies and critical infrastructure operators. Its dates are recommendations, but the document also points to existing law that could give them weight.
Germany’s timeline matches the EU and tracks the US
| Milestone | Germany | US federal agencies |
| First steps | End of 2026: first inventory, owners named, migration started | Oct. 22, 2026: migration plans due to OMB |
| High-risk systems | Migrated by end of 2030 | Key establishment by Dec. 31, 2030; signatures by Dec. 31, 2031 |
| Broad transition | Largely complete by 2035 | Phased schedule through 2035 |
| Legal status | Urgent recommendations; binding adoption requested by end of 2026 | Binding on civilian agencies |
Source: BMI, BMDS, and BSI guideline, Oct. 12, 2026; Executive Order 14412 and OMB memorandum M-26-15.
For multinational organizations, the overlapping 2030 and 2035 milestones could simplify long-term planning. However, the German and US frameworks cover different systems and organizations, so compliance requirements cannot be treated as interchangeable.
What the guideline asks organizations to do first
The first phase centers on planning and visibility:
- Ownership: Name a responsible office and set binding internal deadlines for the transition.
- Inventory: Build a first cryptographic inventory, modeled on the crypto register in the BSI’s IT-Grundschutz requirement CON.1.A19.
- Risk: Add quantum risk to the regular risk register and rank use cases by risk level.
- Suppliers: Involve manufacturers and supply chains early, and design procurement for crypto-agility.
The BSI recommends hybrid schemes that pair a classical algorithm with a post-quantum one. Its press release also cites AI as a reason for crypto-agility, saying AI is speeding up research into attacks on cryptographic methods.
What eWeek found: a soft guideline with hard law behind it
The most consequential detail may not be a date. The guideline calls its deadlines urgent recommendations, but it ties cryptography to Section 30 of the BSI Act, which implements the EU’s NIS2 directive. That section requires covered entities to meet the state of the art in their security measures, including cryptographic processes.
The guideline places post-quantum cryptography under that state-of-the-art heading. It stops short of saying a system without PQC already falls below the standard, according to analyses of the document by PostQuantum.com and Quentir. Regulators and auditors reviewing a future incident could still use the guideline as a reference point.
Binding force for state and local governments depends on a separate step. The guideline asks the IT-Planungsrat, Germany’s federal-state IT planning council, and UP KRITIS, the critical infrastructure partnership, to adopt its dates as binding by the end of 2026.
The inventory deadline is the near-term test. US experience suggests it is harder than it looks: the GAO audit of 24 federal agencies found that only one had fully addressed its inventory of priority systems.
Germany's roadmap makes one thing clear: the transition to post-quantum cryptography is no longer only a distant technical concern. Even where deadlines remain advisory, organizations are being encouraged to prepare now rather than wait for future compliance requirements.
Other news: ORCA Computing has deployed its PT-3 photonic quantum computer alongside Nvidia GPUs at Digital Realty's London data center.