Twenty-one European agencies renew their joint post-quantum statement
1 JULY 2025, BRUSSELS
Twenty-one European agencies, including Norway, renewed a joint post-quantum statement on 1 July 2025. The statement urges organizations to treat post-quantum planning as core risk management rather than a specialist side issue. It builds on a 2024 statement signed by eighteen agencies, so the renewal widens the group of signatories by three.
The content carries forward a consistent message. The agencies urge organizations to adopt hybrid schemes and to protect sensitive data against store-now-decrypt-later attacks by the end of 2030. Framing migration as risk management rather than a technical project pushes it onto the agenda of boards and risk committees, not just cryptographers.
The growth from eighteen to twenty-one signatories matters as a signal. A broader coalition of national agencies agreeing on the same message strengthens the European consensus and makes it harder for an organization to treat post-quantum readiness as an open question. The addition of Norway extends that consensus beyond the European Union itself.
Why it matters. The renewed statement shows European cybersecurity agencies converging on a single message: start now, use hybrids, and protect long-lived sensitive data against store-now-decrypt-later by the end of 2030. The widening group of signatories gives that message more weight. Organizations across Europe can read it as a clear expectation to fold post-quantum planning into their standard risk management without waiting for binding rules.