The answer, up front
Grid operators face one of the longest migrations in critical infrastructure, driven by equipment that outlasts the cryptography inside it. The European Commission's coordinated roadmap, as analyzed in current reporting, says high-risk systems, notably critical infrastructure, should move to post-quantum cryptography as soon as possible and no later than 2030, with utilities among the priority sectors 1. Because substation equipment can run for 20 to 40 years, devices installed today will still be in service when quantum attacks become feasible, which makes the planning horizon a full decade.
The EU deadline
Analysis of the EU roadmap says Member States should start the transition by the end of 2026 with national strategies, awareness work and cryptographic inventories, and finish the wider transition for as many systems as feasible by 2035 1. That source is secondary analysis rather than the Commission's own text, so treat the dates as reported from the roadmap rather than quoted from it. The direction, though, is consistent across the EU's published materials: inventory and strategy first, high-risk systems by 2030.
What it means in grid terms
A July 2026 piece from a security consultancy translates the deadline into grid specifics, noting that substation equipment lasts 20 to 40 years, that the DNP3 Secure Authentication version 5 protocol relies on RSA and ECDSA, and that change management for relay firmware can add three to six months for high-impact assets 2. The same source estimates full operational-technology migration takes a decade while IT-OT boundary and engineering-workstation upgrades can finish in 12 to 24 months, and it recommends requiring algorithm agility in new device tenders from 2026 2. Those timelines are the author's estimates in a vendor-authored piece, so weigh them as informed opinion.
The OT reality
US operational-technology guidance points the same way. Trade coverage of the DHS and CISA paper lists energy among the OT-dependent sectors and stresses slow patch cycles, decades-old equipment and safety testing that resists rapid updates 3. That coverage summarizes a government document the reporting did not read directly, so it is a secondary account.
What this means for grid operators
The device lifecycle is the planning fact. Operators should inventory where RSA and ECDSA protect substation and control systems, prioritize assets that will still be in service past 2030, and write algorithm agility into procurement now so the next relay or RTU purchase does not lock in cryptography that cannot change.
How ArcQubit approaches it
ArcQubit treats discovery as the first move, because a decade-long migration needs an accurate map before it starts. QuCode builds the cryptographic inventory across grid OT and IT, and QuTrust holds the prioritized plan so the longest-lived assets move first and procurement carries agility requirements forward.