EU certification group ECCG adds post-quantum cryptography
6 MAY 2025, BRUSSELS
The European Cybersecurity Certification Group, ECCG, is adding post-quantum cryptography to its Agreed Cryptographic Mechanisms. It published version 2.0 on 6 May 2025 and put a version 3 draft out for public review ending in July 2026. The work extends the mechanisms that products may use to achieve certification in the European Union toward post-quantum options.
Certification is the lever here. The scheme defines which cryptographic mechanisms a product may use to earn certification, so adding post-quantum options lets vendors certify quantum-resistant products. Without approved mechanisms, a vendor cannot certify a post-quantum product, which would hold back trusted procurement across the single market.
The version 3 draft stayed in public review through the end of July 2026, and the final text follows once the ECCG addresses the comments. Vendors should track the ECCG process to learn which post-quantum mechanisms the scheme will approve, because that list determines what they can build into certified products. The timing links product certification to the European Union's broader migration milestones.
Why it matters. The ECCG's work turns post-quantum cryptography into something vendors can certify, which is a quiet but necessary step for the European market. Approved mechanisms let certified products carry quantum-resistant cryptography, aligning procurement with the European Union's migration goals. Vendors planning certified products should follow the version 3 review so their roadmaps match the mechanisms the scheme will approve.