Commission proposes writing post-quantum migration into NIS2
20 JANUARY 2026, BRUSSELS
The European Commission proposed on 20 January 2026, in COM(2026) 13 final, to write the post-quantum transition into NIS2. The proposal would amend the directive so that the national strategies required under Article 7(2)(k) explicitly cover the move to post-quantum cryptography. It sets a 2030 target for critical systems and 2035 for medium-risk systems, matching the risk-based staging the EU roadmap already uses.
The step matters because of its legal weight. The EU roadmap is soft law that sets direction, while NIS2 is a binding directive. Writing the transition into NIS2 would oblige member states to reflect post-quantum migration in the national strategies the directive already requires, turning the roadmap's milestones into a legal expectation rather than a recommendation.
The proposal remains pending. It must pass the EU legislative process before it binds anyone, and member states would then transpose it into national law. Until that happens, the dates carry the Commission's intent rather than legal force, so organizations should track the proposal's progress rather than treat its deadlines as fixed.
Why it matters. The proposal signals that the European Union intends to give its post-quantum timeline legal teeth through NIS2 rather than leaving it as guidance. If it passes, critical-system operators across the Union would face a 2030 expectation grounded in a binding directive. Organizations in scope of NIS2 should watch the proposal closely and begin discovery now, since the directive route would narrow their room to delay.