EU roadmap sets 2026, 2030 and 2035 migration milestones
11 JUNE 2025, BRUSSELS
The European Union's post-quantum roadmap, published on 11 June 2025, sets three dated milestones. Member states should start national strategies by the end of 2026, migrate high-risk use cases by the end of 2030, and migrate medium-risk use cases by the end of 2035. Germany, France and the Netherlands co-chaired the work under the NIS Cooperation Group, so the roadmap reflects a coordinated European position.
Staging the work by risk lets member states tackle the most exposed systems first. High-risk use cases, where a breach would cause the greatest harm or where data must stay confidential for many years, carry the earlier 2030 date. Medium-risk systems follow by 2035, matching the horizon several other jurisdictions use.
The roadmap also references the Cyber Resilience Act's December 2027 upgradability date for vendors. That date requires products to support security updates, which matters for post-quantum migration because a system that cannot be updated cannot receive new algorithms. The roadmap therefore ties the migration timeline to the ability to deliver the new cryptography through updates.
Why it matters. The roadmap converts the Commission's earlier soft-law recommendation into dated milestones that member states can plan against. The 2026, 2030 and 2035 sequence gives organizations in Europe a clear risk-based schedule, and the link to the Cyber Resilience Act's 2027 upgradability date reminds vendors that updatable products are a precondition for migration. Starting discovery now leaves room to meet the 2030 high-risk target.