Post-Quantum Cryptography in Europe: What the EU Roadmap Means for You

Photo: Ragsxl / Wikimedia Commons, CC BY-SA 4.0

Most people in Europe will never touch a quantum computer. Yet the encryption protecting your online banking, private messages and many government services is already being rebuilt with such machines in mind. The new building blocks are called post-quantum cryptography (PQC), and the European Union now has a shared timetable for switching to them.

This week's Quantum Computing series post explains what PQC is, why experts worry about data being "harvested" today, what the EU's migration roadmap says, and where you may already use quantum-resistant encryption.

Important disclaimer

This article is general education about technology and policy. It is not financial, investment, legal or security advice and does not replace guidance from your bank, your employer's IT team or a qualified security professional. Quantum timelines are uncertain and official documents get updated, so check the primary sources linked below.

What is post-quantum cryptography?

Today's internet relies heavily on public-key cryptography, such as RSA and elliptic-curve algorithms. It lets two devices agree on a secret key and lets you check that a message or software update really comes from its claimed sender. In 1994, Peter Shor described quantum algorithms that could break many of these schemes on a sufficiently powerful quantum computer. According to the EU's roadmap, there is currently no evidence that this is already possible.

Post-quantum cryptography is the response. Despite the name, PQC does not need a quantum computer: it is ordinary software for today's phones, laptops and servers, based on mathematical problems believed to be hard even for quantum computers. Symmetric encryption such as AES is much less affected; Apple notes it only needs longer keys.

Why "harvest now, decrypt later" matters

Why hurry? Because data can be stolen now and read later. The European Commission warns that "store now, decrypt later" attacks are already likely happening: attackers record encrypted traffic today, hoping to decrypt it once a capable quantum computer exists.

This matters most for information that must stay secret for years, such as health records or trade secrets. The EU roadmap treats a use case as high-risk if a confidentiality breach 10 or more years from now would still cause significant damage. It also cites a study for Germany's Federal Office for Information Security (BSI): a quantum computer able to break today's public-key encryption is likely feasible within a maximum of 16 years (by 2040 or earlier), possibly within 10 if current progress is confirmed.

The new standards: NIST's post-quantum algorithms

The best-known PQC standards come from the US National Institute of Standards and Technology (NIST), which has run a public selection process since 2016:

• FIPS 203 – ML-KEM (derived from CRYSTALS-Kyber): for key establishment, meaning two parties agree on a secret key to encrypt data. Published on 13 August 2024.
• FIPS 204 – ML-DSA (derived from CRYSTALS-Dilithium): digital signatures, which prove who sent something. Published on 13 August 2024.
• FIPS 205 – SLH-DSA (derived from SPHINCS+): a hash-based signature scheme built on different maths. Published on 13 August 2024.
• FN-DSA (based on Falcon): another signature scheme, planned as FIPS 206. NIST still lists it as "in development".
• HQC: selected on 11 March 2025 as a backup to ML-KEM. Its different maths could matter if a weakness were found in ML-KEM. In its announcement, NIST planned a draft standard about a year later and a final standard in 2027.

The EU roadmap: what it says and when

In April 2024, the European Commission published a Recommendation asking Member States to coordinate their move to PQC. A work stream of the NIS Cooperation Group, co-chaired by Germany, France and the Netherlands, then developed the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography. EU Member States, supported by the Commission, adopted it in June 2025. Its timeline:

Deadline	What should be achieved
By 31 December 2026	All Member States have implemented at least the "First Steps" (such as identifying stakeholders, mapping dependencies and analysing quantum risk), set up initial national PQC roadmaps and started planning and pilots for high- and medium-risk use cases.
By 31 December 2030	The transition for high-risk use cases is complete, planning and pilots for medium-risk use cases are complete, and quantum-safe software and firmware upgrades are enabled by default.
By 31 December 2035	The transition for medium-risk use cases is complete, and low-risk use cases have been moved as far as feasible.

Two details matter. First, the roadmap recommends standardised and tested hybrid solutions "whenever feasible and suitable". Hybrid means combining a classical algorithm with a post-quantum one, so the result is as strong as the stronger of the two. Second, the roadmap notes that NIST and the UK's National Cyber Security Centre also target 2035.

The roadmap consists of recommendations for Member States, public administrations and critical infrastructure, including organisations covered by the NIS2 Directive. Private individuals do not have to "comply" with anything; for you, the change will mostly arrive quietly through software updates.

Where you already meet PQC

• Your browser. Google Chrome first used a hybrid key exchange combining the classical X25519 algorithm with Kyber, and from Chrome 131 switched to the standardised hybrid of ML-KEM768 and X25519. When a website supports it too, that HTTPS connection's key exchange is protected against harvest-now-decrypt-later attacks.
• Signal. In September 2023, Signal introduced PQXDH, adding CRYSTALS-Kyber to how new chats agree on keys. On 2 October 2025, it announced the Sparse Post-Quantum Ratchet (SPQR), which keeps mixing fresh ML-KEM-based secrets into ongoing conversations; together with the existing Double Ratchet, Signal calls this the "Triple Ratchet".
• Apple iMessage. In February 2024, Apple announced PQ3, rolling out with iOS 17.4, iPadOS 17.4, macOS 14.4 and watchOS 10.4. It combines Kyber (ML-KEM) with elliptic-curve cryptography, both when a conversation starts and when keys are refreshed periodically.

All three use the hybrid approach the EU recommends. Apple notes that iMessage still authenticates senders with classical algorithms, because impersonation would require a working quantum computer at the time of the conversation, not years later.

What about Bitcoin and crypto?

Bitcoin's transaction signatures use elliptic-curve cryptography, which is not post-quantum. For Bitcoin, the main concern is less about secret data being decrypted later and more about signatures being forged by a future quantum computer. We explained which coins are exposed and what developers are proposing in our earlier post, Will Quantum Computers Break Bitcoin?.

The EU roadmap is about upgrading public systems over many years, not a signal to buy or sell any crypto asset. Be wary of anyone who name-drops it or the NIST standards to sell a "quantum-proof" coin, token or wallet upgrade.

Practical steps for beginners in Europe

1. Keep your browser, operating system and messaging apps updated. That is how PQC reaches you; Signal's and Apple's upgrades arrive with app and system updates.
2. Replace devices that no longer get security updates. The roadmap wants quantum-safe upgrades enabled by default by 2030, but that only helps devices that still receive updates.
3. Ignore "quantum-proof" marketing. A label is not a standard. Ask which algorithm is used (for example ML-KEM or ML-DSA) and whether it has been independently reviewed. Never share a seed phrase, password or recovery code with anyone offering a "quantum upgrade".
4. Think long-term about very sensitive files. If documents must stay private for ten years or more, check how they are stored and follow guidance from agencies such as the BSI.
5. If you work in IT, ask about a cryptographic inventory. Knowing where cryptography is used is part of the roadmap's First Steps and a "no-regret" move.

Bottom line

Post-quantum cryptography is already here. The first NIST standards were published in 2024, and the EU has a clear timetable: national plans and pilots by the end of 2026, high-risk systems by 2030, and as much as feasible by 2035. Your browser and messengers may already use it. For beginners, the best response is simple: keep software updated, retire unsupported devices, and treat "quantum-proof" sales pitches with healthy scepticism.

Sources

• European Commission: Post-Quantum Cryptography policy page (EU roadmap overview)
• NIS Cooperation Group: A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (June 2025)
• NIST CSRC: Post-Quantum Cryptography standardization (FIPS 203–206, HQC)
• Google Security Blog: A new path for Kyber on the web (Chrome and ML-KEM)
• Signal: Signal Protocol and Post-Quantum Ratchets (SPQR)

Advice Me publishes general information only. It is not financial, investment, legal, or tax advice. Always do your own research and consult a qualified professional before making financial decisions.