"The transition to algorithms resistant to this threat is a long-term undertaking and must therefore be anticipated and initiated now," the French National Cybersecurity Agency (ANSSI) writes, invoking "a context of generally rising threats and a degraded geopolitical situation."
France's ANSSI sets a 2030 operational deadline
France has moved to the front of Europe's post-quantum planning by mandating that ministries deploy post-quantum encryption for systems handling sensitive information by the end of 2030 and afterwards use only encryption products capable of withstanding a quantum onslaught, according to ANSSI's framework. The French plan also requires ministries to inventory "durably sensitive" data that must be prioritized for protection by "the end of this year," and gives ministries until the end of 2027 to choose which technical building blocks to use.
EU coordination, Germany and cross‑European deadlines
European Union member states agreed to a coordinated post‑quantum implementation road map — supported by the European Commission — that includes a 2035 deadline for completing the transition. Germany's Federal Office for Information Security set similar targets in February, recommending that classical asymmetric encryption methods should no longer be used in isolation by the end of 2031 and classical digital-signature algorithms not be used in isolation by the end of 2035. The EU road map also sets a near-term milestone: by the end of this year countries should have started transition planning and pilots for high- and medium-risk use cases.
NIST standards, ML‑KEM (Kyber), HQC and signature choices
France is likely to adopt the algorithms being standardized by the U.S. National Institute of Standards and Technology (NIST). Governments — "with the exception of China" — appear to be converging on the ML‑KEM key‑encapsulation mechanism (also known by its original name, Kyber), which is contained in NIST's FIPS 203 standard and whose development was partly funded by the EU. NIST also selected a backup algorithm called HQC but that algorithm had not yet been included in a standards draft at the time of the report.
On digital signatures, NIST selected ML‑DSA and SLH‑DSA (described in FIPS 204 and FIPS 205 respectively) and FN‑DSA (in progress toward FIPS 206). Germany's Federal Office for Information Security (BIS) advised that ML‑KEM and rival quantum‑ready mechanisms FrodoKEM and Classic McEliece were all suitable for protecting confidential information, and noted that the same recommendation would probably apply to HQC once NIST completes HQC standardization.
Practical migration guidance: hybrids, ETSI standards and timelines
Analysts and standards bodies are pushing for cautious, staged migrations. Juniper Research—via analyst Louis Atkin—said "Sooner is better in principle, but 2035 is still a workable deadline," and warned of "harvest now, decrypt later" schemes as a key risk: "The real risk is that data can be collected now and decrypted later, so organizations with sensitive or long‑lived data don't really have the luxury of waiting." Juniper recommends deploying hybrids of classical cryptographic and post‑quantum algorithms in the near term to reduce the risk that early quantum‑safe algorithms will have unknown vulnerabilities and to limit fallout from early implementation failures.
The European Telecommunications Standards Institute (ETSI) published two transition‑minded standards last year covering quantum‑safe hybrid key establishment and exchange and referenced FIPS 203. The EU road map estimates migration will take between five and 10 years and "highly recommends" that products entering the market with an expected lifetime beyond 2030 be upgradable. Atkin summarized the technical challenge: "You're not just swapping out one tool. You're touching everything from devices and networks to certificates and APIs," and advised organizations to build flexibility into their plans because "some unknowns remain, especially around timelines and which standards will ultimately dominate."
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: expect a complex, systems‑wide migration that will likely proceed in hybrid stages; prioritize inventories to identify "durably sensitive" and long‑lived data now so those assets can meet the earliest protection deadlines.
- Policymakers and regulators: France, Germany and the EU road map set concrete deadlines (end of 2030 for France's sensitive systems; national milestones this year; EU-wide 2035 completion) and will lean on standards such as NIST's FIPS series to harmonize choices across borders.
- Procurement and product teams: the EU road map's recommendation that products with lifetimes past 2030 be upgradable, plus ETSI's hybrid standards, make upgradability and support for hybrid cryptographic stacks procurement priorities going forward.
The European push illustrates a central tension: quantum computers remain experimental, yet migration timelines and the "harvest now, decrypt later" threat make preparation urgent. France's 2030 operational deadline and the EU's 2035 finish line create overlapping timetables that organizations will need to reconcile with technical uncertainty about which standards and algorithms will prevail. The near-term steps — inventories, pilot transitions, hybrid deployments and insistence on upgradability — are concrete moves that, whether adopted this year or next, will determine who is ready if and when large-scale quantum decryption becomes feasible.
https://www.govinfosecurity.com/europe-preps-for-post-quantum-computing-a-31471
