PQC migration timelines: US federal government vs the EU

The short version

The United States and the European Union have landed on remarkably similar end dates for post-quantum cryptography: critical systems migrated around 2030, and quantum-vulnerable public-key algorithms retired by about 2035. What differs is the mechanism. The US drives migration through federal mandates, procurement rules, and NSA requirements for national security systems. The EU works through a coordinated roadmap that member states adopt, with sector regulation such as NIS2 and DORA doing the enforcement.

For organisations selling into either market, or both, the practical message is the same: inventory now, prioritise long-lived data, and plan to be largely finished within the decade.

United States: mandate and procurement

The US framework rests on National Security Memorandum 10 (2022), which set the national goal of mitigating quantum risk by 2035, and the Quantum Computing Cybersecurity Preparedness Act, which requires federal agencies to inventory and plan migration of their cryptographic systems. OMB memorandum M-23-02 turned that into a recurring obligation: agencies submit annual inventories of quantum-vulnerable cryptography.

NIST published the first finalised standards in August 2024: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. NIST's transition guidance proposes deprecating today's RSA and elliptic-curve algorithms at common security levels by 2030 and disallowing them entirely by 2035.

For national security systems, NSA's CNSA 2.0 suite is stricter and more granular. Software and firmware signing, and networking equipment, are expected to prefer quantum-resistant algorithms now and use them exclusively by 2030. Web browsers, servers, and cloud services follow by 2033, with all national security systems quantum-resistant by 2035. Vendors in the defence supply chain feel this first, because the requirement arrives through contracts.

European Union: coordinated roadmap

The European Commission's April 2024 Recommendation asked member states to build a coordinated implementation roadmap rather than act alone. The NIS Cooperation Group delivered it in 2025, with three milestones. By the end of 2026, every member state should have started its transition: national strategies in place, cryptographic inventories under way, and awareness raised with industry. By 2030, high-risk use cases and critical infrastructure should be migrated. By 2035, the transition should be complete for as many systems as is feasible.

The EU roadmap is not itself a regulation, but it does not need to be. NIS2 already requires essential and important entities to apply state-of-the-art cryptography, and DORA imposes similar expectations on financial entities. As national authorities publish guidance, post-quantum readiness becomes part of what 'state of the art' means in a supervisory review.

There are also technical nuances. Several European agencies, notably Germany's BSI and France's ANSSI, recommend hybrid schemes that combine classical and post-quantum algorithms during the transition, where US guidance is more willing to move straight to the NIST algorithms.

Side by side

Start now: the US requires annual federal inventories already; the EU expects every member state to have begun by the end of 2026.

Around 2030: the US deprecates classical public-key algorithms and requires CNSA 2.0 for signing and networking in national security systems; the EU targets migration of high-risk use cases and critical infrastructure.

Around 2035: the US disallows quantum-vulnerable algorithms and completes national security systems; the EU aims for full transition wherever feasible.

Enforcement: the US relies on federal mandates and procurement; the EU relies on member state adoption plus NIS2, DORA, and sector regulators.

What this means for you

If you supply the US federal government or defence sector, the procurement route means deadlines can reach you before they reach agencies themselves. Expect questions about cryptographic inventories and CNSA 2.0 alignment in bids.

If you operate in the EU, watch your national authority and sector regulator. A NIS2 or DORA audit is the most likely place a post-quantum gap will first be raised.

Either way, the first steps are identical and they map cleanly onto an ISO 27001 ISMS: a cryptographic asset inventory, a risk assessment weighted by how long data must stay confidential, and a crypto-agility plan for the systems you cannot replace quickly. That is work you can start this quarter, and it is the evidence both regimes will ask to see.