The EU Just Released a New Post-Quantum Cryptography (PQC) Roadmap: Here’s What You Need to Know

On June 23, 2025, The EU released a new PQC implementation roadmap with clear steps and timelines for all Member States, laying the groundwork for a smooth and coordinated transition to post-quantum cryptography.

Imagine knowing a storm is coming but not precisely when, how strong, or where it will hit first. That’s where cybersecurity stands today with quantum computing. The threat is real, the timeline unclear, and organizations everywhere are looking for direction.

Now, the EU has stepped in with a first high-level implementation roadmap to guide the transition to post-quantum cryptography (PQC).

Developed by the NIS Cooperation Group’s PQC workstream, this roadmap provides long-awaited clarity on what Member States need to do and when to ensure PQC readiness. With clear timelines, actionable steps, and a push for coordinated progress, the EU aims to get all Member States to a minimum baseline readiness by the end of 2026.

Here’s a closer look at what the roadmap includes and why it matters.

What the Roadmap Covers (In a Nutshell)

1. A phased transition timeline for PQC with key milestones in 2026, 2030, and 2035
2. A list of concrete measures divided into First Steps and Next Steps every Member State should take to achieve national readiness

The Phased PQC Transition Timeline – A Quick Breakdown

The EU roadmap breaks the massive PQC transition into three manageable phases with clear priorities:

• By the end of 2026: Every Member State should have a national PQC strategy in place. First Steps should be initiated, and pilots launched for high- and medium-risk use cases.
• By the end of 2030: High-risk use cases must be fully migrated to PQC. Quantum-safe software and firmware upgrades should be enabled by default.
• By the end of 2035: The transition should be complete for as many medium- and low-risk systems as possible.

To ease the transition, the EU recommends starting with hybrid cryptographic solutions that combine classical and quantum-safe algorithms whenever feasible.

Importantly, this phased timeline is designed to align with guidance and timelines set by other International bodies, such as NIST (US) and NCSC (UK). This global alignment is crucial, especially for organizations with cross-border operations or customers.

First Steps and Next Steps: Turning Strategy into Action

The EU wisely divides action into First Steps and Next Steps. This makes real progress feel achievable.

First Steps (By 2026):

The roadmap doesn’t assume you’re ready. Instead, it recommends foundational first steps like:

• Identify and involve stakeholders
• Support mature cryptographic asset management
• Create dependency maps
• Perform quantum risk analysis
• Include the supply chain
• Create a national awareness and communication program
• Share knowledge and get involved with the NIS CG workstream on PQC
• Develop a timeline and an implementation plan

Next Steps (By 2030):

Once the groundwork is in place, the roadmap suggests moving with next steps to ensure the transition is not just planned but also actionable.

• Support cryptographic agility and a quantum-safe upgrade path
• Allocate resources for the transition
• Adapt certification schemes
• Evolve the rules
• Look for opportunities within the ecosystem
• Considering transversal activities throughout the creation and implementation of the roadmap
• Implement pilot use cases and contribute to testing centers

Assessing Quantum Risk: High, Medium, and Low

The roadmap offers a simple framework to assess quantum risk by classifying use cases as high, medium, or low based on how vulnerable existing cryptography is, the consequences of a potential compromise, and how complex migration would be.

High-risk systems (like those safeguarding long-term sensitive data) must be migrated by 2030. Medium-risk systems get until 2035. After those dates, the roadmap mandates that quantum-vulnerable algorithms should no longer be used independently.

How AppViewX Supports Every Step of PQC Readiness and Transition

AppViewX fully supports the EU’s commitment to a structured PQC transition. PQC isn’t just another cryptographic update; it is the biggest cryptographic transition in decades, one that demands time, effort, and meticulous planning. AppViewX is ready to help organizations accelerate their PQC readiness journeys with the right solutions.

How AppViewX Solutions Support PQC Readiness

Start with Cryptographic Discovery, Inventory, and Visibility

One of the first calls to action in the roadmap is building a mature cryptographic asset inventory. In other words, a comprehensive inventory of all cryptographic assets in your environment—certificates, keys, algorithms, configuration files, and their dependencies across devices, applications, workloads, and pipelines. This forms the foundation for everything that follows: dependency mapping, quantum risk analysis, and migration planning (other key aspects explicitly called out in the first steps).

The AppViewX PQC Assessment is built for this. It:

• Scans your hybrid and multi-cloud infrastructures and CI/CD pipelines to identify every instance of quantum-vulnerable algorithms within codebases, configurations, dependencies, and certificates.
• Generates a Cryptographic Bill of Materials (CBOM)
• Scores your PQC readiness
• Recommends clear remediation steps

Learn more about the AppViewX AVX ONE PQC Assessment

“Member States should promote and support that useful cryptographic inventories are being created and maintained. Generating and maintaining cryptographic inventories can be aided by tools (discovery and asset management tools). Using a standardised format for a cryptographic inventory, like CBOM Cryptographic Bill of Materials, an extension of the SBOM standard), is recommended.”

Build Crypto-Agility Into Your CLM Strategy

Another standout recommendation from the EU is cryptographic agility, the ability to quickly and safely replace cryptographic algorithms across systems without disruption.

AVX ONE CLM, our advanced certificate lifecycle management (CLM) solution, enables crypto-agility with:

• Complete Visibility: Automated discovery and inventory of your cryptographic ecosystem, helping you prioritize PQC migration efforts.
• End-to-end Lifecycle Automation: Advanced automation workflows to streamline certificate lifecycle operations and even the most complex cryptographic transitions.
• Continuous Policy Control: Zero-touch policies that ensure strict PKI compliance, automatically enforcing PQC (or strong) algorithms without deviations.

Learn more about how AVX ONE CLM enables Crypto-Agility

Get a PQC-Ready PKI

AVX ONE PKIaaS is a modern, agile, and secure PKI-as-a-Service with full support for NIST-standardized PQC algorithms—ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and Falcon. You can seamlessly issue PQC-enabled certificates for internal use cases. AVX ONE PKIaaS also integrates with AVX ONE CLM for discovery, issuance, and lifecycle automation of legacy, hybrid, and PQC-ready certificates—at scale and speed.

Learn more about AVX ONE PKIaaS

Test PQC Adoption in Real Environments

Want to test quantum-safe certificates before rolling them out? The AppViewX PQC Test Center is a dedicated free online resource to assess your organization’s PQC readiness by generating and testing quantum-safe private trust certificates before their integration into existing systems, workloads, and machines. Quickly set up your own quantum-safe PKI hierarchy and generate PQC-ready certificates and keys to test their compatibility in your environment.

Try AppViewX PQC Test Center

The Transition to PQC Doesn’t Start Later. It Starts Now.

The EU’s roadmap brings structure and momentum to a transition that has long felt like a moving target for many organizations. And that’s just the beginning.

Quantum threats are closing in. PQC algorithms are finalized, timelines are locked in, and the ecosystem is moving fast. If your organization operates in the EU or works with those who do, now is the time to act.

The next decade will define how resilient your cryptographic infrastructure really is. With the roadmap in hand and the right tools at your side, you can make that transition confidently.

To get started on your PQC readiness journey, talk to an expert at AppViewX today.