Do NIS2 or the CRA require post-quantum cryptography?

Not by name, but both point in that direction. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., Directive (EU) 2022/2555, requires covered entities to have policies and procedures on the use of cryptography and, where appropriate, encryption, as part of the cybersecurity risk-management measures in Article 21. The Cyber Resilience Act, Regulation (EU) 2024/2847, requires products with digital elements to protect the confidentiality of data with state-of-the-art mechanisms, among the essential requirements in its Annex I. Neither names an algorithm. The state of the art moves, though: once NIST standards, European agency guidance and the EU roadmap treat hybrid post-quantum key exchange as normal, a product or a policy that ignores it becomes harder to defend in an audit or a tender. The EU roadmap itself presents the post-quantum transition as a no-regret step that supports NIS2 and the CRA. Check your national transposition of NIS2 and any guidance from your national authority, because the details can differ by country.

← All 33 questions on Post-quantum cryptographyAll topics