# Do NIS2 or the CRA require post-quantum cryptography?

Not by name, but both point in that direction. NIS2, Directive (EU) 2022/2555, requires covered entities to have policies and procedures on the use of cryptography and, where appropriate, encryption, as part of the cybersecurity risk-management measures in Article 21. The Cyber Resilience Act, Regulation (EU) 2024/2847, requires products with digital elements to protect the confidentiality of data with state-of-the-art mechanisms, among the essential requirements in its Annex I. Neither names an algorithm. The state of the art moves, though: once NIST standards, European agency guidance and the EU roadmap treat hybrid post-quantum key exchange as normal, a product or a policy that ignores it becomes harder to defend in an audit or a tender. The EU roadmap itself presents the post-quantum transition as a no-regret step that supports NIS2 and the CRA. Check your national transposition of NIS2 and any guidance from your national authority, because the details can differ by country.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/do-nis2-or-the-cra-require-post-quantum-cryptography

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [What should a small company do about post-quantum cryptography now?](https://netsenx.com/en/faq/what-should-a-small-company-do-about-pqc-now)
- [How long does a post-quantum migration take?](https://netsenx.com/en/faq/how-long-does-a-post-quantum-migration-take)
- [What do we gain by migrating to post-quantum cryptography?](https://netsenx.com/en/faq/what-do-we-gain-by-migrating-to-post-quantum-cryptography)
- [What can go wrong in a post-quantum migration?](https://netsenx.com/en/faq/what-can-go-wrong-in-a-post-quantum-migration)
- [What is crypto-agility?](https://netsenx.com/en/faq/what-is-crypto-agility)