# Is post-quantum cryptography a board-level topic?

Yes, as a planning and risk item, not as a crisis. It belongs on the board's agenda for three reasons. It is a long change across the company that touches suppliers, products and budgets over several years, and only management can sequence that. It affects data the company has promised to protect for many years, such as customer, patient or design data. And customers, insurers and public tenders are starting to ask about it, so the answer is becoming a commercial matter. Under NIS2, the management bodies of covered entities must approve and oversee the cybersecurity risk-management measures, and a policy on cryptography is one of them. What the board needs is short: an inventory of where quantum-vulnerable cryptography is used, a priority list based on how long data must stay secret, a named owner, and a timeline aligned with the EU's 2030 and 2035 milestones. It does not need a technical briefing on qubits.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/is-post-quantum-cryptography-a-board-level-topic

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [Does the EU require a post-quantum migration plan?](https://netsenx.com/en/faq/does-the-eu-require-a-post-quantum-migration)
- [What does the EU roadmap ask for by the end of 2026?](https://netsenx.com/en/faq/what-does-the-eu-pqc-roadmap-ask-for-by-2026)
- [Do NIS2 or the CRA require post-quantum cryptography?](https://netsenx.com/en/faq/do-nis2-or-the-cra-require-post-quantum-cryptography)
- [What should a small company do about post-quantum cryptography now?](https://netsenx.com/en/faq/what-should-a-small-company-do-about-pqc-now)
- [How long does a post-quantum migration take?](https://netsenx.com/en/faq/how-long-does-a-post-quantum-migration-take)