What does the EU roadmap ask for by the end of 2026?
That the transition has started everywhere. The coordinated roadmap published by the NIS Cooperation Group on 23 June 2025, following Commission Recommendation (EU) 2024/1101, sets three steps: first steps by the end of 2026, high-risk use cases moved by the end of 2030, and as many systems as feasible by 2035. The first step is about preparation: Member States set out national transition plans, organisations begin inventories of where they use quantum-vulnerable cryptography, and the risk of each use is assessed so that high-risk cases can be piloted early. The roadmap is addressed to Member States and their public and critical sectors, not directly to your company, and national authorities will translate it into their own guidance. Still, its logic applies to any organisation: by the end of 2026, know where your cryptography is, who owns each system, and which ones must move first. Check what your national cybersecurity authority publishes.
This answer is part of the guide: Post-quantum readiness: where to start