In January 1977 the U.S. National Bureau of Standards published the Data Encryption Standard as FIPS 46, for federal agencies protecting sensitive unclassified computer data. In 1981 the American National Standards Institute published the same algorithm as ANSI X3.92, the Data Encryption Algorithm standard. Within four years, a cryptographic standard written for government systems also existed as a national private-sector standard. Europe now appears to be considering a purchasing rule for post-quantum cryptography, and the steps that led there are worth reading in order.
Practical takeaway. According to a draft reported on 10 November 2026, the EU Quantum Act would make post-quantum readiness and crypto-agility a default condition for public purchases in designated critical sectors from procurement procedures that start six months after entry into force. The text is unofficial, but the direction matches every EU step since April 2024.
11 April 2024: the Commission Recommendation asks member states for a joint post-quantum roadmap
The first formal step was soft law. The Commission's Recommendation on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, C(2024) 2393, asked member states to develop a common strategy with goals, milestones and timelines. It anticipated deployment in public administration systems and critical infrastructure through hybrid schemes that combine post-quantum algorithms with existing cryptography or with quantum key distribution. It also asked the Commission and member states to set up a work stream on the subject within the NIS Cooperation Group, the body that coordinates national cybersecurity authorities under the NIS2 Directive.
A Commission recommendation is not legally binding. It assigned the work to the NIS Cooperation Group, and that group produced the first common EU dates fourteen months later.
23 June and 2 July 2025: the NIS Cooperation Group sets end-2026 and end-2030, and the Commission adopts the Quantum Europe Strategy
On 23 June 2025 the member states, supported by the Commission, published A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography. The Commission's announcement summarized the two dates that matter: all member states should start transitioning by the end of 2026, and critical infrastructure should move to post-quantum cryptography as soon as possible and no later than the end of 2030.
Nine days later, on 2 July 2025, the Commission adopted the Quantum Europe Strategy, COM(2025) 363, built around five areas: research and innovation, quantum infrastructures, the wider ecosystem and supply chains, space and dual-use technologies, and skills. The Commission's quantum policy page now describes a Quantum Act scheduled for adoption in 2026 with three objectives: research and innovation, industrial capacity including pilot lines and a design facility, and supply-chain resilience and governance.
The roadmap is a non-binding coordination document prepared with national cybersecurity authorities, and its dates are expectations for member states. The strategy is a Commission policy communication about research, industry and supply chains. If the reported draft holds, the Quantum Act would place a post-quantum purchasing condition and industrial supplier rules in one regulation, which would make some of the roadmap's expectations legally binding for public buyers.
12 October 2026: Germany turns the EU dates into a national guideline that treats crypto-agility as a procurement default
Member states began translating the roadmap into national instruments. Germany's guideline from BMI, BMDS and BSI, published on 12 October 2026, asked every organization to finish an initial cryptographic inventory by the end of 2026, set the end of 2030 for high-risk use cases and the end of 2035 for medium-risk ones, and asked that procurement treat crypto-agility as a default requirement. Its deadlines were urgent recommendations. A national guideline applies in one member state; the other twenty-six set their own procurement practice.
10 November 2026: what the draft EU Quantum Act would require of public buyers
The Quantum Insider's report on the draft, published on 10 November 2026 and based on a document it obtained, describes a procurement clause with four parts.
First, for procurement procedures starting six months after the regulation enters into force, purchases of infrastructure, equipment and systems in designated critical sectors would generally have to be post-quantum cryptography-ready and support crypto-agility, meaning the ability to replace cryptographic methods without replacing the system. Second, where suitable products do not yet exist, the purchase would need to support crypto-agility and come with a documented migration plan. Third, limited exceptions for components that cannot support such changes would require a technical and security assessment, compensating protections and deadlines for upgrade or replacement, and cost or supplier preference alone would not justify an exception. Fourth, member states would report their preparedness within six months of entry into force and annually after that, and the Commission could set binding migration milestones if it judged them necessary.
As reported, the clause reaches beyond quantum technology to infrastructure, equipment and systems bought in designated critical sectors. If health care were designated and the clause applied as reported, a regional hospital tendering a new imaging archive after the six-month period would have to ask its bidders whether the system is post-quantum ready and crypto-agile, and the same would hold for water or energy operators if their sectors were covered. The report does not say which sectors the draft designates or how "post-quantum cryptography-ready" would be tested at tender stage, and both answers will decide how much the clause changes in practice.
Who could sell: EU-controlled suppliers, a reciprocity route for partners, and no overall budget
A second set of provisions concerns the quantum market itself. According to the report, participation in designated strategic projects and public procurement of quantum products, systems and services would generally be limited to EU-controlled companies. Where a strategic partnership allows reciprocal participation, the Commission could authorize access for firms from partner countries, subject to safeguards on security, intellectual property and European technological interests. Buyers would also assess security of supply, interoperability and support over a product's operating life. The Commission would monitor supply dependencies, keep a list of critical quantum components and could consider risks from foreign acquisitions.
The industrial targets are concrete. The draft aims at about 100 error-corrected logical qubits per system by 2030 or soon after, interoperable metropolitan quantum networks by 2030 with pilots of up to about 50 kilometres, and an interconnected experimental terrestrial and space EuroQCI network by 2031, moving toward certified operational services during 2031 to 2035. It also lists the progression of selected quantum medical imaging systems toward multi-site clinical validation around 2030 to 2031. It sets no overall spending allocation, and its provision on innovative financing is a placeholder.
The funding gap has a transatlantic counterpart. The Commission on U.S. Quantum Primacy's preliminary report of 10 November 2026, a set of recommendations to Congress, also asked for state and local post-quantum migration assistance without attaching a figure. Neither document specifies a dedicated allocation for these measures.
How Quentir Reads It
If it is adopted, the procurement clause is the provision most likely to change behavior soon. Qubit targets for 2030 depend on physics and funding, while a tender condition would take effect on a fixed schedule once a regulation enters into force. If the six-month period survives, vendors selling into European hospitals, utilities and public networks will need a credible answer on crypto-agility well before the 2030 date in the 2025 roadmap, because their product cycles are longer than the transition window. The documented-migration-plan route is a sensible concession to the state of the market, and the reported refusal of cost or supplier preference alone as a ground for exception removes an easy route around the rule.
The supplier rules carry more legal risk. The EU is a party to the WTO Agreement on Government Procurement, whose Article IV requires nondiscrimination toward goods, services and suppliers of other parties in covered procurement, including locally established suppliers on the basis of foreign ownership, and whose Article III provides security and general exceptions. Compatibility of an "EU-controlled" restriction will depend on whether the purchases fall within the EU's GPA coverage, how the final text defines and applies the restriction, and whether an exception applies. A discretionary reciprocity authorization by the Commission would not by itself settle that question, and how the final text defines an "EU-controlled" company will matter as much as the restriction itself. Partners such as the United Kingdom, Canada, Japan and South Korea will read that definition closely. There is also a practical overlap: the reported text separates the post-quantum clause, which concerns critical-sector purchases generally, from the quantum-supplier restriction, which concerns quantum products. If both provisions covered a purchase of quantum communication equipment for a critical-sector network, its buyers could face both conditions at once.
The German guideline and the U.S. commission report linked above each cover one part of this transition, and Quentir will follow the proposal as it moves through the Commission, the Council and the Parliament. An All-access membership brings that coverage together with every Signature Brief and Signature Report as it publishes, both Evidence Registers and the full archive, under one organization-wide license. The next fixed point is the Commission's own proposal, which its quantum policy page schedules for 2026. The three questions to check on that day are whether the six-month period survives, which sectors the text designates, and how it defines control.
Sources: The Quantum Insider, Matt Swayne, "Draft EU Quantum Act Would Favor European Suppliers, Set Computing and Security Targets", 10 November 2026 (report on an unofficial draft obtained by the publication; the draft itself is not public); European Commission, Recommendation on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, C(2024) 2393, 11 April 2024; NIS Cooperation Group with the European Commission, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, 23 June 2025, and the Commission press release "EU reinforces its cybersecurity with post-quantum cryptography", 23 June 2025; European Commission, Quantum Europe Strategy, COM(2025) 363, 2 July 2025; European Commission, Quantum policy page, section "The EU Quantum Act"; U.S. National Bureau of Standards, FIPS PUB 46, Data Encryption Standard, January 1977, and ANSI X3.92-1981, Data Encryption Algorithm; World Trade Organization, Revised Agreement on Government Procurement, Articles III and IV. Links checked 11 November 2026.
Published intelligence, built to inform your own decisions. Published: November 11, 2026.