Germany's Post-Quantum Guideline From BMI, BMDS and BSI, Published 12 October 2026: Crypto Inventories by End-2026, High-Risk Systems by 2030, and the Legal Weight of BSI Act Section 30
On 1 January 2002 the euro arrived in German wallets. The date had been fixed at European level years earlier, but the work of the changeover happened locally: every cash register, ticket machine, banking system and price label in the country had to be converted by someone with a budget and a deadline. A common European date only becomes real when a national administration translates it into tasks for the people who own the machines.
Post-quantum cryptography has now reached that stage in Germany. On 12 October 2026 the Federal Ministry of the Interior (BMI), the Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) published a joint guideline on the national implementation of the EU roadmap for the transition to post-quantum cryptography, announced in a BSI press release from Bonn. The PDF carries the date 11 September 2026 on its cover and "August 2026" in its imprint. It is short, ten pages, and most of its weight sits in its dates. Read in order, those dates show which steps are advice and where German law already applies.
Practical takeaway. The German guideline asks every organization in its scope, from federal ministries to municipal IT departments and critical-infrastructure operators, to finish an initial cryptographic inventory and its PQC planning by the end of 2026, to migrate high-risk use cases by the end of 2030 and medium-risk use cases by the end of 2035. The dates themselves are recommendations. The duty of important and particularly important entities to meet the state of the art in cryptography under section 30 of the BSI Act is existing law.
From Shor's algorithm in 1994 to BSI's 2025 estimate of a code-breaking quantum computer by 2040
The guideline opens its history in 1994, when Peter Shor published quantum algorithms that can break much of the public-key cryptography in use today. The next marker is German: in 2017 the BSI commissioned its first study on the development status of quantum computers, updated most recently in 2025. According to the guideline, that update concludes it is likely that a cryptographically relevant quantum computer can be built within 15 years at most, by 2040 or earlier, and it adds that the basic assumptions of quantum error correction were fully verified in 2024. Further progress in error correction could shorten the period considerably.
The guideline also says plainly that there is currently no evidence that quantum computers can already break cryptographic schemes. Its footnote 3 quotes a 2025 Bundestag paper, printed matter 20/14986, in which the federal government says it works in the high-security area under the hypothesis that such machines will be available at the beginning of the 2030s. Two clocks are therefore running at once: an engineering estimate of 2040 or earlier, and a working assumption of the early 2030s for classified systems, where the BSI has already set binding migration deadlines for approved classified-information security products by 2030.
Two threat scenarios drive the urgency. The first is "store now, decrypt later": an attacker keeps encrypted traffic today and reads it once a capable machine exists. The guideline names classified material, sensitive personal data and trade secrets as the information at risk, a concern Quentir traced in medicine through Europol's report on harvest-now, decrypt-later risk to health records. The second is slower and less discussed: long-lived and complex systems whose migration simply takes longer than the time available. The press release adds a third pressure. Artificial intelligence, it says, increases the pace of security research and increasingly accelerates methods for attacking cryptographic schemes.
June 2025 to October 2026: how the EU roadmap of the NIS Cooperation Group became a German timetable
In June 2025 the EU member states, supported by the European Commission, published A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, prepared by the post-quantum workstream of the NIS Cooperation Group. Germany's guideline adopts its timelines without change. Its section 3 sorts use cases into high, medium and low risk. High-risk use cases should be quantum-safe by the end of 2030 and medium-risk use cases by the end of 2035; the summary puts the second goal as completing the change for as many systems as possible by 2035. Where an organization cannot meet these dates, it must assess its individual risk.
The risk level of a use case depends on three factors, borrowed from the PQC Migration Handbook of the Dutch organizations AIVD, CWI and TNO: how attackable the cryptography in use is, how much damage a loss of confidentiality would cause, and how much time and effort the migration will take. That third factor is the interesting one. A system can earn a high rating because it is hard to change, even when the data it protects is modest.
The German market was not ready when this started. A 2023 BSI market survey, carried out with KPMG and cited in the guideline, found that almost 90 percent of respondents expected they would not be able to counter the quantum threat to cryptography in time.
What the guideline asks for by the end of 2026: an inventory, a responsible office and binding deadlines
Section 4 turns the timetable into steps, and the first deadline is close. By the end of 2026 the initial preparation and planning phase, which the guideline calls PQC readiness, should be complete and the first migration steps should have begun. Each organization should have created its cryptographic inventory by the same date, modeled on the crypto register required by the BSI IT-Grundschutz module CON.1, requirement CON.1.A19. The guideline mentions inventory tools, repository scans and cryptographic bills of materials based on the CycloneDX standard as aids. It also asks for an overview of dependencies, with an example that will be familiar to readers of Quentir's analysis of the Pentagon's 2030 post-quantum target for PIV and CAC smart cards: a card reader and its cards must both implement quantum-safe schemes before the exchange between them is quantum-safe.
Section 4.1 is headed "Make deadlines binding", and it admits the limit of the document. The deadlines are urgent recommendations. The guideline asks the IT Planning Council, which coordinates IT between the federal government, the states and municipalities, and UP KRITIS, the public-private partnership for critical infrastructure, to adopt them as binding deadlines by the end of 2026. That request matters because, as the guideline itself notes, BSI requirements often have only advisory force for state and municipal administrations. Each organization should also name at least one responsible office for the migration, with enough staff and money to do the job.
Why section 30 of the BSI Act gives "state of the art" legal force for NIS2 entities
Section 4.4 is where the guideline meets statute. Germany implemented the NIS2 directive through a revised BSI Act, and section 30 of that act obliges important and particularly important entities to take appropriate technical and organizational security measures. Subsection 2 says those measures should comply with the state of the art, and its list of minimum measures includes concepts and processes for the use of cryptographic procedures. The guideline reads this as an obligation to follow the state of the art for cryptography in line with each entity's risk management, and it places post-quantum cryptography, as described in the BSI technical guideline TR-02102, under that heading.
The BSI recommends hybrid schemes, which combine a classical algorithm with a post-quantum one so that the security of both is retained. Quentir looked at one consequence of that preference in its read of why the BSI advises against Classic McEliece for new systems. The guideline does not say that every system without post-quantum protection already falls below the state of the art. It does say, in its introduction, that outside regulated sectors the use of outdated or vulnerable cryptography can be judged negligent, regardless of the quantum threat. A supervisor, an auditor or a court weighing a 2031 incident will have this document to read.
2030 and 2035: high-risk systems first, suppliers in the contract
Section 4.6 brings in the market. Early coordination with manufacturers, IT service providers and communication partners is described as indispensable. Providing a cryptographic bill of materials simplifies comparing cryptographic capabilities across the supply chain, and that provision "can be set down in contracts." New developments should use only quantum-safe cryptography. In procurement and tendering, PQC and crypto-agility requirements under TR-02102 should be applied by default. Lifecycle planning gets a practical note: sometimes the right move is to delay replacing a product until a PQC-capable successor exists, and sometimes it is to replace a product early.
For citizens, the stakes sit in ordinary services the guideline names in its first paragraph: digital administrative services, the banking system and messaging apps. Tax files, health data and the records of a municipal registry office are exactly the long-lived data that the store-now, decrypt-later scenario describes.
How Quentir Reads It
Germany has done three things with one short document. It has adopted the EU's 2030 and 2035 dates without softening them. It has moved the practical deadline forward to the end of 2026, when inventories, responsible offices and planning should exist. And it has tied the whole effort to an existing legal duty, section 30 of the BSI Act, which already reaches every important and particularly important entity under NIS2. The weak point is federalism. A guideline from Berlin and Bonn cannot bind a municipal IT department, which is why the request to the IT Planning Council is the date to watch. The council can issue legally binding decisions on IT security standards with the consent of the federal government and a qualified majority of the states, a decision may apply only in the territories whose members voted for it, and it can also adopt mere recommendations by simple majority. The next question is whether the council adopts a binding decision by the end of 2026, which bodies and systems it covers, and how the states carry it down to their municipalities.
The second date to watch is commercial. Once procurement offices apply crypto-agility requirements by default and ask suppliers for cryptographic bills of materials in contracts, vendors selling into German public bodies and critical infrastructure will need to show which algorithms their products use and how quickly they can change them. The guideline names those steps and leaves the sequencing to each organization. Quentir's Signature Report on the PQC Migration Roadmap for Boards adds what this post leaves out: a fixed scope, an executive summary, a checklist and refresh triggers for the decisions that sit above the inventory.
Sources: BMI, BMDS and BSI, Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie: Gemeinsame Leitlinie von BMDS, BMI und BSI, cover date 11 September 2026, published 12 October 2026 (summary, sections 1 to 4.6, footnotes 3 and 10); BSI, "Umstellung auf Post-Quanten-Kryptografie: Leitlinie zur nationalen Umsetzung der EU-Roadmap veröffentlicht", press release, Bonn, 12 October 2026; NIS Cooperation Group, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, June 2025; BSI Act (BSIG), section 30; BSI, Technical Guideline TR-02102; IT-Planungsrat, "Rechtsverbindlichkeit". Pages accessed 13 October 2026.
Published intelligence, built to inform your own decisions. Published: October 13, 2026.