Germany's Post-Quantum Guideline From BMI, BMDS and BSI, Published 12 October 2026: Crypto Inventories by End-2026, High-Risk Systems by 2030, and the Legal Weight of BSI Act Section 30

What BMI, BMDS and BSI published on 12 October 2026

Germany's Federal Ministry of the Interior (BMI), its Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) have jointly published a ten-page guideline on the national implementation of the EU roadmap for the transition to post-quantum cryptography. It addresses federal, state and municipal administrations, companies and operators of critical infrastructure. High-risk use cases should move to quantum-safe cryptography by the end of 2030, and medium-risk use cases by the end of 2035. By the end of 2026 every organization should have completed an initial cryptographic inventory, named a responsible office and started the first migration steps.

Why the German timetable is guidance with a legal edge

The guideline calls its deadlines urgent recommendations and asks Germany's IT Planning Council and the critical-infrastructure partnership UP KRITIS to make them binding by the end of 2026. It also points to section 30 of the BSI Act, which requires important and particularly important entities under the NIS2 regime to take security measures that meet the state of the art, including concepts for the use of cryptography. The guideline places post-quantum cryptography under that heading, recommends hybrid schemes, and asks that procurement treat crypto-agility as a default requirement. This post follows the dates from 1994 to 2035 and marks where each one carries legal force.