The Czech Cybersecurity Agency's Own Website Is Already Quantum-Safe. Its Recommendation to Everyone Else Is Just a Recommendation.

Most government cybersecurity agencies recommend things they haven't done themselves yet. The Czech Republic's NÚKIB recommends a 2030 PQC deadline to everyone else while already running post-quantum cryptography on its own website.

Practicing what it recommends, on a small scale

NÚKIB (National Cyber and Information Security Agency of the Czech Republic) joined a joint statement of 18 EU member states on transitioning to post-quantum cryptography, published 17 January 2025, which recommends migrating "as soon as possible, ideally by 2030 at the latest" to counter the "store now, decrypt later" threat -- the same risk most of this tracker calls "harvest now, decrypt later."

NÚKIB's own text goes further than simply endorsing the statement. It states directly that NÚKIB has already implemented quantum-resistant cryptography to secure communication between web browsers and the NÚKIB Portal -- its own government web application. That's a small-scale but genuine example of a regulator applying its own recommendation to its own infrastructure before asking anyone else to do the same. Most countries on this tracker publish guidance about what organizations should do; comparatively few government bodies can point to their own systems as a working example.

What the recommendation doesn't require

Here's the limit: NÚKIB's own language describes its role as agreeing with and supporting the joint statement's conclusions -- an endorsement, not a mandate. No binding statutory or regulatory instrument accompanies it. No defined regulated sector is named, no economy-wide scope is stated, and no enforcement mechanism -- fines, audits, certification -- attaches to the 2030 date for anyone outside NÚKIB itself. The recommendation reaches as far as NÚKIB's own portal and stops there in terms of actual obligation.

A clean division of labor, confirmed by both sides

One detail worth noting precisely: Czech National Bank (ČNB), which could plausibly issue its own PQC requirements for the financial sector the way several other countries' central banks have, has explicitly said it won't. A joint ČNB-NÚKIB statement on DORA supervisory division of labor states that cryptographic algorithm standards are left to NÚKIB. That's unusually clear institutional coordination -- rather than two regulators potentially issuing conflicting or duplicative guidance, Czech Republic has one named authority for cryptographic standards, confirmed by both sides of the arrangement.

The practical consequence: if you're a Czech financial institution looking for PQC requirements, ČNB isn't where to look, and NÚKIB -- the body that is responsible -- hasn't issued a binding one yet either.

What to do with this

If you operate in the Czech Republic, NÚKIB's own portal migration is a credible signal of where enforceable policy is likely heading, even without a mandate yet -- a regulator doesn't typically implement something on its own infrastructure and then walk away from recommending it broadly. The 2030 date from the EU joint statement is worth treating as a real planning target despite its non-binding status, particularly since NÚKIB has demonstrated the migration is practically achievable by doing it themselves.

The Czech Republic country page tracks the joint statement and NÚKIB's own deployment with primary sources.