The EU's 2026/2030/2035 PQC Timeline Isn't in the Commission's Recommendation. It's Not Anywhere Yet.

If you've seen a chart showing the EU's PQC migration running through 2026, 2030, and 2035, you've seen a timeline that doesn't exist in any EU document. It describes what a future roadmap is expected to say -- not a commitment Brussels has actually made.

What the Commission actually committed to

The European Commission's Recommendation (EU) 2024/1101, published 11 April 2024, invites member states to coordinate national PQC transition strategies. Read directly against the EUR-Lex text, its actual commitment is narrow: a shared implementation roadmap appearing roughly two years after publication -- around April 2026 -- with a review scheduled roughly a year after that, around April 2027.

That's it. No 2026/2030/2035 migration-completion milestones appear anywhere in the Recommendation's text. Those specific dates, which circulate widely in secondary coverage and some vendor materials, describe what people expect a future roadmap to eventually contain -- not something the Recommendation itself has committed to. Citing them as an existing EU mandate is a documented, common error, and anyone asked to comply with "the EU's 2030 PQC deadline" should ask which document actually contains that date, because the Commission's own Recommendation does not.

The guidance that's actually more specific than the mandate

Here's the inversion that matters for anyone operating in the EU: ENISA, the EU's cybersecurity agency, has published more concrete, more technical PQC guidance than the Commission's own Recommendation -- and published it earlier. "Post-Quantum Cryptography: Current State and Quantum Mitigation" came out in May 2021, three years before the Commission Recommendation, surveying the five PQC algorithm families and recommending immediate mitigations like hybrid schemes and pre-shared keys. A follow-up "Integration Study" (October 2022) worked through integrating post-quantum systems into existing cryptographic protocols.

ENISA has kept this current: a 2024 assessment surveyed PQC investment and awareness across more than 1,350 organizations in all 27 member states, and ENISA co-supported an April 2025 update to the European Cybersecurity Certification Group's Agreed Cryptographic Mechanisms that formally added PQC algorithms to the EU's certification framework. None of this carries statutory force -- ENISA advises, it doesn't regulate -- but as a practical technical reference, it's a better starting point than the policy-level Recommendation that gets cited more often.

The enforcement that exists, and doesn't name PQC

Two already-binding EU instruments create real pressure without naming post-quantum cryptography specifically. NIS2 sets cybersecurity risk-management obligations, with penalties up to 2% of global turnover for essential entities, covering energy, transport, banking, health, and digital infrastructure sectors -- cryptographic risk management can reasonably be read into those obligations, but the directive doesn't call out PQC by name. The Cyber Resilience Act, covering security requirements for products with digital elements and entering force from 2027, likewise sets no PQC-specific deadline. Both carry real enforcement weight for general cybersecurity posture; neither currently gives a regulator the power to penalize an organization specifically for missing a post-quantum migration date, because no EU-level date exists to miss.

One early signal of movement: a July 2026 ECB Banking Supervision letter to bank CEOs, nominally about AI-enabled cybersecurity threats, includes the line that "the adoption of post-quantum cryptography... must start now" -- while explicitly stating ECB will address quantum risk in a dedicated letter later. That's confirmation a PQC-specific ECB communication is coming, not evidence that it has arrived.

What to do with this

Stop treating the 2026/2030/2035 timeline as something to plan against -- track the Commission's actual roadmap when it's published instead, expected around April 2026 per the Recommendation's own text. Use ENISA's technical publications as your practical starting point for algorithm and protocol decisions; they're more current and more specific than the policy Recommendation. Check your own member state's national guidance, since several -- notably Germany and the Netherlands -- are considerably more concrete than the EU level. And if you're a NIS2-covered entity, fold cryptographic risk into your existing risk-management documentation now; that obligation is already binding, independent of whatever EU-level PQC-specific timeline eventually lands.

The European Union country page tracks ENISA's publications, the Commission Recommendation, and the ECB and EBA activity checked against primary sources.