Finland's PQC Guidance Doesn't Pretend to Be a National Plan. That's Unusual.

Read enough national PQC roadmaps and a pattern shows up: a government agency publishes a timeline that reads like a sovereign commitment, with dates that turn out to be lifted, often without attribution, from the EU's own coordinated roadmap. Finland does something different. Its guidance says, in its own first sentence, exactly where the dates come from.

The honesty is the story

Traficom's Kyberturvallisuuskeskus -- Finland's National Cyber Security Centre, part of the transport and communications regulator -- publishes a guide titled "Siirtymä kvanttiturvallisiin salausmenetelmiin" (Transition to quantum-safe encryption methods). It opens with a direct attribution:

"Tällä sivulla kuvataan EU:n NIS-yhteistyöryhmän hahmottelema siirtymän tiekartta (EU PQC Roadmap)." ("This page describes the transition roadmap outlined by the EU's NIS Cooperation Group (EU PQC Roadmap).")

That single sentence is more transparent than most comparable national guidance on this tracker. Several countries present the EU's dates as if a national agency independently arrived at them -- Finland names the actual source, which matters if you're trying to understand whether a "Finnish" deadline reflects Finnish policy judgment or an EU-level coordination document Finland is simply relaying to its own organisations.

The dates, relayed accurately

What follows is the EU NIS Cooperation Group's roadmap, presented faithfully: immediate preparation to build visibility into current cryptography and identify key risks and dependencies; foundational actions -- PQC plans, high-risk-system pilots, supplier engagement -- by end of 2026; high-risk systems' transition complete and medium-risk piloting underway by end of 2030; and by end of 2035, "kaikki keskitason ja mahdollisuuksien mukaan myös matalan riskin järjestelmät on päivitetty PQC-aikaan" (all medium-risk and, where possible, low-risk systems updated to the PQC era).

The guide's first recommended immediate action is a cryptographic inventory:

"Tee kryptoinventaario: muodosta luettelo kaikista sovelluksista, järjestelmistä ja laitteista, joissa käytetään kryptografiaa." ("Create a crypto inventory: compile a list of all applications, systems, and devices that use cryptography.")

And it frames the whole transition correctly as a sustained process rather than a single event: "Varautumisen ajoitus on keskeinen tekijä siirtymän onnistumisessa. Aikainen valmistautuminen mahdollistaa hallitun etenemisen ja riskien priorisoinnin." ("The timing of preparation is a key factor in the transition's success. Early preparation enables managed progress and prioritization of risks.")

What this means for comparing Finland to other countries

If you're using this tracker to compare national PQC postures, it's worth not over-crediting Finland for independent regulatory action, and not under-crediting it either. Finland hasn't set its own deadlines -- it's accurately relaying a supranational roadmap, which is less than a sovereign mandate but more than silence. The practical content for a Finnish organisation is identical either way: the same dates, the same recommended first step. What differs is how much weight the attribution carries if you're assessing regulatory momentum or trying to predict whether Finland will eventually convert this guidance into something binding.

Nothing in Traficom's guide is enforceable. It sits under the "Ohjeet ja oppaat" (Guides and instructions) heading, with no penalty, reporting requirement, or audit mechanism attached to any date in the roadmap. Finland's financial supervisor, FIN-FSA, has published no PQC-specific guidance of its own -- the one regulator with the clearest path to making cryptographic migration binding for Finnish banks and insurers hasn't acted yet.

What to do with this

If you operate in Finland, Traficom's guide is accurate and worth following regardless of its non-binding status -- the dates it relays are the same ones driving binding obligations elsewhere in the EU (Germany's new statutory hook, the Netherlands' cabinet strategy), so a Finnish organisation ignoring them is just deferring work that EU-level coordination is clearly moving toward making mandatory eventually. The crypto inventory the guide recommends first is the same foundational work every version of this roadmap, Finnish or otherwise, assumes you'll eventually need.

The Finland country page tracks the guide with its primary source.