Germany Quietly Turned a Recommendation Into a Mandate for 29,500 Companies

Six weeks from now, roughly 29,500 German organizations are supposed to have finished building a cryptographic inventory. Most of them don't know it yet, because the document that sets that deadline reads like guidance, not law -- and the law that actually makes it binding doesn't mention post-quantum cryptography at all.

The document that looks optional

On 11 September 2026, BSI (Germany's federal cybersecurity agency), the Federal Ministry of the Interior (BMI), and the newly formed Federal Ministry for Digital Affairs and State Modernisation (BMDS) jointly published "Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie" -- the national implementation of the EU's post-quantum cryptography roadmap. BSI announced it publicly a month later, on 12 October.

Read the guideline on its own, and it looks like every other national PQC roadmap: a risk-tiered timeline, addressed to "Bundes-, Landes- und Kommunalverwaltungen, Organisationen und Unternehmen, insbesondere Betreiber kritischer Infrastrukturen" -- federal, state, and municipal government, organizations and companies generally, with particular attention to critical-infrastructure operators -- written almost entirely in "sollte" (should), not "muss" (must).

Three dates anchor it:

• End of 2026 -- initial cryptographic inventory and preparation complete, first migration steps underway
• End of 2030 -- all high-risk use cases running quantum-safe cryptography
• End of 2035 -- migration "largely complete" for nearly all systems

Advisory language, a long horizon, nothing that forces anyone's hand. That's the reading that misses the point.

The statute underneath it

Section 30(2) of the BSI-Gesetz (BSIG) -- Germany's NIS2 transposition law, in force since December 2025 -- already requires "wichtige" and "besonders wichtige Einrichtungen" (important and especially important entities, the roughly 29,500 organizations NIS2 reaches in Germany) to implement, as one of ten mandatory minimum risk-management measures:

"8. Konzepte und Prozesse für den Einsatz von kryptographischen Verfahren" ("8. Concepts and processes for the use of cryptographic procedures")

The lead clause of Section 30(2) requires that these measures meet "den Stand der Technik" -- the state of the art. That phrase is not decorative. BSI's own Technical Guideline TR-02102, updated 23 January 2026, now defines quantum-safe cryptography as part of what "state of the art" means, with a changelog entry specifically noting "updates in the area of PQ cryptography (including the inclusion of migration periods...), discontinuation of the sole use of classic asymmetric mechanisms."

The September guideline makes the connection explicit, in its own words:

"Wichtige und besonders wichtige Einrichtungen sind nach dem... BSI-Gesetz (BSIG), § 30 dazu verpflichtet, den Stand der Technik für Kryptografie gemäß ihrem Risikomanagement einzuhalten." ("Important and especially important entities are legally obligated under... the BSI-Gesetz (BSIG), Section 30, to keep pace with the state of the art for cryptography in accordance with their risk management.")

Put the two documents together and the "should" language reads differently. The guideline isn't proposing a new obligation -- it's telling 29,500 already-obligated entities what their existing statutory duty now requires of them, with dates attached.

The inventory deadline is the one to watch

The guideline's end-2026 milestone is where this gets concrete fastest, and it names the mechanism directly:

"Cryptographic inventory tools, repository scans und CBOMs (Cryptographic Bill of Materials, z.B. basierend auf dem CycloneDX-Standard) können die Erstellung des kryptografischen Inventars unterstützen... die initiale Erstellung sollte bis Ende 2026 abgeschlossen sein." ("Cryptographic inventory tools, repository scans, and CBOMs... can support the creation of the cryptographic inventory... the initial creation should be complete by end-2026.")

It goes a step further than most government guidance by addressing the supply chain directly:

"Die Bereitstellung von CBOMs vereinfacht den Vergleich von kryptografischen Fähigkeiten innerhalb der Lieferkette. Eine solche Bereitstellung kann vertraglich festgehalten werden." ("Providing CBOMs simplifies comparing cryptographic capabilities across the supply chain. Such provisioning can be made a contractual requirement.")

That's a government document telling regulated entities they can -- and, read against the Section 30 deadline, probably should -- start requiring CBOMs from their vendors as a contract term, not just producing one for themselves.

What's still soft, and what isn't

To be precise about what has and hasn't changed: the 2026/2030/2035 dates themselves are not yet independently enforceable. The guideline explicitly calls on the IT-Planungsrat (IT Planning Council) and UP KRITIS (the critical-infrastructure protection framework) to make these milestones "möglichst verbindlich" -- as binding as possible -- by the end of 2026. Until that happens, the enforcement teeth that exist today attach to Section 30's general cryptography-concept requirement, not to the specific PQC timeline.

What that means in practice: an auditor checking NIS2 compliance today can already ask whether your organization's cryptography concepts and processes meet the state of the art, and can point to TR-02102 and this guideline as the reference for what that means. Whether a regulator can cite the specific end-2026 inventory date as a standalone violation is, for now, a legal question the IT-Planungsrat's forthcoming binding designation is meant to settle.

One claim worth retiring while we're here: VDA ISA 2027, Germany's automotive information-security standard published 1 July 2026, does not contain a confirmed PQC-specific control. Its documented changes map to NIST CSF 2.0, ISO 27001:2022, and IEC 62443 -- general frameworks, not a named cryptography-migration requirement. If you've seen this cited as a PQC mandate, it isn't, as far as any primary VDA document shows.

What to do with this

If you're a "wichtige" or "besonders wichtige Einrichtung" under German NIS2 -- which covers most mid-sized and large organizations in energy, transport, banking, health, drinking water, digital infrastructure, and manufacturing of critical products -- Section 30 BSIG already binds you, and BSI has now told you what compliance looks like for the next decade. The inventory deadline is six weeks out as of this writing.

The hard part is rarely the policy document the end-2026 deadline asks for. It's that most organizations can't currently answer "where does RSA or ECC run across our own systems and our vendors' systems" without going and finding out, which is exactly the gap a real cryptographic bill of materials closes.

The Germany country page tracks the primary sources behind this -- the guideline PDF, the statute text, and BSI's technical guideline -- each independently verified.