Latvia's Defence Ministry Is Being Paid €237,000 to Find Out What Its Own Laws Need to Change

Most EU countries funding PQC pilot projects are testing technology. Latvia's EU-funded commitment is explicitly testing its own laws first.

A guideline that recommends, carefully

Latvia's national NIS2 cybersecurity authority, cyber.gov.lv, operates under the Ministry of Defence -- itself a notable structural choice, since most countries house cybersecurity guidance in a dedicated civilian agency. It published "Kriptogrāfijas vadlīnijas" (Cryptography Guidelines), Version 1.0, dated 12 September 2025, recommending preparation for post-quantum cryptography through hybrid implementation:

"Gatavošanās postkvantu (Post-quantum) kriptogrāfijai: ieviešana hibrīdajiem risinājumiem, kas kombinē klasiskos algoritmus (piemēram, RSA vai ECDSA) ar postkvantu kriptogrāfijas algoritmiem, lai sagatavotos nākotnes drošības izaicinājumiem." ("Preparing for post-quantum cryptography: implementing hybrid solutions that combine classical algorithms (such as RSA or ECDSA) with post-quantum cryptographic algorithms, in order to prepare for future security challenges.")

Standard advisory language -- "ieteicams" (recommended), not a binding instruction, with no compliance deadline attached.

The EU project with an unusual first objective

What's distinctive about Latvia is what its Ministry of Defence is actually funded to do next. Latvia is one of 14 partners across 11 countries (alongside Ukraine, Ireland, Czech Republic, Estonia, Spain, Norway, the Netherlands, Slovakia, Switzerland, and France) in QARC -- Quantum-Resistant Cryptography in Practice, an EU-funded pan-European pilot project running January 2026 to December 2028. Latvia's Ministry of Defence receives approximately EUR 237,000 in funding for its role.

Per public reporting on the project, that role breaks into three parts: identify necessary regulatory amendments in advance, assess the readiness of Latvia's IT infrastructure for quantum-resistant encryption, and work with other European cybersecurity institutions to devise a roadmap for implementing PQC solutions domestically.

Notice the ordering. Most countries' PQC pilot funding goes directly to technical testing -- deploying PQC in a payment system, a network, an identity platform. Latvia's first listed objective is a legal and regulatory gap analysis: figuring out what existing Latvian law would need to change before PQC migration could actually happen, before the technical assessment and roadmap work. That's a meaningfully different starting point, and one that other countries doing similar pilot work rarely state explicitly as their lead objective.

Why that ordering matters

A roadmap built without first identifying regulatory obstacles risks hitting legal friction partway through implementation -- a procurement rule that doesn't contemplate PQC-capable products, a certification requirement written around classical algorithms, a data-protection provision that assumes a specific cryptographic standard. Latvia's approach, at least as funded, is structured to surface those obstacles before building toward a technical roadmap rather than discovering them during implementation.

Whether this produces a genuinely better outcome than jurisdictions that start with technical pilots is an open question the project's 2026-2028 timeline will eventually answer. What's confirmed now is that Latvia secured EU funding specifically framed around that sequencing, which is itself a notable data point for any country designing its own PQC transition approach.

What's still missing

QARC is a funded commitment to eventually produce a roadmap, not a published roadmap itself -- its 2026-2028 project timeline is not a national compliance deadline. Neither the Cryptography Guidelines nor the QARC commitment names a cryptographic-inventory or CBOM requirement. Latvijas Banka, Latvia's central bank, has published nothing PQC-specific of its own, leaving the financial sector without sector-specific guidance beyond the general national guidelines.

What to do with this

If you operate in Latvia, or are designing a PQC transition approach for any jurisdiction, Latvia's regulatory-gap-first sequencing is worth studying as a methodology regardless of whether you're directly affected by QARC -- identifying legal and procurement obstacles before building a technical roadmap is a genuinely different and arguably more pragmatic order of operations than most countries' approach on this tracker.

The Latvia country page tracks both the guidelines and the QARC commitment with their sources.