The Netherlands Just Gave Its PQC Timeline a Cabinet Signature

Most national PQC strategies arrive as a single agency's guidance document. The Netherlands' arrived with nine ministries' names on it and a reporting line to Parliament.

A cabinet document, not an agency one

On 5 October 2026, the Dutch cabinet sent the "Rijksbrede Quantumstrategie" (Nationwide Quantum Strategy) to the Tweede Kamer. It's signed by the Minister of Economic Affairs and Climate and the State Secretary for Digital Economy and Sovereignty, jointly with the ministries of the Interior, Foreign Affairs, Defence, Finance, Infrastructure and Water Management, Justice and Security, Education, Culture and Science, and Health, Welfare and Sport. Parliament will get an annual progress report starting in 2027.

That's a different kind of document than AIVD and NCSC's January 2024 guidance, which is still good technical advice but carries the weight of two technical agencies, not a cabinet commitment with parliamentary oversight attached.

Five dates, and the first one is close

Inside the strategy's security chapter sits a table titled "PQC-migratie tijdpad voor de Nederlandse Rijksoverheid" -- the PQC migration timetable for the Dutch central government. It's more granular than most national roadmaps:

End of 2026. Government organizations must have incorporated quantum-computing risk into their risk-management process, and have their own cryptography policy conforming to the Rijksbreed Beleidskader Cryptografie (the nationwide cryptography policy framework). Ten weeks away as of this writing.

End of 2027. Organizations must account for the harvest-now-decrypt-later risk scenario with mitigating measures where needed, have a draft PQC migration plan, prepare or run practical trials for high- and medium-risk use cases, and -- the clause that matters most for anyone building toward compliance:

"Rijksoverheidsorganisaties nemen passende maatregelen om volwassen cryptografisch asset management uit te voeren en te onderhouden." ("Government organizations take appropriate measures to implement and maintain mature cryptographic asset management.")

That's an inventory requirement in substance, even though the strategy doesn't use the word CBOM to describe it.

End of 2028. Government organizations must be able to set quantum-safe cryptography requirements in procurement and tenders, with attention to contract management, and must have written guidelines steering essential businesses toward PQC migration.

End of 2030. High-risk use cases fully migrated; software and firmware using quantum-safe cryptography by default; the government has, in a European context, standardized quantum-safe cryptography use and agreed which standards to retire.

End of 2035. Medium-risk use cases migrated; low-risk use cases migrated "where possible."

The statute that makes this more than a plan

The strategy explicitly ties its own execution to the Cyberbeveiligingswet (Cybersecurity Act), the Dutch NIS2 transposition law, in force since 15 August 2026:

"Zo vraagt artikel 13 van de Cbw om specifiek beleid rond cryptografie." ("Article 13 of the Cbw requires specific policy around cryptography.")

The strategy is explicit that this is how organizations get from "recommended" to "required": the Cbw gives them a statutory hook they can use to take concrete steps on quantum-safe cryptography, even where the Quantumstrategie's own dated milestones don't reach them directly.

Where the binding force actually stops

The dated timetable above binds "Rijksoverheidsorganisaties" -- central government bodies. It does not, on its own text, extend the same dates to the private sector or critical-infrastructure operators generally. The strategy discusses extending protection to "essentiele diensten" (essential services under the Cyberbeveiligingswet) but stops short of attaching its own government timetable to them.

If you're outside central government, the document that actually reaches you is the Cyberbeveiligingswet's general NIS2 cryptography-policy requirement -- real, but less specific than the Quantumstrategie's own milestones.

The sector that's already ahead

Dutch financial institutions have had a working version of this for longer than the Quantumstrategie has existed. DNB's "Good Practice Information Security 2023" (current, last updated August 2025) directs supervised institutions to maintain "an inventory of the cryptographic landscape (encryption protocols and certificates for network connections, key management and data storage)" and to run an annual Cryptography Risk Assessment across multi-year horizons that explicitly account for "the development of Quantum computing." If your organization is DNB-regulated, you're likely already closer to the Quantumstrategie's end-2027 milestone than a central-government department starting from the strategy alone.

What to do with this

If you're part of the Dutch central government, the cryptography-policy deadline lands at year-end, and "mature cryptographic asset management" is due twelve months after that -- which means the inventory work needs to start now, not after the policy document is filed. If you're a DNB-regulated institution, the annual Cryptography Risk Assessment DNB already expects is, functionally, the same ask.

Either way, the practical first step is the same: an actual, current cryptographic bill of materials covering your own code, infrastructure, and vendors -- not a plan to build one before the next deadline arrives.

The Netherlands country page tracks the primary sources, independently verified against the strategy's own 73-page text.