Poland's 2029 PQC Deadline Isn't When Migration Finishes. It's When the Plan to Migrate Is Due.

A government resolution with a named ministry, a gazetted publication, and a dated deadline sounds like exactly the kind of binding mandate most PQC coverage is looking for. Poland's is real on every one of those counts. It's also easy to overstate, because the 2029 date doesn't mean what a quick read suggests.

What Poland actually adopted

Poland's Council of Ministers adopted the "Strategia Cyberbezpieczeństwa Rzeczypospolitej Polskiej" (Cybersecurity Strategy of the Republic of Poland) by Uchwała Nr 92 (Resolution No. 92) on 10 March 2026, published in Monitor Polski -- the official government gazette -- on 23 March 2026, under the statutory authority of Article 68 of the National Cybersecurity System Act. This is a gazetted government resolution, not an agency guidance document, which gives it more institutional weight than most national PQC strategies on this tracker.

The strategy's body text commits to building national cryptographic capacity directly in response to quantum computing:

"W celu zwiększenia odporności systemów informacyjnych będzie rozwijany krajowy potencjał kryptograficzny, uwzględniający wyzwania kryptografii postkwantowej... W obliczu postępu technik kryptoanalitycznych, w tym w szczególności kwantowej... Ocenie zostaną poddane nowe standardy i algorytmy kryptograficzne przyjmowane przez zagraniczne gremia pod względem trybu ich wdrażania w RP." ("To increase the resilience of information systems, national cryptographic capacity will be developed, taking into account the challenges of post-quantum cryptography... In the face of advancing cryptanalytic techniques, particularly quantum ones... New cryptographic standards and algorithms adopted by foreign bodies will be assessed with regard to their implementation in Poland.")

The deadline that gets misread

Here's the detail that matters most: the strategy's implementation table assigns a specific, dated task -- 3.2.1 -- to the Ministry of Digital Affairs (MC), cooperating with Poland's internal security agency (ABW), defense ministry (MON), economic development ministry (MRiT), military counterintelligence (SKW), the national research network (NASK), the national telecommunications institute (IŁ), and the cyberspace defense command (DKWOC). The task:

Field	Value
Task	Opracowanie Planu migracji do kryptografii postkwantowej (Development of a Plan for migration to post-quantum cryptography)
Start	2025 (ongoing)
Deadline	2029
Lead	MC
Metric	Przyjęcie Planu (Adoption of the Plan)

Read quickly, "2029 deadline for post-quantum cryptography migration" sounds like a completion date. It isn't. The task's own metric is "Adoption of the Plan" -- the deliverable due in 2029 is a migration plan, not completed migration. That's a materially different, and materially easier, commitment than what the shorthand suggests, and it's worth being precise about before citing Poland as having a 2029 PQC deadline the way one might cite the EU's 2030 milestone for high-risk systems.

A related task, 3.2.2, runs on the identical 2029 deadline but covers a different technology entirely: building national quantum-key-distribution infrastructure (PIONIER-Q), as part of the EU's EuroQCI initiative. QKD is physical quantum-mechanical key exchange, not quantum-resistant algorithms -- a different problem with a coincidentally identical due date in the same document.

What the strategy doesn't commit to yet

Two gaps are worth flagging precisely because the strategy is otherwise substantive. First, no specific PQC algorithm is named anywhere in the document's 74-page annex -- not Kyber, not Dilithium, not ML-KEM, not ML-DSA, not a FIPS reference. The strategy's one mention of "NIST" refers to the general NIST Cybersecurity Framework, not NIST's PQC standardization work -- an easy conflation to make, and one worth checking carefully if you see Poland's strategy cited as endorsing specific algorithms.

Second, no cryptographic-inventory or CBOM requirement is named. A direct grep for "CBOM," "SBOM," and "inwentaryzacj" (inventory) across the full annex returns nothing in a cryptographic-asset context. Building the migration plan that's actually due in 2029 will, in practice, require knowing what cryptography currently runs across the systems in scope -- but the strategy doesn't name that inventory work as a deliverable in its own right, the way Germany's September 2026 guideline or the Netherlands' Quantumstrategie do.

KNF, Poland's financial regulator, has published nothing on this at all -- its own site search for "kryptografia postkwantowa" and "kwantowa" returns zero results.

What to do with this

If you track Poland's PQC posture, the accurate framing is: a real, gazetted government commitment to produce a national migration plan by 2029, led by a named ministry with named interagency cooperation, running alongside a parallel quantum-communications infrastructure commitment on the same timeline. Not: Poland requires PQC migration by 2029. The distinction matters if you're comparing Poland against jurisdictions with actual completion deadlines, or deciding how urgently to treat Polish regulatory exposure against other markets.

Either way, the underlying work doesn't wait for 2029 to become relevant -- whoever ends up writing that migration plan will need a real cryptographic inventory to write it from, which is exactly the kind of groundwork worth starting now rather than in the run-up to the deadline.

The Poland country page tracks the strategy with its primary source.