Belgium

What's verified

A white paper titled "Preparing for the Quantum Era: A Practical Guide to Post-Quantum Cryptography" gives Belgian organisations a three-phase migration plan: Phase 1 - Awareness and Assessment, Phase 2 - Planning and Strategy, Phase 3 - Implementation and Beyond. It defines risk-tiered migration timelines: high-risk systems should start planning by end of 2026 and complete full migration by end of 2030; medium-risk systems should also start planning by end of 2026, complete pilots by end of 2030, and achieve full migration by end of 2035 (low-risk systems can be scheduled in a later phase). These risk-tiered dates align with the EU's Coordinated Implementation Roadmap milestones (national strategies by 2026, high-risk/critical infrastructure protected by 2030, broad adoption by 2035), and are explicitly presented as doing so.

Who actually published it

The attribution matters here, because it is easy to read this as Belgian government guidance and it is not quite that. The CCB's own announcement says it "has contributed to a white paper on Post-Quantum Cryptography (PQC)," and that "this initiative was led by the Belgian Cyber Security Coalition and the Quantum Circle." The paper's colophon describes it as "a collaborative effort, bringing together expertise from the Belgian Cyber Security Coalition, the Quantum Circle, and the Centre for Cybersecurity Belgium (CCB)," and it is hosted on the Coalition's own domain rather than a Belgian government one.

So this is an industry-association white paper with the national cybersecurity centre as a named contributor — closer in status to a sector guide than to a regulator's circular. It carries no enforcement mechanism, and its language throughout is "should."

Belgium names no algorithms of its own

The white paper does name algorithms — ML-KEM, ML-DSA, SLH-DSA, FN-DSA, XMSS, LMS, AES-256, SHA-3 — but it presents them as NIST's standards and surveys what other countries prefer, rather than approving a Belgian list. It notes, for instance, that "some EU member states favour Frodo-KEM over ML-KEM" and that "Germany's BSI supports Classic McEliece," and it expects the global picture to stay fragmented: "China, Japan, Malaysia, and Korea are also considering national PQC standards, potentially diverging from NIST's selections."

On migration approach it comes down firmly on the European side of the hybrid question: "experts agree it is too early to replace all classical algorithms outright. The preferred migration path is therefore hybrid cryptography, which combines classical and post-quantum protection."

Belgium is, in short, a downstream adopter on both axes we track: NIST for algorithms, the EU roadmap for dates. We found no Belgian national PQC algorithm catalogue, no national parameter-set guidance, and no Belgian-authored deadline.