Does Czech Republic have a post-quantum cryptography (PQC) law?

No. Nothing published for Czech Republic carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber and Information Security Agency (NÚKIB).

What is Czech Republic's PQC migration deadline?

2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from National Cyber and Information Security Agency (NÚKIB).

Does Czech Republic require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

CZGuidance

Czech Republic

Czech Republic's NÚKIB has endorsed a non-binding 18-member EU joint statement recommending PQC migration "by 2030 at the latest" and has itself deployed quantum-resistant cryptography on its own web portal, but no binding mandate, defined sector scope, inventory/CBOM requirement, or enforcement mechanism has been established.

Czech Republic's post-quantum cryptography posture is classified as guidance, led by National Cyber and Information Security Agency (NÚKIB), with a migration target of 2030. It scores 30/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

NÚKIB (National Cyber and Information Security Agency of the Czech Republic) has joined the joint statement of 18 EU member states on transitioning to post-quantum cryptography (published January 17, 2025), which recommends migrating to PQC "as soon as possible, ideally by 2030 at the latest" to counter the "store now, decrypt later" threat (functionally equivalent to "harvest now, decrypt later"). NÚKIB also states it has already implemented quantum-resistant (post-quantum) cryptography to secure communication between web browsers and the NÚKIB Portal web application.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	NÚKIB only 'agrees with the document's conclusions and supports the preparatory steps' of a joint statement. This is endorsement of a recommendation, not a binding statutory or regulatory mandate with penalties, so score is 0.
Deadline concreteness	20/20	The joint statement NÚKIB joined recommends migrating 'as soon as possible, ideally by 2030 at the latest,' a specific year explicitly published in the source, so score is 20.
Scope of coverage	0/20	The source only describes NÚKIB's own portal (a government web application) implementing PQC and a general EU-wide recommendation with no defined regulated sectors or economy-wide scope stated, so score is 0.
Inventory/CBOM requirement	0/20	The evidence contains no mention of a cryptographic inventory, CBOM, or any risk-assessment obligation that would imply one, so score is 0.
Regulatory activity	10/20	NÚKIB is a named authority actively engaging on the topic (joining the statement, upgrading its own portal), but no enforcement mechanism such as fines, audits, or certification is described, so score is 10.
Total	30/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Czech National Bank (ČNB)
Not yet addressed, a gap to watch
A joint ČNB–NÚKIB statement on DORA supervisory division of labor explicitly leaves cryptographic algorithm standards to NÚKIB, confirming ČNB is not an independent source for PQC requirements.

FAQ: Czech Republic and PQC

Does Czech Republic have a post-quantum cryptography (PQC) law?: No. Nothing published for Czech Republic carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is National Cyber and Information Security Agency (NÚKIB).
What is Czech Republic's PQC migration deadline?: 2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from National Cyber and Information Security Agency (NÚKIB).
Does Czech Republic require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.