Does European Union have a post-quantum cryptography (PQC) law?

No. Nothing published for European Union carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is ENISA (European Union Agency for Cybersecurity).

What is European Union's PQC migration deadline?

None. No migration deadline has been published for European Union by any regulator we checked, including ENISA (European Union Agency for Cybersecurity).

Does European Union require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

EUGuidance

European Union

ENISA has published substantive, independent technical guidance on post-quantum cryptography since 2021, predating and more specific than the European Commission's 2024 Recommendation, which itself sets no binding migration deadlines.

European Union's post-quantum cryptography posture is classified as guidance, led by ENISA (European Union Agency for Cybersecurity). It scores 10/100 on this tracker's rubric, guidance only, with little binding force yet, and that is not a measure of how secure or advanced the country actually is.

What's verified

ENISA (the EU Agency for Cybersecurity) has published a substantive, independent body of technical work specifically on post-quantum cryptography. This work is separate from and predates the European Commission's 2024/1101 Recommendation by three years. "Post-Quantum Cryptography: Current State and Quantum Mitigation" (May 2021) surveys the PQC standardization landscape and the five algorithm families (code-based, isogeny-based, hash-based, lattice-based, multivariate-based), recommending immediate mitigations such as hybrid schemes and pre-shared keys. Its follow-up, "Post-Quantum Cryptography - Integration Study" (October 2022), examines integrating post-quantum systems into existing cryptographic protocols. ENISA continues active PQC work, including a 2024 assessment of PQC investment and awareness across 1,350+ organizations in 27 member states, and co-support for the April 2025 update to the European Cybersecurity Certification Group's Agreed Cryptographic Mechanisms, which formally added PQC algorithms.

Separately, the European Commission's Recommendation (EU) 2024/1101, published 11 April 2024, invites member states to coordinate national transition strategies. Checked directly against the EUR-Lex text: the Recommendation commits only to a shared implementation roadmap appearing roughly two years after publication (around April 2026), with a review around April 2027. It does not contain the specific 2026/2030/2035 migration-completion milestones that circulate in secondary coverage; those describe what a future roadmap is expected to contain, not a commitment the Recommendation itself makes.

Who it applies to

Neither ENISA's guidance nor the Commission Recommendation binds companies or critical-infrastructure operators directly. Practical pressure on organizations comes through two separate, already-binding instruments:

NIS2 Directive: cybersecurity risk-management obligations for essential and important entities (energy, transport, banking, health, digital infrastructure), which can be read to cover cryptographic risk but does not name post-quantum cryptography specifically.
Cyber Resilience Act: security requirements for products with digital elements, in force from 2027, which likewise does not set a PQC-specific deadline.

What organizations need to do

Do not treat the widely-cited 2026/2030/2035 EU timeline as an operative deadline, since it is not in the Commission's Recommendation. Track the roadmap's actual publication instead.
Use ENISA's technical publications as the practical starting point for algorithm and protocol decisions, since they are more specific and more current than the Commission Recommendation.
Follow your own member state's national guidance, which in several cases is more concrete than the EU level. See Germany, France, Netherlands, Sweden, Italy, Belgium, Czech Republic, Slovenia, Norway, and Switzerland (non-EU but closely watched).
For NIS2-covered entities, fold cryptographic risk into existing risk-management documentation now. That obligation is already binding independent of any PQC-specific EU timeline.

Enforcement and current status

NIS2 carries real penalties (fines up to 2% of global turnover for essential entities) but for general cybersecurity risk management, not a PQC-specific requirement. No EU body currently has the power to penalize an organization specifically for missing a post-quantum migration deadline, because no such EU-level deadline has been published yet.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	ENISA's publications are technical surveys and integration studies aimed at informing the field, with no statutory force: non-binding guidance.
Deadline concreteness	0/20	No migration deadline appears in ENISA's technical publications; they describe the algorithm landscape and integration paths, not a timeline for adoption.
Scope of coverage	0/20	ENISA's work addresses the EU cybersecurity community broadly (standards bodies, vendors, member-state agencies) rather than naming a specific mandatory scope of who must comply with what.
Inventory/CBOM requirement	0/20	Neither publication names a cryptographic inventory or CBOM requirement; they focus on algorithm selection and protocol integration, not asset discovery.
Regulatory activity	10/20	ENISA is a real, named EU agency actively publishing and updating PQC guidance (including a 2024 assessment of 1,350+ organizations across 27 member states), but its own publications carry no enforcement mechanism: ENISA advises, it does not regulate.
Total	10/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

European Central Bank (ECB)
In progress, no guidance yet
A July 2026 ECB Banking Supervision letter to bank CEOs on AI-enabled cybersecurity threats notes in passing that "the adoption of post-quantum cryptography ... must start now," while explicitly stating the ECB will address quantum risk to encryption in a separate letter in due course, confirming a dedicated PQC communication is anticipated but not yet issued.
ECB Banking Supervision letter on AI-enabled cybersecurity threats (July 2026) →
European Banking Authority (EBA)
Not yet addressed, a gap to watch
Neither EBA's Guidelines on ICT and Security Risk Management (as amended for DORA, effective January 2025) nor its associated press releases mention post-quantum cryptography, quantum computing risk, or CBOM in any form.

FAQ: European Union and PQC

Does European Union have a post-quantum cryptography (PQC) law?: No. Nothing published for European Union carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is ENISA (European Union Agency for Cybersecurity).
What is European Union's PQC migration deadline?: None. No migration deadline has been published for European Union by any regulator we checked, including ENISA (European Union Agency for Cybersecurity).
Does European Union require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.