Does France have a post-quantum cryptography (PQC) law?

Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is ANSSI (Agence nationale de la sécurité des systèmes d'information).

What is France's PQC migration deadline?

2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from ANSSI (Agence nationale de la sécurité des systèmes d'information).

Does France require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

FRRegulated

France

France's ANSSI has published a detailed three-phase PQC migration roadmap (hybrid-mandatory through at least 2030, standalone PQC optional only in phase 3) enforced through its security-visa/qualification scheme for security products, but the policy carries no cryptographic inventory mandate and no stated penalty regime, and applies only to vendors seeking ANSSI certification rather than economy-wide.

France's post-quantum cryptography posture is classified as regulated, led by ANSSI (Agence nationale de la sécurité des systèmes d'information), with a migration target of 2030. It scores 40/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

ANSSI published a three-phase roadmap for the PQC transition in its March 30, 2022 position paper "ANSSI views on the Post-Quantum Cryptography transition" (not in the URL/document actually cited, which redirects to a 2023 follow-up landing page; the correct primary source is https://cyber.gouv.fr/en/publications/anssi-views-post-quantum-cryptography-transition, PDF at messervices.cyber.gouv.fr/documents-guides/EN_Position.pdf). Phase 1 (today, lasting until after 2025): mandatory pre-quantum security, optional PQC, no claimed quantum resistance, hybridation mandatory. Phase 2 (not earlier than 2025, lasting until at least 2030): mandatory pre-quantum security, optional PQC now carrying claimed quantum resistance, hybridation still mandatory (except hash-based signatures, for which hybridation is optional in both phases). Phase 3 (probably not earlier than 2030): optional standalone PQC becomes possible, with optional hybridation. ANSSI explicitly states it "will not endorse any direct drop-in replacement of currently used algorithms in the short/medium term" and recommends hybrid classical+PQC schemes throughout phases 1-2. The 2023 follow-up document (Dec 21, 2023) reaffirms and updates this roadmap, noting ANSSI is accelerating the timeline (first phase-2 security visas for hybrid PQC products expected 2024-2025).

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	10/20	The source states hybridation 'will be mandatory for phases 1 and 2' for products seeking ANSSI security visas/qualifications, which is a binding requirement only for that regulated subset (vendors seeking ANSSI certification), not an economy-wide statutory mandate, hence 10, not 20.
Deadline concreteness	10/20	The roadmap gives directional phase boundaries tied to approximate years ('not earlier than 2025', 'lasting until at least 2030', 'probably not earlier than 2030') rather than a single hard-committed year, so it sits between phased language and a firm date: scored 10 per the rubric's 'phased/directional language without a hard year' tier.
Scope of coverage	10/20	The source discusses products undergoing ANSSI security visa/qualification (i.e., vendors of security products seeking ANSSI certification), a specific regulated population rather than all critical infrastructure or the whole economy, matching the 10-point 'specific regulated sectors/entities only' tier.
Inventory/CBOM requirement	0/20	None of the quoted or paraphrased evidence mentions a cryptographic inventory, asset inventory, or CBOM obligation of any kind. The document only addresses algorithm/hybridation policy per phase, so this axis scores 0 as not addressed.
Regulatory activity	10/20	ANSSI is explicitly named as the authority issuing the phased roadmap and 'security visas' for phase-2 hybrid PQC products (expected 2024-2025 per the 2023 follow-up), showing a named authority with a concrete certification mechanism, but the source provided shows no fines, audits, or penalty regime, matching the 10-point 'named authority, no visible enforcement teeth yet' tier.
Total	40/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Banque de France
Has published guidance
Via the Observatoire de la sécurité des moyens de paiement (OSMP, the payment-security oversight body it chairs), Banque de France published a dedicated study on quantum-computing risk to payment-card security in its 2023 annual report (published September 2024), recommending adoption of post-quantum algorithms and confirming it has integrated the OSMP's recommendations into its own prudential and operational supervision. It has also run PQC pilot experiments, including a cross-border post-quantum email exchange trial with the Monetary Authority of Singapore.
ACPR (Autorité de contrôle prudentiel et de résolution)
Has published guidance
An April 2026 ACPR statement discloses that it launched a 2026 cycle of consultations with financial-sector actors on PQC migration and invites institutions to advance their own migration roadmaps and resilience testing. This is an awareness/consultation-stage communication rather than a binding notice with a compliance deadline, but it is a real, independent, dated ACPR action.
AMF (Autorité des marchés financiers)
In progress, no guidance yet
Beyond a line item in its general annual risk-mapping report listing quantum computing as an emerging risk to encryption standards, AMF's own 2026 supervisory priorities release states its cybersecurity inspection program "will begin to include anticipation of the impact of quantum computing." This is a real, dated commitment to future supervisory action, not yet a published PQC/CBOM standard or migration requirement.
AMF sets its priorities for 2026 →Read the full breakdown →

FAQ: France and PQC

Does France have a post-quantum cryptography (PQC) law?: Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is ANSSI (Agence nationale de la sécurité des systèmes d'information).
What is France's PQC migration deadline?: 2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from ANSSI (Agence nationale de la sécurité des systèmes d'information).
Does France require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.