Does Germany have a post-quantum cryptography (PQC) law?

No. Nothing published for Germany carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is BSI (Bundesamt für Sicherheit in der Informationstechnik), Federal Office for Information Security.

What is Germany's PQC migration deadline?

None. No migration deadline has been published for Germany by any regulator we checked, including BSI (Bundesamt für Sicherheit in der Informationstechnik), Federal Office for Information Security.

Does Germany require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

DEGuidance

Germany

Germany's BSI has published detailed, technically specific PQC migration guidance, including a hybrid-cryptography requirement for high-security applications, but the source is explicitly non-binding recommendations with no statutory mandate, no stated deadline year, undefined scope, and no named inventory/CBOM obligation.

Germany's post-quantum cryptography posture is classified as guidance, led by BSI (Bundesamt für Sicherheit in der Informationstechnik), Federal Office for Information Security. It scores 10/100 on this tracker's rubric, guidance only, with little binding force yet, and that is not a measure of how secure or advanced the country actually is.

What's verified

BSI states that from its point of view, the question of "whether" or "when" there will be quantum computers is no longer in the foreground, and that post-quantum cryptography will become the standard in the long term. The BSI does not recommend using post-quantum cryptography alone, but only "hybrid" (in combination with classical algorithms) where possible, and requires hybrid solutions for high-security applications. The document (Section 3, "Recommendations for action") frames this as guidance for organizations to begin considering, at an early stage and within their risk management processes, when and how to migrate, consistent with "organizations should begin migration planning now."

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source is a BSI 'recommendations for action' document: it 'does not recommend using post-quantum cryptography alone, but only hybrid if possible,' and even the strongest clause ('the BSI requires the use of hybrid solutions' in high-security applications) is a technical specification requirement within guidance, not a cited statutory or regulatory mandate with penalties, so this scores 0 per the rubric's 'guidance/non-binding only' tier.
Deadline concreteness	0/20	The evidence contains no specific year or phased timeframe at all, only open-ended language that PQC 'will become the standard in the long term' and that organizations should consider migration 'at an early stage,' with no year or date anywhere in the cited text.
Scope of coverage	0/20	The evidence does not define a scope of economy-wide, sector-specific, or government-only coverage: it speaks generically to 'organizations' and 'high-security applications' without identifying which sectors or entities are covered, so scope is undefined in the source provided.
Inventory/CBOM requirement	0/20	The evidence makes no mention of a cryptographic inventory, CBOM, or even a general risk-assessment obligation. It only says organizations should consider 'when and how to migrate... within their risk management processes,' which falls short of the rubric's bar for an implied inventory requirement since no inventory or assessment obligation is actually named.
Regulatory activity	10/20	BSI is a named federal authority (Bundesamt für Sicherheit in der Informationstechnik) issuing this document, but the evidence describes only recommendations and a requirement for hybrid solutions in high-security contexts, and no enforcement mechanism (fines, audits, certification) is cited, matching the rubric's 'named authority, no visible enforcement teeth yet' tier.
Total	10/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

BaFin (Federal Financial Supervisory Authority)
Has published guidance
BaFin's annual "Risiken im Fokus 2025" report includes a dedicated section, "Quantencomputing: Schutzmaßnahmen jetzt notwendig" (Quantum Computing: Protective Measures Now Necessary), warning that quantum computers threaten RSA/ECC and recommending PQC standards. This is genuine BaFin analysis, but a risk-awareness publication rather than a circular imposing inventory or migration obligations.
Deutsche Bundesbank
In progress, no guidance yet
Bundesbank participated in the BIS Innovation Hub's "Project Leap" (hybrid post-quantum encryption trials between central bank payment systems) and co-signed the November 2025 G7 Cyber Expert Group statement on a coordinated PQC roadmap. This is real, dated technical/multilateral activity, but the G7 statement explicitly states it "does not set guidance or regulatory expectations," and no independent Bundesbank circular exists.
"Project Leap proves the viability of a quantum-safe financial system" →

FAQ: Germany and PQC

Does Germany have a post-quantum cryptography (PQC) law?: No. Nothing published for Germany carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is BSI (Bundesamt für Sicherheit in der Informationstechnik), Federal Office for Information Security.
What is Germany's PQC migration deadline?: None. No migration deadline has been published for Germany by any regulator we checked, including BSI (Bundesamt für Sicherheit in der Informationstechnik), Federal Office for Information Security.
Does Germany require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.