LVGuidanceLatvia
Latvia's national NIS2 cybersecurity authority published Cryptography Guidelines (September 2025) recommending organizations prepare for post-quantum cryptography via hybrid classical-PQC implementations, and the Ministry of Defence separately joined the EU-funded QARC pilot project to develop a national PQC implementation roadmap -- real, dated activity, but both are advisory rather than binding, and neither names a compliance deadline or CBOM requirement.
Latvia's post-quantum cryptography posture is classified as guidance, led by cyber.gov.lv (Latvia's NIS2 cybersecurity authority, under the Ministry of Defence). It scores 23/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.
What's verified
Latvia's national NIS2 cybersecurity authority (cyber.gov.lv, operating under the Ministry of Defence) published "Kriptogrāfijas vadlīnijas" (Cryptography Guidelines), Version 1.0, dated 12 September 2025. Under its asymmetric-encryption/PKI section, the guideline recommends preparing for post-quantum cryptography via hybrid implementations:
"Gatavošanās postkvantu (Post-quantum) kriptogrāfijai: ieviešana hibrīdajiem risinājumiem, kas kombinē klasiskos algoritmus (piemēram, RSA vai ECDSA) ar postkvantu kriptogrāfijas algoritmiem, lai sagatavotos nākotnes drošības izaicinājumiem." ("Preparing for post-quantum cryptography: implementing hybrid solutions that combine classical algorithms (such as RSA or ECDSA) with post-quantum cryptographic algorithms, in order to prepare for future security challenges.")
Separately, Latvia's Ministry of Defence joined QARC (Quantum-Resistant Cryptography in Practice), an EU-funded pan-European PQC pilot project (January 2026-December 2028, 14 partners across 11 countries including Ukraine, Ireland, Latvia, Czech Republic, Estonia, Spain, Norway, the Netherlands, Slovakia, Switzerland, and France), receiving approximately EUR 237,000 in funding. Per public reporting on the project, the Ministry's role is to identify necessary regulatory amendments in advance, assess the readiness of Latvia's IT infrastructure for quantum-resistant encryption, and work with other European cybersecurity institutions to devise a roadmap for implementing PQC solutions domestically.
What we checked and did not find
The Cryptography Guidelines use "ieteicams" (recommended) rather than binding language throughout the PQC clause -- this is advisory guidance, not an enforceable requirement, and carries no compliance deadline. QARC is a funded research and pilot commitment to eventually produce a national roadmap, not a published roadmap itself, and its 2026-2028 project timeline is not a national compliance deadline. Neither document names a cryptographic-inventory or CBOM requirement. Latvijas Banka, Latvia's central bank, has published no PQC-specific circular of its own.
Score rationale
Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.
| Axis | Score | Why |
|---|---|---|
| Mandate strength | 3/20 | The guideline uses 'ieteicams' (recommended) rather than binding language for its PQC-preparation clause -- advisory guidance, not a compliance requirement, and QARC is a research/pilot project commitment, not a regulation. |
| Deadline concreteness | 2/20 | Neither the guideline nor the QARC project commitment attaches a specific compliance year or migration deadline; QARC itself runs January 2026 to December 2028 as a project timeline, not a national compliance deadline. |
| Scope of coverage | 10/20 | The Cryptography Guidelines are addressed broadly to organizations generally (not one regulated sector), giving them wide intended reach as national guidance, though non-binding. |
| Inventory/CBOM requirement | 0/20 | Neither document names a cryptographic inventory or CBOM requirement. |
| Regulatory activity | 8/20 | cyber.gov.lv (Latvia's national NIS2 authority) published a dated, versioned technical guideline naming post-quantum cryptography directly, and the Ministry of Defence has a real, funded commitment (~EUR 237,000 via QARC) to produce a national PQC implementation roadmap -- genuine institutional activity, though neither has yet converted into a binding rule. |
| Total | 23/100 | A blunt sum of the five columns to its left. |
Related regulators
Sector bodies checked independently, not assumed from the primary source above.
- Not yet addressed, a gap to watch
Bank of Latvia (Latvijas Banka)
No central-bank circular or supervisory guidance specifically addressing post-quantum cryptography or cryptographic inventory was located.
FAQ: Latvia and PQC
- Does Latvia have a post-quantum cryptography (PQC) law?
- No. Nothing published for Latvia carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is cyber.gov.lv (Latvia's NIS2 cybersecurity authority, under the Ministry of Defence).
- What is Latvia's PQC migration deadline?
- None. No migration deadline has been published for Latvia by any regulator we checked, including cyber.gov.lv (Latvia's NIS2 cybersecurity authority, under the Ministry of Defence).
- Does Latvia require a Cryptographic Bill of Materials (CBOM)?
- No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.