Does Luxembourg have a post-quantum cryptography (PQC) law?

No. Nothing published for Luxembourg carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Ministère d'État (Luxembourg government).

What is Luxembourg's PQC migration deadline?

None. No migration deadline has been published for Luxembourg by any regulator we checked, including Ministère d'État (Luxembourg government).

Does Luxembourg require a Cryptographic Bill of Materials (CBOM)?

Not as a requirement, though it is named directly. Action 11 of Luxembourg's 2025 Quantum Strategy calls for "comprehensive cryptographic inventories" as the way to identify vulnerable assets and applications. It is a recommended action for stakeholders to pursue, not a mandated deliverable with a reporting obligation, and CSSF has issued nothing of its own.

LUGuidance

Luxembourg

Luxembourg's government published a national Quantum Strategy in 2025 with a dedicated PQC transition roadmap (Foundation 2025-2027, Scale-up 2027-2030, Commercial 2030+) and a named action on cryptographic inventories, but the strategy is aspirational and cross-sectoral, not a binding regulatory instrument, and the financial regulator CSSF has issued nothing PQC-specific of its own.

Luxembourg's post-quantum cryptography posture is classified as guidance, led by Ministère d'État (Luxembourg government). It scores 38/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

Luxembourg's Ministère d'État published "Luxembourg's Quantum Strategy: Accelerating Digital Sovereignty 2030" in 2025, a national strategy document with a dedicated section on transitioning to post-quantum cryptography. The strategy names eight concrete actions under its PQC section, including:

"Quantum threat analyses: Identify vulnerable assets and applications through comprehensive cryptographic inventories, enabling risk-based mitigation and cost-effective solutions."

"Comprehensive migration frameworks: Develop guidelines ensuring seamless PQC adoption with backward compatibility and minimal system disruption adopting a crypto-agility approach."

The strategy also commits Luxembourg to a national roadmap "in alignment with the European Commission's recommendation for a coordinated approach to PQC," citing the EU's April 2024 "Recommendation on a Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography." Its own roadmap sets three phases: Foundation (2025-2027), Scale-up (2027-2030), and Commercial (2030 and beyond), covering quantum computing and quantum communication infrastructure alongside the PQC transition. The document also references NIST's August 2024 PQC standards release and describes Luxembourg's intended approach as "a phased, hybrid approach combining traditional and quantum-safe cryptography."

What we checked and did not find

CSSF, the financial-sector regulator whose action would actually bind Luxembourg's banking and fund industry, has published no PQC-specific circular, FAQ, or supervisory letter -- its own site search for "quantum" surfaces only an unrelated 2022 press release. The strategy itself contains no compliance deadline, no penalty clause, and no reporting requirement for any private-sector entity; "cryptographic inventories" appears as a recommended action for stakeholders pursuing quantum threat analyses, not a mandated deliverable with a due date or an enforcement mechanism.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	5/20	The strategy uses aspirational language throughout ('Luxembourg aims to,' 'the government aims to develop') and explicitly defers a binding roadmap to future work, aligned with the EU Commission's 2024 recommendation -- it commits the government to action but imposes no obligation on any regulated entity.
Deadline concreteness	8/20	The strategy sets three named phases with year ranges (Foundation 2025-2027, Scale-up 2027-2030, Commercial 2030 and beyond) attached to concrete national infrastructure milestones, which is more specific than a vague aspiration but is a government capability roadmap, not a compliance deadline for any regulated party.
Scope of coverage	12/20	The strategy is explicitly cross-sectoral -- government, industry, financial services, and public institutions are all named as required collaborators -- broader than a single regulated sector, though nothing in it currently binds any of them.
Inventory/CBOM requirement	5/20	Action 11's 'Quantum threat analyses' item explicitly names 'comprehensive cryptographic inventories' as the mechanism to 'identify vulnerable assets and applications' for risk-based mitigation -- a real, named inventory concept, but as a recommended action for stakeholders to pursue, not a mandated deliverable with a reporting obligation.
Regulatory activity	8/20	The Ministère d'État is a real national authority publishing a dated, substantive strategy document with named actions and a research-and-standardization commitment (referencing NIST's 2024 PQC standards and ENISA alignment), but CSSF -- the regulator that would actually enforce anything -- has published nothing, so regulatory activity here is strategic/ministerial rather than supervisory.
Total	38/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Commission de Surveillance du Secteur Financier (CSSF)
Not yet addressed, a gap to watch
CSSF's own site search for "quantum" returns only an unrelated November 2022 press release. No PQC-specific circular, FAQ, or supervisory guidance has been issued for the financial sector.

FAQ: Luxembourg and PQC

Does Luxembourg have a post-quantum cryptography (PQC) law?: No. Nothing published for Luxembourg carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Ministère d'État (Luxembourg government).
What is Luxembourg's PQC migration deadline?: None. No migration deadline has been published for Luxembourg by any regulator we checked, including Ministère d'État (Luxembourg government).
Does Luxembourg require a Cryptographic Bill of Materials (CBOM)?: Not as a requirement, though it is named directly. Action 11 of Luxembourg's 2025 Quantum Strategy calls for "comprehensive cryptographic inventories" as the way to identify vulnerable assets and applications. It is a recommended action for stakeholders to pursue, not a mandated deliverable with a reporting obligation, and CSSF has issued nothing of its own.