Does Netherlands have a post-quantum cryptography (PQC) law?

No. Nothing published for Netherlands carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is AIVD (Algemene Inlichtingen- en Veiligheidsdienst) and NCSC (Nationaal Cyber Security Centrum).

What is Netherlands's PQC migration deadline?

2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from AIVD (Algemene Inlichtingen- en Veiligheidsdienst) and NCSC (Nationaal Cyber Security Centrum).

Does Netherlands require a Cryptographic Bill of Materials (CBOM)?

Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.

NLGuidance

Netherlands

The Netherlands has no binding PQC mandate; AIVD and NCSC jointly issued January 2024 guidance urging organizations to inventory cryptographic assets (including via CBOM) and migrate before quantum computers can break common algorithms, expected between 2030 and 2040.

Netherlands's post-quantum cryptography posture is classified as guidance, led by AIVD (Algemene Inlichtingen- en Veiligheidsdienst) and NCSC (Nationaal Cyber Security Centrum), with a migration target of 2030. It scores 50/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

The AIVD (Algemene Inlichtingen- en Veiligheidsdienst, the Dutch General Intelligence and Security Service) and NCSC (Nationaal Cyber Security Centrum) jointly published a January 2024 guide, "Kicking off your quantum migration program," stating that the general expert view is that quantum computers will probably have sufficient computing power to break many of the most common cryptographic algorithms by 2030 to 2040, and that it is time for organizations to take action and prepare for migration to quantum-safe cryptography, specifically by conducting a risk analysis, mapping/inventorying cryptographic assets (crypto asset management, e.g. via a Cryptographic Bill of Materials/CBOM), assessing risks, and drawing up a migration plan.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source is a jointly published AIVD/NCSC guidance document using recommendation language ('it is time... start preparing', 'we recommend') rather than any statutory or regulatory mandate with penalties, so this scores 0 per the rubric's non-binding guidance tier.
Deadline concreteness	10/20	The guide gives a bounded expert-consensus window ('probably have sufficient computing power to break many of the most common cryptographic algorithms by 2030 to 2040') rather than a single hard deadline, matching the rubric's 10-point tier for phased/directional timing without one specific year.
Scope of coverage	10/20	The evidence addresses 'organisations' generally with no sector restriction or explicit economy-wide/critical-infrastructure framing stated in the source, so scope is best treated as undefined/general guidance rather than clearly economy-wide, landing at the mid-tier for addressing organizations broadly without a defined critical-infrastructure designation.
Inventory/CBOM requirement	20/20	The claim explicitly names crypto-asset mapping/inventorying (including 'e.g. via a Cryptographic Bill of Materials/CBOM') as one of the four concrete steps in the guide's structure, directly matching the rubric's 20-point tier for an explicit inventory/CBOM mandate named in the source.
Regulatory activity	10/20	AIVD and NCSC are named authorities that jointly issued the guidance, but the source describes only a recommendation document with no published enforcement mechanism (no fines, audits, or certification scheme mentioned), matching the rubric's 10-point tier of a named authority without visible enforcement teeth.
Total	50/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

De Nederlandsche Bank (DNB)
Has published guidance
DNB's "Good Practice Information Security 2023" (current supervisory guidance, last updated August 2025) goes well beyond a passing mention: it directs institutions to maintain "an inventory of the cryptographic landscape (encryption protocols and certificates for network connections, key management and data storage)" recording protocol lifetimes, to carry out an "annual Cryptography Risk Assessment," and to analyze cryptographic risk over 1/1-5/greater-than-5-year horizons that explicitly account for "the development of Quantum computing." This is real, dated, cryptographic-inventory-equivalent supervisory expectation, not a one-line mention.
Good Practice Information Security 2023 →Read the full breakdown →
AFM (Authority for the Financial Markets)
Has published guidance
AFM's Trendzicht 2026 (Trend Outlook 2026, published November 2025) explicitly flags that quantum computers could in principle break the non-quantum-proof encryption algorithms financial institutions use to protect data confidentiality, and states that addressing this risk will require significant effort and investment. This is a strategic risk acknowledgment in AFM's own annual outlook document, not a migration mandate or cryptographic inventory requirement.
Trendzicht 2026 (Trend Outlook 2026) →Read the full breakdown →

FAQ: Netherlands and PQC

Does Netherlands have a post-quantum cryptography (PQC) law?: No. Nothing published for Netherlands carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is AIVD (Algemene Inlichtingen- en Veiligheidsdienst) and NCSC (Nationaal Cyber Security Centrum).
What is Netherlands's PQC migration deadline?: 2030. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from AIVD (Algemene Inlichtingen- en Veiligheidsdienst) and NCSC (Nationaal Cyber Security Centrum).
Does Netherlands require a Cryptographic Bill of Materials (CBOM)?: Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.