Does Norway have a post-quantum cryptography (PQC) law?

No. Nothing published for Norway carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Nasjonal sikkerhetsmyndighet (NSM), Norway's National Security Authority.

What is Norway's PQC migration deadline?

None. No migration deadline has been published for Norway by any regulator we checked, including Nasjonal sikkerhetsmyndighet (NSM), Norway's National Security Authority.

Does Norway require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

NOGuidance

Norway

Norway's National Security Authority (NSM) publishes non-binding quantum-migration guidance urging critical-sector organizations to map their cryptographic assets and begin transitioning now, but sets no deadline and no enforcement mechanism.

Norway's post-quantum cryptography posture is classified as guidance, led by Nasjonal sikkerhetsmyndighet (NSM), Norway's National Security Authority. It scores 30/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

Norway's National Security Authority (Nasjonal sikkerhetsmyndighet, NSM) publishes official guidance directing Norwegian organizations to carry out "kvantemigrasjon" (quantum migration), risk-assessing IT systems for quantum vulnerabilities and transitioning to quantum-safe cryptography. This lives under a dedicated "Kvantemigrasjon" section on nsm.no, including an overview page, a migration guide (veileder), and a page of cryptographic recommendations.

The guidance is aimed particularly at system owners in critical sectors (telecom, finance, health, energy, petroleum) and recommends starting with a detailed mapping of an organization's cryptographic assets and risks, then migrating in a staged way to preserve operations.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source language is entirely advisory: NSM 'har råd og anbefalinger' (has advice and recommendations) and says organizations 'bør' (should) risk-assess and migrate. This is recommendatory, not obligatory, with no statute, regulation, or penalty cited.
Deadline concreteness	0/20	No year or date of any kind appears in the evidence, only that migration 'tar tid' (takes time) and organizations should start 'allerede nå' (already now), with no temporal marker at all.
Scope of coverage	10/20	Guidance is aimed particularly at public- and private-sector system owners handling sensitive information (telecom, finance, health, energy, petroleum). These are named critical sectors, not an explicit economy-wide mandate.
Inventory/CBOM requirement	10/20	The guidance recommends starting with a detailed mapping of an organization's cryptographic assets and risks. This is a general risk-assessment obligation that implies an inventory without naming CBOM or a formal mandated artifact.
Regulatory activity	10/20	NSM is clearly named as the publishing authority, but nothing in the evidence describes an enforcement mechanism: no fines, audits, or certification scheme, only guidance pages and a veileder (guide).
Total	30/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Finanstilsynet (Financial Supervisory Authority of Norway)
Has published guidance
Finanstilsynet's 2025 annual ICT risk report (ROS 2025) carries a dedicated section on quantum-computing threats to the financial sector, warning of "steal data today, decrypt later" attacks and recommending financial firms adopt new encryption algorithms as they become available. This is a real, independently authored risk analysis rather than a restatement of NSM's guidance, though general rather than CBOM-process-detailed.
Norges Bank
In progress, no guidance yet
Norges Bank's 2026 Financial Infrastructure report, a real, dated, official publication, discusses quantum threats and confirms NSM holds sector-wide advisory responsibility, but does not commit Norges Bank itself to issuing PQC migration recommendations or define a cryptographic-inventory requirement of its own.
Financial Infrastructure Report 2026 →

FAQ: Norway and PQC

Does Norway have a post-quantum cryptography (PQC) law?: No. Nothing published for Norway carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Nasjonal sikkerhetsmyndighet (NSM), Norway's National Security Authority.
What is Norway's PQC migration deadline?: None. No migration deadline has been published for Norway by any regulator we checked, including Nasjonal sikkerhetsmyndighet (NSM), Norway's National Security Authority.
Does Norway require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.