PLRegulatedPoland
Poland's Council of Ministers adopted a national Cybersecurity Strategy in March 2026 with a dedicated section on migrating to post-quantum cryptography, including a binding task assigning the Ministry of Digital Affairs to produce a national PQC migration plan by 2029 -- a real, dated, government-adopted commitment, though the 2029 deliverable is the plan itself, not completed migration, and no specific algorithm or CBOM requirement is named.
Poland's post-quantum cryptography posture is classified as regulated, led by Rada Ministrów (Council of Ministers) / Ministerstwo Cyfryzacji (Ministry of Digital Affairs), with a migration target of 2029. It scores 46/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.
What's verified
Poland's Council of Ministers adopted the "Strategia Cyberbezpieczeństwa Rzeczypospolitej Polskiej" (Cybersecurity Strategy of the Republic of Poland) by Uchwała Nr 92 (Resolution No. 92) on 10 March 2026, published in Monitor Polski (the official government gazette) on 23 March 2026 at position 309, under the statutory authority of Article 68 of the National Cybersecurity System Act. The strategy's table of contents includes a dedicated section:
"7.2. Rozwój krajowej kryptologii, w tym migracja do kryptografii postkwantowej oraz rozwój technologii kwantowych" ("7.2. Development of national cryptology, including migration to post-quantum cryptography and development of quantum technologies")
Its body text commits to building national cryptographic capacity in response to quantum-computing risk:
"W celu zwiększenia odporności systemów informacyjnych będzie rozwijany krajowy potencjał kryptograficzny, uwzględniający wyzwania kryptografii postkwantowej... W obliczu postępu technik kryptoanalitycznych, w tym w szczególności kwantowej... Ocenie zostaną poddane nowe standardy i algorytmy kryptograficzne przyjmowane przez zagraniczne gremia pod względem trybu ich wdrażania w RP." ("To increase the resilience of information systems, national cryptographic capacity will be developed, taking into account the challenges of post-quantum cryptography... In the face of advancing cryptanalytic techniques, particularly quantum ones... New cryptographic standards and algorithms adopted by foreign bodies will be assessed with regard to their implementation in Poland.")
The strategy's implementation table assigns a concrete task with a deadline, task 3.2.1 under area "3.2 Rozwój krajowej kryptologii":
| Field | Value |
|---|---|
| Task | Opracowanie Planu migracji do kryptografii postkwantowej (Development of a Plan for migration to post-quantum cryptography) |
| Start | 2025 (ongoing task) |
| Deadline | 2029 |
| Lead institution | MC (Ministerstwo Cyfryzacji -- Ministry of Digital Affairs) |
| Cooperating institutions | ABW, MON, MRiT, SKW, NASK, IŁ, DKWOC |
| Metric | Przyjęcie Planu (Adoption of the Plan) |
A related task, 3.2.2, commits to building national quantum-key-distribution communication infrastructure (PIONIER-Q, participating in EuroQCI) with the same 2029 deadline.
What we checked and did not find
The strategy names no specific PQC algorithm (no Kyber, Dilithium, ML-KEM, ML-DSA, or FIPS 203/204 reference anywhere in the document), and its one "NIST" mention refers to the general NIST Cybersecurity Framework, not NIST's PQC standards. A direct grep of the full 74-page annex found zero occurrences of "CBOM," "SBOM," or "inwentaryzacj" (inventory) in a cryptographic-asset context. The 2029 deadline is for the Ministry of Digital Affairs to adopt a migration plan, not for migration itself to be complete. KNF, Poland's financial regulator, has published no PQC-specific circular of its own -- its own site search for "kryptografia postkwantowa" and "kwantowa" returns no results.
Score rationale
Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.
| Axis | Score | Why |
|---|---|---|
| Mandate strength | 12/20 | The Strategy was adopted by formal Council of Ministers resolution (Uchwała Nr 92) under statutory authority (Article 68 of the National Cybersecurity System Act), making it a binding government commitment with a named lead institution (Ministry of Digital Affairs) and cooperating agencies, though it obligates the government to produce a plan rather than imposing a compliance obligation directly on private-sector entities. |
| Deadline concreteness | 10/20 | The implementation table sets a specific year (2029) as the deadline for task 3.2.1, with 2025 as the task's start year -- a real, dated deliverable, but the 2029 date is for adopting a migration plan, not completing migration, which caps this below a full mark. |
| Scope of coverage | 12/20 | Section 7.2 frames national cryptographic capacity broadly, and the migration-plan task names cooperating institutions spanning intelligence (ABW, SKW), defense (MON), digital affairs (MC), research/telecom (NASK, IŁ), and economic development (MRiT) -- a whole-of-government scope, not limited to one regulated sector. |
| Inventory/CBOM requirement | 0/20 | Neither the strategy text nor the task table names a cryptographic inventory, CBOM, or SBOM requirement -- confirmed by direct grep of the full document: zero hits for those terms. |
| Regulatory activity | 12/20 | The Council of Ministers is Poland's highest executive authority, and this is a formally adopted, gazetted national strategy with a named lead ministry and a concrete task deadline -- substantial regulatory activity, though it commits to producing a plan rather than enforcing algorithm migration itself. |
| Total | 46/100 | A blunt sum of the five columns to its left. |
Related regulators
Sector bodies checked independently, not assumed from the primary source above.
- Not yet addressed, a gap to watch
Komisja Nadzoru Finansowego (KNF)
KNF's own site search for "kryptografia postkwantowa"/"kwantowa" returns no indexed results. No financial-sector-specific PQC circular has been published.
FAQ: Poland and PQC
- Does Poland have a post-quantum cryptography (PQC) law?
- Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Rada Ministrów (Council of Ministers) / Ministerstwo Cyfryzacji (Ministry of Digital Affairs).
- What is Poland's PQC migration deadline?
- 2029. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Rada Ministrów (Council of Ministers) / Ministerstwo Cyfryzacji (Ministry of Digital Affairs).
- Does Poland require a Cryptographic Bill of Materials (CBOM)?
- No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.