Does Spain have a post-quantum cryptography (PQC) law?

No. Nothing published for Spain carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is CCN-CERT / Centro Criptológico Nacional (CNI).

What is Spain's PQC migration deadline?

None. No migration deadline has been published for Spain by any regulator we checked, including CCN-CERT / Centro Criptológico Nacional (CNI).

Does Spain require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

ESGuidance

Spain

Spain's CCN-CERT (under CNI) issued non-binding technical recommendations (CCN-TEC 009 / BP-37) urging organizations to adopt hybrid PQC solutions 'as soon as possible.' The guidance carries no statutory mandate, no hard deadline, no defined sector scope, and no inventory/CBOM requirement.

Spain's post-quantum cryptography posture is classified as guidance, led by CCN-CERT / Centro Criptológico Nacional (CNI). It scores 10/100 on this tracker's rubric, guidance only, with little binding force yet, and that is not a measure of how secure or advanced the country actually is.

What's verified

CCN-CERT (Centro Criptológico Nacional, part of Spain's intelligence service CNI) published official recommendations, CCN-TEC 009 "Recomendaciones para una transición postcuántica segura" (Recommendations for a secure post-quantum transition), first issued December 2022 and reissued/updated as CCN-CERT Best Practices Guide BP-37 in July 2026. The document explicitly describes hybridization (combining pre-quantum and post-quantum algorithms) as "an intermediate step in the migration from current to post-quantum cryptography," and recommends organizations "use hybrid solutions as soon as possible," not as a permanent end-state. It also details the five NIST-recognized PQC algorithm families: code-based (error-correcting codes), lattice-based, hash-based, multivariate quadratic, and isogeny-based cryptography. The claim is accurate as a description of "recommendations"/"guidance" (the document itself uses "recommends," not "mandates").

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source itself uses 'recommends'/'recommendations' (CCN 'recommends the use of hybrid solutions as soon as possible'), never 'mandates' or 'requires'; it is guidance/non-binding only, so 0.
Deadline concreteness	0/20	The cited evidence only describes hybridization as 'an intermediate step' and urges adoption 'as soon as possible,' with no specific year or phased timeline given anywhere in the source, so 0.
Scope of coverage	0/20	The document is a technical best-practices guide addressed to 'organizations' generally with no defined sector or economy-wide applicability scope stated in the evidence, so 0.
Inventory/CBOM requirement	0/20	The evidence describes algorithm-family recommendations and hybridization guidance but contains no mention of a cryptographic inventory, CBOM, or even a general risk-assessment obligation, so 0.
Regulatory activity	10/20	CCN-CERT (part of CNI, a named national authority) published this guide, but the source describes only recommendations with no enforcement mechanism, fines, audits, or certification scheme mentioned, so 10.
Total	10/100	A blunt sum of the five columns to its left.

FAQ: Spain and PQC

Does Spain have a post-quantum cryptography (PQC) law?: No. Nothing published for Spain carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is CCN-CERT / Centro Criptológico Nacional (CNI).
What is Spain's PQC migration deadline?: None. No migration deadline has been published for Spain by any regulator we checked, including CCN-CERT / Centro Criptológico Nacional (CNI).
Does Spain require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.