Preparing for the post-Quantum era: industry input vital to success of EU’s plans

With the UN’s declaration of 2025 as the Year of Quantum, Europe appears to share the priority with the release of the EU Roadmap for Post-Quantum Cryptography (PQC) and the upcoming EU Quantum Strategy (due 2 July 2025). The two announcements, released within a fortnight of one another reflect a Union that plans a coordinated approach to quantum technologies; one that positions security, innovation, and industry at its core. Yet, the success of these initiatives hangs on the role of industry in the follow-up. Both initiatives will only succeed if industry plays a central role in shaping realistic, actionable plans that reflect market needs, technical dependencies, and the investment required to move quantum technologies from lab to large-scale deployment.

 

On 23 June, EU Member States, via the NIS Cooperation Group and with Commission support, adopted a 10-year PQC Roadmap. The aim: to prepare critical digital infrastructure for the emerging threat posed by quantum computers, which once operational, could break widely used cryptographic standards, thus compromising government communications, financial systems, and critical infrastructure impacting sectors as diverse as telecommunications, connectivity, 5G+ technology and automotive. Today’s sensitive data is already at risk, even before the quantum technology is available, due to “harvest now, decrypt later” attacks. The message is clear: pre-emption is no longer optional. Both governments and industry must now act to secure long-term digital trust.

 

What is the PQC Roadmap for?

The roadmap is intentionally high-level, setting the foundation for a more detailed roadmap to follow to be completed, in theory, with industry input. The current roadmap can be broken down into three phases:

 

Phase 1 – Preparation (Now–2026)

• Member States must implement First Steps: stakeholder coordination, cryptographic asset inventories, dependency mapping, and quantum risk assessments.
• Develop national awareness programmes and draft initial national PQC transition plans.
• Launch planning and pilot projects for high- and medium-risk use cases.
• Deadline: 31 December 2026

 

Phase 2 – Implementation (2026–2030)

• Member States must implement Next Steps: integrate PQC into certification schemes, procurement processes, and regulations.
• High-risk systems (e.g. long-term sensitive data, PKIs) must be fully transitioned to PQC.
• Quantum-safe software and firmware upgrade mechanisms must be enabled by default.
• Deadline: 31 December 2030

 

Phase 3 – Completion (2030–2035)

• Transition for medium and low-risk systems completed as far as practically feasible.
• Ongoing refinement of national strategies, testing, and support for EU and international standardisation.
• Deadline: 31 December 2035

By the end of 2026, all Member States are expected to have concrete national PQC transition plans. The Commission will monitor and coordinate progress across the EU.

 

 The EU Quantum Strategy: A Broader Vision.

The PQC Roadmap is part of a wider shift. The EU Quantum Strategy, to be released on 2 July 2025, is expected to outline a five-year plan to scale up Europe’s quantum ecosystem. It follows the 2023 European Declaration on Quantum technologies and precedes a proposed Quantum Act, expected in late 2025 or early 2026. The extent to which the Quantum Strategy will link to the PQC Roadmap is yet to be seen, but the launch of two separate quantum-related initiatives within such a short time-period raises concerns of unnecessary complications for industry involvement. Moreover, will the security aspects of quantum technologies, such as those addressed in the PQC Roadmap continue to be treated as a separate issue? The opportunities and risks faced by industry are multifaceted and the approach taken by the EU must acknowledge this, not in words, but in the actions taken. This can’t be done without taking industry, in its entirety, and placing them at the centre of the planning.

 

Concluding thoughts.

Both initiatives require meaningful industry input to be a success. For PQC, it is industry that must translate high-level timelines into concrete action, shaping the forthcoming detailed roadmap to reflect real-world dependencies, needs, and risks. The member states must listen to industry when requesting them to add the meat on the bones. This means aligning with market realities, avoiding overpromising on regulation, and investing in the ecosystem that will carry quantum technologies from lab to market.

The current awareness being shown for the realities of quantum technology and the positive and negative potential that they pose is undoubtedly a promising step forward. They reflect a clear desire to work with the realities of modern technology, but this approach must be followed with proactive steps. Member States and the Commission must bring all Quantum-relevant industry into the discussion and listen to what is needed from the experts across sectors including automotive, telecommunications, finance and IT, to name only a few, and subsequently follow this by acting on the information received.