Germany Issues Joint Federal PQC Migration Guidelines to Align with EU Post-Quantum Roadmap

The German Federal Ministry for Digital and State Modernization (BMDS), the Federal Ministry of the Interior (BMI), and the Federal Office for Information Security (BSI) have officially published their joint national guidelines (“Leitlinie zur Umstellung auf PQC“) detailing Germany’s strategy to migrate public and private digital infrastructure to Post-Quantum Cryptography (PQC). Following the formal release of the guidelines, the BSI issued an official press release highlighting that the national implementation framework directly operationalizes the European Union’s “Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,” adopted by NIS Workstream member states in June 2025. The publication emphasizes that rapid advancements in artificial intelligence (AI) are accelerating security research and attack methodologies against classical public-key encryption schemes (RSA, ECC), underscoring the necessity for crypto-agility—the ability to dynamically update cryptographic primitives and key lengths without disrupting underlying system architectures. [ Germany Federal PQC Migration Timeline & Risk Classifications ]Migration Phase & DeadlineTarget Risk Category & SystemsMandatory Technical Action Items• Phase 1: Readiness(Target: End of 2026)• All Federal, State, Municipal, and Critical Infrastructure (KRITIS) Entities• Establish cryptographic inventories (CBOMs) and Cryptographic Catalogs.• Formalize governance bodies and appoint responsible migration leads.• Adopt legally binding deadlines via IT-Planungsrat and UP KRITIS.• Phase 2: High-Risk Migration(Mandatory Deadline: 2030)• High-Risk Systems: Classified IT (VS-IT), long-term confidentiality data (“Store Now, Decrypt Later”), and critical infrastructure control.• Complete transition to BSI TR-02102 compliant post-quantum algorithms.• Enforce hybrid key exchange mechanisms (combining classical + PQC).• Deploy quantum-safe PKI and firmware/software update channels.• Phase 3: Full Migration(Target Deadline: 2035)• Medium & Low-Risk Systems: Broad enterprise, public administrative services, and supply chain integrations.• Complete migration across nearly all digital infrastructure, legacy IT components, and supply chain dependencies. To address immediate threat vectors—specifically “Store Now, Decrypt Later” risks for long-lived sensitive data and long replacement cycles for legacy systems—the guidelines enforce compliance with Technical Guideline BSI TR-02102, emphasizing hybrid cryptographic mechanisms that pair classical algorithms with NIST-standardized PQC algorithms. Under Section 30 of the BSI Act (BSIG), operators of critical and essential infrastructure are required to incorporate PQC readiness into their formal risk management frameworks. Review the official announcement on the BSI Pressroom here and examine the complete guidance document on the BSI Publication Portal here. In GQI Portal The players behind the news The team that writes QCR tracks every company, deal and technology in the GQI Factory, GQI's verified database of the quantum industry. Next up: every story linked to its players, coming to QCR's paid plans. Players →Companies and institutions across the quantum industry, by segment. Scorecards →How the players compare on hardware, software, funding and more. Newsletter QCR Alerts in your inbox The latest reporting and analysis from Quantum Computing Report. Free, unsubscribe any time. Sign up for QCR Alerts Leave a commentCancel replyAll fields are required. Your email address will not be published.CommentName Email Type in the text displayed above Δ