Regulatory framework
Quantum-resistant cryptography is not yet mandatory, but the EU timeline is written. And the rules in force already require links to be well encrypted.
NIS2 and DORA already require cryptography
The rules in force do not name algorithms. They require encryption of the data exchanged, key management, and cryptography kept up to the state of the art.
2024
NIS2 in Italy
Legislative Decree 138/2024 transposes the NIS2 Directive: the security measures of essential and important entities include policies and procedures on the use of cryptography and, where appropriate, encryption.
2025
DORA, financial sector
Since 17 January 2025, the DORA Regulation and its technical standards require encryption rules for data in transit, key management throughout the key lifecycle, and updates to cryptography as cryptanalysis advances.
2026
ACN, TLS guidelines
Since May 2026, Italy’s National Cybersecurity Agency recommends the X25519 plus ML-KEM-768 hybrid key exchange for TLS, against those who record today to decrypt tomorrow.
The EU timeline for the new algorithms
These are reference dates: the European Commission sets them for Member States, NIST for US federal systems.
2024
NIST
First quantum-resistant standards published: FIPS 203 for keys and FIPS 204 for signatures.
2024
EU Recommendation
The Commission asks Member States for a coordinated roadmap for the move to the new algorithms.
End of 2026
European Union
Member States start the transition and prepare their first national plans.
End of 2030
European Union
High-risk uses move to the new algorithms, such as data that must stay confidential for ten years or more. Devices in use beyond 2030 should be able to adopt them.
2035
EU and NIST
EU target for as many systems as possible. For NIST, RSA and elliptic curves are deprecated after 2030 and disallowed after 2035.
The EU recommendation and roadmap are non-binding acts addressed to Member States.
Public standards onlyThe risk may already be here
The European Commission notes that data that must stay confidential for a long time may already be at risk if it is not adequately protected today. Three durations are enough to tell.
Source: European Commission ↗The three durations
-
How long the data must stay confidential
For much data, a long time
-
How long the move to the new algorithms takes
To be planned in good time
-
When Q-Day will come
Unknown
If the first duration plus the second exceeds the third, the risk is already here.
Illustrative diagram: the lengths do not represent values.
Plants that stay in service for decades
Networks, plants and control systems last for decades and are not replaced all at once. That is why the move is planned ahead of the reference dates, one link at a time.
Reference dates, compared with the service life of systems
- 2024 NIST standards and EU Recommendation
- 2026 Start in the Member States
- 2030 High-risk uses
- 2035 As many systems as possible
Critical infrastructure in operation: decades. Illustrative diagram. Reference dates: European Commission and NIST.
Contact usContact us
A few lines on your context are enough: we will get back to you for a first meeting.
Thank you.
We have received your request.
We will get back to you to arrange a first meeting.
The form uses JavaScript. You can write to us directly at info@crystallis.eu