Post-quantum readiness
Data can stay sensitive for years. Signed documents may need to remain verifiable for decades. Devices can depend on long-lived trust anchors. Discover where those lifetimes outlast your cryptography.
Two different risks. One inventory to start from.
PQC migration concerns what others can read and what your systems will accept as genuine.
Confidentiality
Traffic recorded today could be decrypted by a future quantum computer capable of breaking the key establishment used to protect it.
Sensitive communications · Long-lived records
What must remain confidential for years?
Authenticity & integrity
A future quantum attacker could use a vulnerable public key to forge signatures. Systems that still trust that key could accept forged documents, malicious software or false credentials.
Signed PDFs · Legal agreements · Archives · Firmware · Certificates
What will still be trusted years from now?
Historical signature validation also depends on trusted timestamps and preserved evidence. Future forgery does not automatically invalidate every past signature. Long-term signature validation (RFC 9321). NIST guidance on the PQC transition. Signature-risk terminology in an IETF PQUIP presentation.
Identify both kinds of exposureStandards and transition guidance
NIST proposes an algorithm transition schedule; the EU roadmap sets milestones for Member States and high-risk use cases. Check applicability to your systems before treating a date as your deadline.
By the end of 2026 Member States are expected to have a national transition strategy under way, including the first steps of inventory and risk assessment. European Commission.
Under the proposed schedule, RSA-2048 and other 112-bit parameter sets are deprecated for new use after 2030. NIST IR 8547 ipd.
The roadmap sets the end of 2030 as the deadline for high-risk use cases, including critical infrastructure, to have completed the transition. European Commission.
Under the proposed schedule, RSA, ECDSA, ECDH and the other quantum-vulnerable public-key algorithms are disallowed in NIST guidance after 2035. NIST IR 8547 ipd.
The roadmap aims for the transition to be completed across Europe by 2035, with an acknowledgement that some legacy and lower-risk systems may take longer. European Commission.
2024 · NIST
NIST publishes ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). From this point the replacement algorithms exist as standards, and vendors can be asked when they will support them. NIST.
2024 · NIST
NIST IR 8547 (initial public draft) proposes deprecating quantum-vulnerable algorithms at the 112-bit security level, such as RSA-2048, after 2030 and disallowing all quantum-vulnerable public-key algorithms after 2035. NIST IR 8547 ipd.
2024 · European Union
The European Commission's Recommendation of 11 April 2024 on a coordinated implementation roadmap for the transition to post-quantum cryptography starts the EU-wide effort. European Commission.
2025 · European Union
On 23 June 2025 the NIS Cooperation Group publishes the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, with three dated milestones. European Commission.
NIST’s proposed algorithm transition schedule and the EU coordinated roadmap serve different audiences. A shared year does not make them the same requirement. Review the applicable framework, the risk of the system and the time needed for its suppliers to deliver a change.
The NIST draft remains a proposal. The EU roadmap asks Member States to begin transitioning by the end of 2026 and prioritizes high-risk use cases by 2030. Dutch NCSC guidance advises organizations to inventory cryptographic assets, assess risk and prepare a migration plan.
Signed PDFs, legal agreements and archived records may need to prove authenticity long after the software that created them has changed. Include signing certificates, timestamp services, validation software and preservation processes in your assessment.
A future quantum attacker could forge signatures under a vulnerable public key. That does not automatically invalidate every earlier document: historical validation depends on trustworthy timestamps and preserved evidence. Preservation must also account for weakening algorithms and renewal before protection fails. See NCSC guidance on signature threats and RFC 4998 on long-term evidence preservation.
Cryptoramic can inventory cryptographic metadata from supported signed PDFs to help scope this work. Discovery does not validate a document’s signature or establish its legal effect. Review the affected signing and archive workflows with their owners and trust-service providers.
Long-lived confidential information can be exposed to harvest-now-decrypt-later attacks. Supplier release cycles and operational maintenance windows may also take longer than the technical replacement itself. Identify those dependencies early; a deadline alone does not tell you which change comes first.
The animation compares realistic, pessimistic, optimistic and delayed scenarios using illustrative data. It shows how a time-based view supports investigation; it does not predict when a cryptographically relevant quantum computer will exist.
Choose one application, image or network segment and ask: which cryptography is present, which requirements apply, and which changes depend on someone else? Review findings with the owner, agree an action and verify it before widening the scope.
See a worked assessment, explore regulatory frameworks or scope a first assessment.
There is no single deadline for every organization. NIST’s draft proposes phasing out weaker algorithms such as RSA-2048 after 2030, and disallowing quantum-vulnerable public-key algorithms after 2035. The EU has separate milestones, including 2030 for high-risk uses. Check which requirements apply to your services before setting a deadline.
The 2026 milestone is for Member States to start their transition, not for every organization to finish migrating. The EU roadmap also calls for high-risk uses to move by the end of 2030. Organizations should begin identifying their cryptography and risks, then check the national and sector requirements that apply to them.
An attacker saves encrypted information today, hoping a future quantum computer will let them read it. This matters most for information that must stay confidential for years, such as medical records or long-term business secrets. Find where that information is protected and plan to replace vulnerable cryptography before it can be collected.
A future quantum computer could let an attacker forge digital signatures that your systems still accept as genuine. That could affect signed PDFs, legal agreements, archives, software updates and certificates. Plan how long those signatures need to remain trustworthy. Trusted timestamps and preserved validation records can help establish when an older signature was valid; existing signatures do not all become invalid automatically.
Find the cryptography used by one important service and identify who can act on the findings. Start with its certificates, keys, software and connections. Use the results to decide what you can change yourself and where you need supplier support.
Tell us which systems carry your highest-risk data. We will show what discovery finds there and what the dates mean for it.
We use optional analytics to understand site usage. Tracking stays off until you agree. Privacy notice
