Germany sets 2030 deadline for quantum-safe encryption in high-risk systems

Germany sets 2030 deadline for quantum-safe encryption in high-risk systems

12 October 2026: Germany has published its national guideline for moving to post-quantum cryptography, confirming the European timetable: systems with a high risk should switch to quantum-safe methods as early as possible and complete the move by the end of 2030, and the whole transition should be largely finished by 2035. The Federal Ministry of the Interior, the Federal Ministry for Digital Affairs and State Modernisation and the BSI, the federal cyber security agency, released it jointly from Bonn on 12 October.

Not yet independently verified. We read the BSI announcement, not the guideline PDF itself. The guideline recommends deadlines; it is not a law, and which bodies make them binding, and when, rests on heise's reading. We will update this when it can be confirmed, and remove this note.

Who the guideline addresses

The BSI names federal, state and municipal administrations as the main audience, together with organisations and companies, among them operators of critical infrastructure. It implements a roadmap that EU member states agreed for a coordinated switch, which asked each country for a national plan.

The threat it answers is that a sufficiently capable quantum computer would break the public-key methods behind most encrypted connections and signatures today. Data captured now can be stored and decrypted later, which is why long-lived secrets and high-risk systems come first.

Five measures it recommends

The BSI summarises the guideline's recommendations as:

• clear responsibilities and binding deadlines for the switch inside each organisation;
• post-quantum cryptography in line with the state of the art;
• a systematic assessment of quantum risk, anchored in risk management;
• early involvement of vendors and supply chains;
• crypto-agility, meaning systems, procurement and risk processes built so that algorithms or settings such as key lengths can be swapped quickly when knowledge or threats change.

The agency ties the last point to artificial intelligence, which it says is speeding up research into attacks on cryptographic methods.

According to heise's reading of the document, the guideline runs to only a few pages of substance, recommends hybrid schemes that combine classical and post-quantum algorithms, and calls for an inventory of cryptographic components. It also says the responsible bodies should adopt the deadlines bindingly before the end of 2026.

Where companies are likely to feel it first

For a company that is not a public body, the guideline has no legal force on its own. It reaches suppliers through procurement: an administration that adopts binding deadlines will ask vendors of software, network equipment and managed services when their products support post-quantum methods, and critical infrastructure operators already report to the BSI. A crypto inventory, listing where certificates, keys and libraries sit, is the step every later deadline depends on and the one most organisations have not taken.

Our enterprise architecture software category lists nine products, the kind of tools teams use to map where cryptography sits across their systems.

Sources

• BSI press release: Umstellung auf Post-Quanten-Kryptografie, Leitlinie zur nationalen Umsetzung der EU-Roadmap veröffentlicht (in German), 12 October 2026
• heise online: Bund veröffentlicht Leitlinie zur Umstellung auf Post-Quanten-Kryptografie (in German), 15 October 2026