Post-Quantum Cryptography and EU Regulation: GDPR, NIS2, DORA, and CRA Implications

EU regulations don't mention "post-quantum cryptography" by name. But they require "state of the art" and "appropriate" security measures. As PQC becomes the recognized state of the art, continuing to rely solely on classical cryptography becomes a compliance gap. Here's how PQC intersects with each major regulation.

GDPR (Article 32)

"Implement appropriate technical measures... taking into account the state of the art." For data with long-term confidentiality requirements (health data, financial records), "appropriate" increasingly means PQC or hybrid encryption. A data breach involving quantum-vulnerable encryption of sensitive data — even if the decryption happens in 2035 — could be traced back to inadequate measures taken today.

NIS2 (Article 21)

NIS2 requires "state of the art" cybersecurity risk management measures including "the use of cryptography and, where appropriate, encryption." Member state transposition is explicitly referencing modern cryptographic standards. PQC readiness assessments will become part of NIS2 compliance audits.

DORA (Article 9)

Financial entities must implement "policies and procedures regarding cryptographic controls." DORA's regulatory technical standards (RTS) require encryption practices aligned with evolving threats. Financial supervisors (EBA, EIOPA, ESMA) are aware of quantum risks and will expect PQC migration plans in ICT risk management frameworks.

CRA (Essential Requirements)

The CRA requires products to use "state of the art" cryptographic mechanisms. As NIST PQC standards become widely available, products shipping only with RSA/ECC may fail to meet essential requirements. The ETSI EN 304 series standards will reference PQC as it matures.

Regulatory Timeline Intersection

• 2025-2026 — Regulators expect awareness and planning. PQC migration roadmap should exist
• 2027-2028 — "State of the art" increasingly includes hybrid PQC. Auditors start asking about PQC readiness
• 2029-2030 — PQC expected for new deployments. Classical-only encryption may be flagged as non-compliant

Action Plan

Don't wait for explicit regulatory mandates. Build your PQC migration into your existing compliance programs: add PQC to your ICT risk register (DORA), include PQC in your security measures documentation (GDPR), reference PQC in your cryptographic policy (NIS2), ensure new products support PQC (CRA). The regulatory expectation is clear — the migration timeline is yours to choose, but it must start.