QSC Atlas

← All countries

Germany

EU roadmap Standard-contextualiser

Germany's posture is led by the BSI, the Federal Office for Information Security, whose technical guideline TR-02102 sets the recommended algorithms and the migration path. In its 2025 and 2026 updates the BSI extended these recommendations to the quantum threat and, for the first time, fixed end-of-life dates for classical asymmetric cryptography, to be replaced by hybrid post-quantum schemes: no sole use of classical asymmetric encryption beyond end 2031, end 2030 for highly sensitive applications, and classical signatures phased out by end 2035. Deadlines have also been agreed for migrating classified government IT, and a national project plan for the transition is being drawn up. The work is coordinated with seventeen other EU member states and the EU quantum-safe roadmap, and the Federal Government set a goal of initiating migration in security-critical areas by 2026. The BSI recommends hybrid solutions and a conservative algorithm set, and its president has described the transition to post-quantum cryptography as without alternative.

Governance credibility

Governance credibility for GermanyA six-axis reading out of two: Relevance 2.0 / 2, Coherence 2.0 / 2, Effectiveness 1.5 / 2, Efficiency 2.0 / 2, Governance 2.0 / 2, Impact 2.0 / 2.RelCohEffEff.GovImp
Governance credibility scores for Germany, each out of two. Hover or focus a row to highlight its axis.
CriterionScoreConfidence
Relevance2.0 / 2High
Coherence2.0 / 2High
Effectiveness1.5 / 2High
Efficiency2.0 / 2High
Governance2.0 / 2High
Impact2.0 / 2High

Regulatory basis

  • NIS2 Directive (EU) 2022/2555, Art. 21(2)(h) EU Binding law
  • DORA, Regulation (EU) 2022/2554 (financial sector) EU Binding law
  • BSI TR-02102 technical guidelines (now setting dated end-of-life deadlines for classical asymmetric cryptography) national Guidance
  • BSI migration roadmap and recommendations national Guidance

Legal status: Binding

Essential and important entities must use state-of-the-art cryptography under NIS2; the BSI technical guidelines (TR-02102) set the recommended algorithms and hybrid deployment that public-sector procurement and certification follow, though the guidelines are not themselves statute.

Standards and algorithms

Standard families
BSI TR-02102
Algorithms
ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, Classic McEliece, XMSS, LMS

Hybrid stance

Recommended

Migration timeline

today
2026
2030
2031
2035
20252036
  1. 2026Federal Government goal to initiate migration in security-critical areas
  2. 2030Highly sensitive applications: classical asymmetric encryption no longer used on its own; high-security applications migrated
  3. 2031Classical asymmetric encryption no longer used on its own
  4. 2035Classical signatures phased out

Target completion: 2035

International standards processes

  • NIS Cooperation Group co-authored the EU coordinated PQC roadmap
  • EU PQC working group (BSI with 17 other member states) co-signed the joint call and statement to transition to post-quantum cryptography

Governmental and standards bodies

  • BSI Federal Office for Information Security, sets national cryptographic recommendations
  • Bundesregierung Federal Government, set the action plan for quantum technologies and the goal to initiate migration in security-critical areas
  • Bundestag Federal parliament, reported the planned national PQC roadmap and project plan
  • Bundesrat Federal Council, addressed obligations to adopt PQC migration concepts in national cybersecurity strategies
  • Bundesbank German central bank, set out the quantum threat to banking and the 2026 migration goal
  • BMBF Federal research ministry, funds bringing post-quantum cryptography into application

Key institutional documents

Advising on this transition, or your own sector's? Request a briefing →