Inside FinRAG
Europe set a deadline for a computer that doesn't exist yet
EU member states have agreed a roadmap to quantum-safe encryption, with a first milestone at the end of 2026. Here is what the dates mean, why the threat is already real, and what every firm should do first.
In this article
Europe has set a deadline. Not for a war or a pandemic, but for a computer that doesn't exist yet.
The roadmap
In June 2025, EU member states, supported by the European Commission, published a coordinated roadmap for the transition to post-quantum cryptography. It builds on a Commission Recommendation from April 2024 and sets three milestones, as summarized by Encryption Consulting:
| Deadline | What should happen |
|---|---|
| End of 2026 | Start: inventories of where cryptography is used, risk assessments, national plans, and pilots for high- and medium-risk use cases |
| End of 2030 | High-risk systems migrated to quantum-safe cryptography |
| 2035 | Medium-risk systems and as many low-risk systems as feasible |
It is a coordinated plan agreed by member states, not a law. But it sets the direction regulators, suppliers and auditors will follow.
Why now, if the machine isn't here?
Almost everything private online, from bank transfers to medical records, is protected by public-key cryptography. A large enough quantum computer could one day break it.
That machine does not exist yet. The risk is that data stolen today can be stored and decrypted later, once it does. Security experts call this harvest now, decrypt later.
That is why the roadmap treats long-lived secrets as high risk: anything that must stay confidential for around ten years or more is already exposed in principle.
The new locks already exist
In August 2024, the US standards body NIST published the first post-quantum cryptography standards:
- ML-KEM (FIPS 203): key exchange
- ML-DSA (FIPS 204): digital signatures
- SLH-DSA (FIPS 205): backup signature scheme
The tools are available. The hard part is the switch.
What this means for financial firms
Our reading: the first deadline is not about replacing everything. It is about knowing what you have.
- Build a cryptographic inventory. Where is encryption used across your systems, vendors, broker links and data stores?
- Classify by lifetime. Which data must stay confidential for 10 years or more?
- Ask your vendors. When will their products support the NIST standards?
- Design for agility. Can you swap algorithms without rebuilding systems?
- Pilot early. Test post-quantum key exchange on one high-value link before 2027.
So, one question for every firm: do you know where your encryption is?
References
- European Commission: Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, June 23, 2025
- European Commission: Post-quantum cryptography policy page
- Encryption Consulting: EU roadmap milestones
- CoinDesk: EU financial watchdogs warn on quantum risk, September 24, 2026
Milestone details are summarized from secondary sources; the full roadmap PDF is linked on the Commission page. The video narration is an AI voice (ElevenLabs). FinRAG.tech has no connection to the bodies mentioned. This article is commentary, not legal, investment or security advice.
Worth sharing?
Pass this article along to someone who would find it useful.
The work continues in the studio.
More build notes, walkthroughs, and perspectives from the FinRAG team.
Explore all stories
