The EU post-quantum roadmap, read by someone who signs documents

In June 2025 the EU Member States, supported by the European Commission, adopted the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography. It was the first deliverable of the NIS Cooperation Group’s work stream on post-quantum cryptography and follows the Commission’s Recommendation of April 2024.

The two dates

The Commission summarises the roadmap’s timeline in two sentences:

“All Member States should start transitioning to PQC by the end of 2026.”European Commission, Post-Quantum Cryptography policy page

“At the same time, the protection of high-risk use cases should be transitioned to PQC as soon as possible, no later than by the end of 2030.”European Commission, Post-Quantum Cryptography policy page

Both use should. The roadmap coordinates; it does not by itself impose an obligation on a trust service provider. But it sets the expectation that public administrations, and the providers they buy from, will be asked about.

Why signatures are different from encryption

For encryption, the familiar risk is “harvest now, decrypt later”: data recorded today could be decrypted once a large quantum computer exists. Signatures carry a different risk. Once an algorithm like ECDSA can be broken, a valid-looking classical signature no longer distinguishes a genuine document from a forged one.

Long-term validation formats such as PAdES-BASELINE-LTA protect old signatures by re-sealing the evidence with archive time-stamps. That protection lasts only as long as the algorithm of the newest time-stamp holds, so the time-stamps need a post-quantum algorithm before the classical ones weaken, not after.

Which documents first

The documents with the longest lives: land and property registers, notarial deeds, court and archive records, long-term contracts, and identity documents issued to citizens. A signature made today on a record kept for thirty years will still be relied on well after 2030.

What a sensible first step looks like

1. Keep compatibility. Add a post-quantum signature without changing the classical one, so nothing breaks for relying parties.
2. Protect the time-stamps. Add post-quantum time-stamps to the long-term validation chain.
3. Validate what you add. A post-quantum signature that no validator checks gives a relying party nothing. Plan the validation together with the signing.
4. Pilot before procurement. Measure on your own document types, with a qualified provider in the loop.

Perennis covers steps 1 to 3 and offers step 4 as a limited pilot in a controlled environment. See the public sector page.