Attackers can copy encrypted data today and keep it until a quantum computer is powerful enough to break the public-key algorithms that protect it. That is “harvest now, decrypt later”, and it is why the EU’s post-quantum roadmap puts the first steps, including an inventory of where cryptography is used, at the end of 2026 rather than 2030.
If your data has to stay confidential for ten years or more, the risk already applies to you.
Key Facts
- The EU’s Coordinated Implementation Roadmap for the transition to post-quantum cryptography (PQC) was published in June 2025 by the NIS Cooperation Group.
- By the end of 2026, first steps should be under way, including inventories of cryptographic assets.
- By the end of 2030, high-risk use cases should be quantum-safe; the roadmap says quantum-vulnerable public-key mechanisms should not be used on their own after that.
- By the end of 2035, the transition should cover as many systems as feasible.
- NIST published the first PQC standards, FIPS 203, 204 and 205, in August 2024.
What does “harvest now, decrypt later” mean for your data?
It means the confidentiality of data you send today depends on cryptography that may be broken tomorrow. The question is not when quantum computers arrive, but how long your data must stay secret. Contracts, health records, intellectual property and customer data often need protection for a decade or longer, so they are exposed now if they travel over quantum-vulnerable connections.
Why start with a cryptographic inventory?
You cannot migrate what you cannot see. Cryptography sits in TLS connections, VPNs, certificates, code signing, databases, backups, cloud services and connected devices, and much of it comes from suppliers.
A useful inventory records, for each use: the algorithm and key length, where it runs, who owns it, what data it protects, how long that data must stay confidential, and which supplier controls the change.
How do you build one without stalling the business?
- Start with the data that must stay secret longest, and trace the systems and connections it passes through.
- Automate discovery of certificates, TLS configurations and libraries instead of relying on spreadsheets alone.
- Ask suppliers for their PQC plans and add them to your third-party risk management
- Prioritise migration work by data lifetime and exposure, and design for crypto-agility so algorithms can be swapped without rebuilding systems.
We help organisations map and classify sensitive information through data discovery and classification and broader data protection work, which gives the inventory its starting point.
Frequently asked questions
Can quantum computers break today’s encryption yet?
No quantum computer capable of breaking widely used public-key cryptography is publicly known to exist. The concern is data stolen now and decrypted later.
Is AES encryption also at risk?
The main risk is to public-key algorithms such as RSA and elliptic-curve cryptography. Symmetric encryption with sufficiently long keys, such as AES-256, is considered far less exposed.
What are FIPS 203, 204 and 205?
They are NIST’s first post-quantum standards: ML-KEM for key establishment, and ML-DSA and SLH-DSA for digital signatures.
What to do next
2030 sounds far away, but inventories, supplier changes and testing take years. Starting the inventory now gives you a realistic migration plan instead of a rushed one. Talk to us about a cybersecurity risk assessment that includes your cryptographic exposure.
