Why has post-quantum cryptography evolved from a technical issue into a governance and compliance challenge?

In recent years, many organisations have regarded the cybersecurity risks associated with quantum computing as a distant concern, largely confined to research. That position is becoming increasingly difficult to sustain. A turning point came in August 2024, when NIST published its first formal post-quantum cryptography standards. With their release, quantum-resistant cryptography moved beyond the research laboratory and into security programmes affecting businesses, governments and critical infrastructure.

In Hungary, early signs of this development were already visible in July 2022, in the final amendment to Act L of 2013. The amendment took a forward-looking approach by proposing short implementation deadlines for post-quantum encryption obligations applicable to certain organisations. This direction was continued by Act LXIX of 2024, which remains in force and devotes a separate chapter to the use of post-quantum encryption, the requirements applicable to organisations providing such solutions, and the certification and regulatory supervision of compliance.

Today, the central question is no longer simply whether quantum computers capable of undermining current encryption solutions will emerge. Rather, organisations must determine where they use quantum-vulnerable cryptography and whether they have a migration plan that will enable them to transition to a quantum-resistant environment.

Within the European Union, post-quantum cryptography (PQC) has become a strategic priority. Commission Recommendation (EU) 2024/1101 calls for an implementation roadmap for the transition to post-quantum cryptography and urges Member States to prepare in a consistent and coordinated manner. The roadmap published by the NIS Cooperation Group in June 2025 establishes risk-based milestones for the transition. Although these milestones do not constitute deadlines directly applicable to every organisation, they are expected to shape national programmes, supervisory expectations in critical sectors and supplier requirements.

Why does this matter?

According to ENISA, cryptography underpins, among other things, data integrity, the authenticity of communications, the reliability of digital signatures and the security of electronic transactions, making it a foundation of the modern digital economy. By safeguarding the confidentiality of data, it also plays a critical role in establishing and maintaining digital trust.

ENISA further emphasises that migration does not end with selecting and standardising algorithms. New solutions must also be integrated into existing protocols, applications, public key infrastructure (PKI) environments and supplier ecosystems, while performance, interoperability and resource constraints must be assessed. New developments should be designed with PQC requirements in mind from the outset. During the transition period, it may also be appropriate to deploy hybrid solutions that combine classical and post-quantum mechanisms.

Which technical security solutions are used today?

The security of the digital world continues to rely on several fundamental cryptographic building blocks. The best-known examples include:

• AES — The Advanced Encryption Standard is currently the most widely used symmetric encryption algorithm. It is deployed in VPN solutions, full-disk encryption, cloud platforms and wireless networks. Its strengths include high performance, broad support and a security record proven over decades. The prevailing technical view is that quantum computers may reduce its effective key strength; however, with an appropriate key size, AES is expected to remain viable over the long term.
• RSA — RSA (Rivest–Shamir–Adleman) is one of the best-known components of digital certificates, PKI systems and key-exchange mechanisms. Its security is based on the difficulty of factoring large integers into prime numbers. This is precisely the type of mathematical problem that a sufficiently capable quantum computer is expected to solve efficiently.
• ECC — Elliptic Curve Cryptography provides security comparable to RSA with smaller key sizes and is therefore widely used in mobile and cloud environments. Although it is regarded as a more efficient and modern solution, its vulnerability to quantum computing is similar to that of RSA.
• TLS — Transport Layer Security protects a substantial proportion of internet communications. HTTPS connections, business applications, APIs and cloud platforms all rely on it. TLS is not itself an algorithm; it is a protocol that combines RSA, ECC and symmetric encryption. The quantum threat therefore directly affects the broader TLS ecosystem.

What is the quantum threat in practice?

Quantum computers are not merely faster versions of conventional computers; the fundamental distinction lies in their ability to address certain mathematical problems in a different way. Research indicates that a cryptographically relevant quantum computer could, in the future, break RSA and ECC algorithms that are currently widely used and deeply embedded in systems and communications. This would affect digital certificates, electronic signatures, authentication systems and secure communications on a broad scale. The risk is particularly significant for information that must remain confidential for many years or even decades, such as health records, intellectual property and technical documentation relating to critical infrastructure.

• The best-known quantum risk is Harvest Now, Decrypt Later (HNDL). In this scenario, attackers obtain encrypted data today, store it and decrypt it years later when sufficient quantum-computing capacity becomes available. The attack therefore does not require immediate decryption; collecting and retaining the data is sufficient.
• Store Now, Forge Later — Here, the objective is not to decrypt protected information but to compromise the authenticity and integrity provided by digital signatures. Using a future quantum computer, an attacker could sign malware, firmware updates, certificates or electronic documents in the name of an apparently trusted party. A manipulated update or forged certificate could consequently appear trustworthy, undermining the integrity of digital systems and their chains of trust.
• Lack of Crypto-Agility — Many organisations do not know precisely which systems use RSA or ECC, which certificates are active, or where critical cryptographic dependencies exist. In many cases, the challenge is therefore not the replacement algorithm itself, but whether the replacement can be executed effectively.
• Supply-Chain Risks — Preparing an organisation’s own infrastructure is not sufficient for a successful post-quantum transition. Support for PQC from VPN products, HSMs (hardware security modules), network devices, cloud providers and business partners is also essential, because weaknesses in those components may create corresponding vulnerabilities for the organisation.
• Absence of an Inventory of Cryptographic Assets and Solutions — Many organisations lack an accurate record of the algorithms, keys and certificates they use. Without such an inventory, a successful PQC migration is practically impossible.

Applying post-quantum cryptography (PQC)

Post-quantum cryptography refers to a new generation of algorithms that run on conventional computers while, according to current scientific understanding, remaining resistant to attacks by quantum computers. NIST’s first standards package identified three principal algorithms:

• ML-KEM (CRYSTALS-Kyber) — ML-KEM is designed to establish shared keys securely. It may become a primary successor to current RSA- and ECDH-based key-establishment mechanisms, particularly for TLS connections and secure communications systems.
• ML-DSA (CRYSTALS-Dilithium) — ML-DSA is a standard for digital signatures. It can protect certificates, code signing, firmware authentication, electronic documents and PKI systems. The technical community regards it as one of the most important prospective successors to RSA- and ECC-based signature schemes.
• SLH-DSA (SPHINCS+) — SLH-DSA is a hash-based digital-signature algorithm. One of NIST’s principal objectives was to ensure cryptographic diversity; accordingly, in addition to the two lattice-based algorithms, ML-KEM and ML-DSA, it standardised a solution based on different mathematical foundations.

Although NIST technical standards do not constitute legislation in the European Union, they currently serve as leading, internationally recognised technical references for post-quantum algorithms. Another important milestone is NIST SP 800-227, Recommendations for Key-Encapsulation Mechanisms, finalised on 18 September 2025, which provides guidance on the properties, use and secure implementation of KEMs.

What does this mean for NIS 2 compliance?

The NIS 2 Directive does not prescribe specific post-quantum encryption algorithms or impose a general obligation to deploy them. Nevertheless, it is clearly relevant to areas including cryptographic controls, secure data handling, information requiring long-term protection, critical-infrastructure security and supply-chain risk management.

Alongside NIS 2, the EU framework is principally supplemented by the previously mentioned Commission Recommendation (EU) 2024/1101 and the coordinated 2025 PQC roadmap. The roadmap calls for Member State strategies and planning for high- and medium-risk use cases to begin by the end of 2026, the prioritised migration of high-risk use cases and critical infrastructure by 2030, and a broader transition by 2035. These are EU policy milestones, not direct legal deadlines automatically binding every organisation.

Other relevant EU frameworks may also influence preparedness. The Cyber Resilience Act is particularly important in relation to manufacturer-supported updates, vulnerability management and crypto-agility because it establishes cybersecurity requirements throughout the lifecycle of products with digital elements. DORA creates obligations for financial entities concerning ICT risk management, resilience testing and third-party risk, while eIDAS 2.0 concerns the long-term trustworthiness of digital identities, trust services and electronic signatures. Under the GDPR, the suitability of cryptography used to protect personal data over the long term and the assessment of data-protection risks may also require consideration; however, none of these instruments generally prescribes a specific PQC algorithm. In Hungary, Act LXIX of 2024 addresses the use, provision and certification of post-quantum encryption.

Organisations should assess their cryptographic dependencies as soon as possible, review their certificate-management processes and establish a migration strategy for post-quantum encryption.

From a technology issue to a compliance imperative

The post-quantum transition is no longer solely a technological or research matter. The regulatory environment outlined above will also determine the practical scope of obligations, including which organisations will be required by implementing legislation to adopt these measures. Preparation should therefore not be deferred. Establishing a cryptographic inventory, identifying RSA and ECC dependencies, assessing information that requires long-term protection and evaluating suppliers’ PQC capabilities are already justified risk-management and compliance activities, as well as essential steps toward understanding the current cryptographic environment.

The Black Cell perspective

Professional discussions concerning the transition to quantum-resistant security still focus primarily on algorithms and quantum computers. In practice, however, the principal challenge for most organisations is not the technology itself, but mapping cryptographic dependencies, managing supplier risks and developing an appropriate migration strategy for their existing environment.

Black Cell’s expert team supports organisations in preparing for the post-quantum era in areas including:

• NIS 2 compliance;
• critical-infrastructure protection;
• development of cryptographic asset inventories;
• identification of algorithm dependencies;
• cryptographic risk assessments;
• assessment of certificate environments;
• control-maturity assessments;
• advisory support for defining migration priorities and designing security architectures;
• cloud and identity security;
• audit readiness and a wide range of additional control areas.

Deferring post-quantum preparedness is itself a risk decision, with technological, operational and compliance consequences that organisations must consider. A sound level of preparedness is built on an understanding of cryptographic exposures, a documented risk assessment and a realistic transition roadmap—before regulatory requirements or direct technological pressure make action urgent.

Closing thoughts

The direction of European preparedness is now clear: the Commission Recommendation, the NIS Cooperation Group roadmap and ENISA’s technical work all support an early, coordinated and risk-based transition. Within this wider context, Hungarian legislation represents a national approach whose detailed implementation must be assessed against the rules and regulatory measures in force at the relevant time.

The need to prepare extends beyond immediate legal obligations. Organisations that identify their cryptographic exposures early and establish the conditions for a phased transition before regulatory or technological pressure arises will be better positioned to manage the change.

Interpretation of legal and standards references

• Directive (EU) 2022/2555 (NIS 2 Directive): establishes risk-based cybersecurity obligations for essential and important entities but does not prescribe a specific post-quantum algorithm.
• Commission Recommendation (EU) 2024/1101 of 11 April 2024: a non-binding Commission recommendation calling for a coordinated Member State strategy for the transition to PQC, particularly in relation to public-administration services and critical infrastructure.
• Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (NIS Cooperation Group, June 2025): a high-level EU roadmap and set of policy milestones. The 2026, 2030 and 2035 targets should not automatically be interpreted as directly enforceable legal deadlines applicable to every organisation.
• ENISA publications on post-quantum cryptography: provide technical and policy guidance on risk assessment, protocol integration, hybrid migration and European preparedness. ENISA guidance is an authoritative professional reference but does not constitute directly binding legislation.
• NIST FIPS 203, FIPS 204 and FIPS 205: United States federal standards defining the ML-KEM, ML-DSA and SLH-DSA algorithms. They are not EU legislation but are internationally significant technical references.
• NIST SP 800-227, Recommendations for Key-Encapsulation Mechanisms (September 2025): technical guidance on the secure implementation and use of KEMs. The Initial Public Draft dated 7 January 2025 was superseded by the final publication issued on 18 September 2025.
• Regulation (EU) 2024/2847 (Cyber Resilience Act): establishes lifecycle cybersecurity requirements for products with digital elements. It does not mandate general PQC deployment, but it is relevant to crypto-agility through its requirements concerning secure design, updateability and vulnerability management.
• Regulation (EU) 2022/2554 (DORA): a binding framework for digital operational resilience in the financial sector. It does not prescribe a specific PQC algorithm but is relevant to financial-sector preparedness through ICT risk management, resilience testing and third-party risk requirements.
• Regulation (EU) 2024/1183 (eIDAS 2.0): the EU framework for digital identities and trust services. It is relevant to PQC because of the need to maintain digital signatures and chains of trust in the quantum era, but it does not establish a general requirement to use specified PQC algorithms.
• Regulation (EU) 2016/679 (GDPR): a technology-neutral, risk-based data-protection framework. It may be relevant to the long-term confidentiality of personal data and the assessment of appropriate technical measures, but it does not identify PQC as a mandatory control.
• ISO/IEC 27001:2022 and ISO/IEC 27002:2022: international standards for information security management and controls. They do not prescribe specific PQC algorithms, but provide an appropriate framework for managing cryptography, assets, supplier relationships, risk assessment and technological change.
• Act LXIX of 2024 on the Cybersecurity of Hungary: Hungarian national legislation containing specific provisions on post-quantum encryption. Its requirements must be interpreted within the Hungarian jurisdiction and applicable implementing rules, rather than as a general requirement across the European Union.
• Act L of 2013 on the Electronic Information Security of Central and Local Government Bodies: former Hungarian legislation whose post-quantum provisions remain relevant as part of the legislative and regulatory history.
• Minister of the Prime Minister’s Cabinet Office Decree 7/2024 (24 June): Hungarian implementing legislation concerning security classification and applicable protective measures; it applies only within its specified national scope.

Interpretive note: This article does not suggest that every organisation in the European Union is currently required by law to implement post-quantum cryptography. Applicable obligations depend on the organisation’s jurisdiction, sector, risk profile, contractual environment and future national implementation measures. Unless binding legislation, a regulatory decision or a contractual requirement makes them enforceable, ENISA guidance, the EU Recommendation and the coordinated roadmap should be treated primarily as strategic and risk-management references.