Quantum computing has the potential to transform cybersecurity because sufficiently powerful quantum computers could break some of the cryptographic methods on which today’s digital security infrastructure relies. The principal concern is public-key cryptography, including widely used systems such as RSA and elliptic-curve cryptography. It underpins secure web browsing, email, VPN connections, digital signatures, software updates and many other forms of secure digital communication.
Public-key cryptography relies on mathematical problems that are easy to perform in one direction but cannot be efficiently reversed using a classical computer. RSA, for example, is based on integer factorisation: multiplying two large prime numbers is straightforward, whereas recovering those primes from their product is infeasible for a classical computer once the numbers are large. In 1994, mathematician Peter Shor demonstrated that a sufficiently powerful quantum computer could efficiently solve these mathematical problems underlying widely used public-key cryptography. Such quantum computer running Shor’s algorithm could therefore break these systems, potentially allowing an attacker to decrypt protected information or forge digital signatures.
Is the decryption threat only a future threat?
No. Although quantum computers capable of breaking public-key cryptography remain a future prospect, their anticipated development already creates a security risk today through what is known as “harvest now, decrypt later”. An adversary can intercept and store encrypted data now and decrypt it retrospectively once a sufficiently powerful quantum computer becomes available.
The relevant security question is therefore not simply “Is our encryption secure today?” but also “Will our data remain secure for as long as it needs to remain confidential?” This is particularly important for information with a long confidentiality lifetime, such as government secrets, trade secrets, intellectual property and sensitive personal data. The quantum threat is a future technological threat with a present-day security impact.
Can data be protected from future quantum decryption?
The key response is post-quantum cryptography (PQC): cryptographic algorithms designed to resist attacks by both classical and quantum computers. In August 2024, the US National Institute of Standards and Technology (NIST) published its first three principal PQC standards: FIPS 203 (ML-KEM) for key establishments, FIPS 204 (ML-DSA) for digital signatures and FIPS 205 (SLH-DSA) for stateless hash-based digital signatures. Unlike RSA and elliptic-curve cryptography, these schemes rely on mathematical problems for which no efficient quantum attack comparable to Shor’s algorithm is known.
Are NIST’s post-quantum cryptography standards legally binding?
Not directly – at least not in Europe. The NIST standards are US federal standards and do not create legal obligations for organisations operating in Europe. Their significance, however, extends well beyond the United States, as they have provided a common technical foundation around which much of the international transition to PQC is developing.
European cybersecurity authorities are already incorporating PQC into their technical guidance. Germany’s BSI, for example, recommends quantum-safe mechanisms for information requiring long-term confidentiality and currently recommends deploying PQC key-establishment mechanisms in hybrid combination with established conventional methods. France’s ANSSI has similarly advocated a gradual transition using hybrid approaches. European authorities are therefore converging on PQC migration, although their recommendations concerning particular algorithms, hybridisation and migration timelines are not identical.
At EU level, following the European Commission’s 2024 Recommendation on post-quantum cryptography, the NIS Cooperation Group published a Coordinated Implementation Roadmap in June 2025. The roadmap calls on all Member States to start transitioning to PQC by the end of 2026, while critical infrastructure should be transitioned as soon as possible and no later than the end of 2030.
A further regulatory step is now underway. In January 2026, the European Commission published a proposal for a Directive amending the NIS 2 Directive as regards simplification measures and alignment with the proposed Cybersecurity Act 2. Article 1(5) of the proposal adds a new point (k) to Article 7(2) of the NIS 2 Directive, requiring Member States to adopt, as part of their national cybersecurity strategy, policies for the transition to post-quantum cryptography, taking into account the transition timelines and relevant requirements set out in applicable EU legal acts and policies. This should be understood as a reference to the above Coordinated Implementation Roadmap. The European Commission’s proposal elevates PQC from a matter of technical guidance to an explicit regulatory mandate, establishing a direct chain of accountability from EU legislation or recommendations through national strategies to regulated entities.
The UK has adopted a similar direction. The National Cyber Security Centre (NCSC) supports migration to NIST-standardised algorithms. Its 2025 migration timetable calls for organisations to complete discovery and planning by 2028, migrate their highest-priority systems by 2031 and complete migration of all systems, services and products by 2035. These are target dates rather than binding statutory deadlines, but they are intended to guide UK industry, government and regulators. In both jurisdictions, the 2035 deadline for full migration is a shared benchmark, though the EU imposes an earlier milestone of 2030 for critical use cases, compared with 2031 for the UK’s highest-priority systems.
The NIST algorithms are accordingly becoming part of the technical benchmark against which appropriate cybersecurity may be assessed, even if the standards themselves are not binding law in the EU or UK.
Do post-quantum cryptography schemes need to be considered when applying cyber laws?
Increasingly, yes. EU legislation such as the NIS 2 Directive, DORA and the Cyber Resilience Act do not prescribe particular cryptographic algorithms, but impose technology-neutral, risk-based cybersecurity requirements which, depending on the legislation and obligation concerned, require consideration of factors such as identified risks, proportionality and the state of the art. As PQC matures and its use is increasingly recommended by cybersecurity authorities, continued reliance on quantum-vulnerable cryptography will become harder to justify. A similar principle applies in the UK, where the NCSC’s migration timetable may increasingly influence the interpretation of what constitutes appropriate cybersecurity under legislation and sector-specific regulation.
Do organisations that fail to adopt post-quantum cryptography face regulatory sanctions or civil liability?
Potentially both. There is currently no general rule in Europe requiring organisations to replace conventional cryptography with PQC by a particular date. However, as mentioned, organisations are already subject to technology-neutral cybersecurity obligations, and as the quantum threat becomes more concrete, those obligations may increasingly require the usage of PQC. When that point is reached for an organisation may depend on factors such as the sensitivity and required confidentiality lifetime of the data held, exposure to “harvest now, decrypt later”, regulatory guidance, industry practice and the cost and complexity of migration. For information that must remain confidential for many years, the legally relevant risk may arise well before a capable quantum computer exists.
Regulatory enforcement
Under Article 32 GDPR, controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, with consideration of the state of the art, implementation costs and the nature and severity of risks. Encryption is expressly identified as a possible security measure.
The same principle applies under other EU cybersecurity legislation. The NIS 2 Directive requires essential and important entities to implement appropriate technical, operational and organisational measures, expressly including cryptography and encryption policies. DORA addresses encryption and cryptographic keys in the context of ICT security measures. The CRA similarly imposes risk-based cybersecurity requirements on products with digital elements.
Regulatory exposure would not necessarily arise from breaching a specific rule requiring PQC. Instead, a regulator or court could conclude that, in the prevailing circumstances, continued reliance on quantum-vulnerable cryptography no longer constituted an appropriate response to a reasonably foreseeable risk.
Civil liability
Failure to prepare for the quantum transition may also result in civil liability. Under Article 82 GDPR, an individual who suffers material or non-material damage as a result of a GDPR infringement may claim compensation. Failure to implement appropriate security measures under Article 32 could contribute to liability where the other requirements – including damage and causation – are satisfied.
Liability may also arise, e.g. under contract law, where customers require suppliers and ICT service providers to comply with specified security standards or migrate to PQC within agreed timeframes. An organisation that disregards established warnings and migration timelines may be in a weaker position than one that assessed the risk, documented its approach and implemented proportionate migration measures.
What should organisations do now?
For most organisations, the implication is not that every cryptographic system must be replaced with PQC today. Premature or poorly managed migration can itself introduce vulnerabilities. The priority is often to understand exposure and prepare for an orderly transition.
Organisations should first establish where and how quantum-vulnerable cryptography is used and which information must remain confidential over long periods. This assessment should cover the entire chain of data-processing activities rather than individual systems in isolation. Data may be adequately protected within an organisation but exposed when transmitted to a customer or processed by a cloud provider. Effective protection depends on the security of the weakest relevant link in the processing chain.
Organisations should also map dependencies on third-party products and service providers. For many standardised cloud or software services, migration may be delivered largely through vendor updates. In contrast, migration may be burdensome for organisations operating their own infrastructure or bespoke systems. These organisations may need to redesign protocols, update interfaces and coordinate changes across multiple systems and counterparties.
Also, organisations should consider quantum risk when entering into new contracts, particularly with IT service providers. Where services involve the processing or transmission of sensitive or long-lived data, it may be worth reflecting on whether contractual arrangements adequately account for the evolving cryptographic landscape. For example, consideration might be given to how future migration to quantum-safe algorithms could be handled within the scope of the engagement and whether the relevant service agreements offer sufficient flexibility to adapt to emerging regulatory and technical requirements.
Finally, organisations should ensure cryptographic agility: the ability to replace cryptographic algorithms and protocols without redesigning entire systems. Given that complex cryptographic migrations can take many years, organisations with material quantum exposure should begin inventorying, assessing and planning now rather than waiting until PQC has clearly become part of the applicable cybersecurity standard.
If you have any questions about the topics raised in this article or would like to discuss how quantum technologies may affect your business, our team would be delighted to hear from you. For more information, please visit this page.
For further information, please contact:
Dr. Juliana Kliesch, Partner, Bird & Bird
