BSI, ENISA, NCSC and ANSSI on post-quantum cryptography: where they agree, where they differ

Published 12 October 2026 · 9 min read · By Ali Korsi Four bodies shape how European organisations migrate to post-quantum cryptography. Read side by side, their guidance converges on what to do first and differs mainly on how long hybrids last, which conservative options to keep, and when.

Why compare national guidance at all?

NIST wrote the algorithms, but European organisations are supervised, certified and audited against national guidance. A group with entities in France, Germany and the UK, or a supplier selling into all three, has to meet ANSSI, BSI and NCSC expectations at once — on top of the EU’s coordinated timeline. The good news: they agree on far more than they disagree on. The differences are real, but they can be designed around.

This is a practitioner’s summary of public guidance as of October 2026, not a substitute for the documents themselves. National guidance is updated regularly — BSI’s TR-02102 every year — so check the current edition before you fix a design.

At a glance

ANSSI (France)

ANSSI’s doctrine rests on one principle: add post-quantum protection, do not swap. Its 2022 position and December 2023 update set a three-phase plan: hybridisation as defence in depth first, then post-quantum security as a claimed and sometimes mandatory property (the current phase), and standalone post-quantum algorithms only from around 2030. A product that implements ML-KEM alone, without a classical component, is not aligned with the doctrine today. Stateful hash-based signatures (LMS, XMSS) are the exception and can be used without hybridisation. For buyers, the dates that matter are 2027, when qualification starts to require post-quantum features, and 2030, after which buying products without them will not be reasonable. Our ANSSI guide (in French) goes further.

BSI (Germany)

BSI’s guidance lives in Technical Guideline TR-02102, whose part 1 on cryptographic mechanisms and key lengths is revised every year. Recent editions recommend using post-quantum schemes in hybrid combination with classical ones, accept ML-KEM at the higher parameter sets, and keep more conservative options — FrodoKEM and Classic McEliece — for those who want to avoid relying on structured lattices alone. On signatures, they cover ML-DSA and SLH-DSA, with stateful hash-based schemes for specific uses such as firmware. BSI has also published broader material on quantum-safe migration for organisations.

NCSC (United Kingdom)

The UK NCSC is outside the EU but matters for any group with UK operations. Its stance differs in emphasis: it sees post-quantum-only as the end state, accepts hybrid schemes as an interim measure where they help interoperability or assurance, and is explicit about the extra complexity hybrids bring. It recommends ML-KEM-768 and ML-DSA-65 for general use. Its 2025 migration timeline is the most concrete of the four: define goals, carry out discovery and build an initial plan by 2028; complete the highest-priority migrations by 2031; complete migration by 2035.

The EU level: NIS Cooperation Group and ENISA

At EU level, the binding direction comes from Commission Recommendation 2024/1101 and the Coordinated Implementation Roadmap published by the NIS Cooperation Group in June 2025: start the transition, including inventories, by the end of 2026; migrate high-risk use cases by the end of 2030; migrate as much as feasible by 2035. ENISA, the EU cybersecurity agency, supports this work and has published studies on the state of post-quantum cryptography and on integrating it into systems, but it does not set national algorithm rules. Supervisors applying NIS2 and DORA will read these milestones alongside national guidance.

Where they agree

• Start now, and start with an inventory. Every one of them puts discovery first.
• The NIST algorithms are the base. ML-KEM for key establishment and ML-DSA for signatures, with hash-based signatures for specific long-lived uses.
• Key exchange first. Harvest-now-decrypt-later makes confidentiality the priority.
• Strong symmetric cryptography. 256-bit symmetric keys and SHA-2/SHA-3 at matching strength.
• QKD is not the answer for most organisations. Post-quantum cryptography is the migration path.
• Crypto-agility. None of them expects this to be the last migration.

Where they differ

• How long hybrids last. ANSSI and BSI treat hybrid as the rule for now; the NCSC treats it as a bridge to post-quantum-only.
• Algorithm diversity. BSI and ANSSI keep conservative alternatives such as FrodoKEM (and, for BSI, Classic McEliece) in view; the NCSC concentrates on the NIST set.
• Parameter levels. The NCSC names ML-KEM-768 and ML-DSA-65; ANSSI and BSI lean towards higher levels and avoid minimal sets.
• Dates. 2026/2030/2035 (EU), 2027/2030 for French product qualification and procurement, and 2028/2031/2035 (UK).

Designing for a multi-country estate

1. Inventory once, map many times. Build one CBOM and tag systems by the jurisdictions and regimes that apply to them, rather than running separate programmes.
2. Default to hybrid key exchange at ML-KEM-768 or above. For example X25519MLKEM768 in TLS 1.3, or ML-KEM-1024 hybrids for the most sensitive data. This meets ANSSI and BSI expectations and is acceptable to the NCSC.
3. Plan signatures per use case. Hybrid or composite ML-DSA where ANSSI or BSI apply; LMS/XMSS or SLH-DSA for firmware and long-lived roots, which every agency accepts in some form.
4. Raise symmetric strength. AES-256 and SHA-384 or stronger where data must stay confidential for long, which satisfies the strictest reading.
5. Work to the earliest date that applies. In practice: inventory by end-2026, high-risk flows by 2030, and post-quantum features as a procurement requirement now for anything you will run past 2030.
6. Make the hybrid-to-PQC-only step a configuration change. Keep algorithms configurable behind central libraries or services — crypto-agility — so that moving from today’s hybrids to tomorrow’s post-quantum-only profiles does not mean another rewrite.

Where CRYPTAGION fits

CRYPTAGION builds the single inventory behind step 1. It discovers cryptography in Python, JavaScript/TypeScript, Java, Go and C/C++ source, X.509 certificates and live TLS endpoints, records key sizes, curves and modes where detectable, scores each asset by quantum risk and HNDL exposure, and recommends a replacement with a migration year. Its mapping covers NIST FIPS 203/204/205, DORA, NIS2, the EU CRA, BSI TR-02102-1 and CNSA 2.0, and the inventory exports as a CycloneDX 1.6 CBOM that you can map to ANSSI or NCSC expectations yourself.

Sources

• ANSSI, position paper on post-quantum cryptography migration (2022) and follow-up (December 2023)
• BSI, Technical Guideline TR-02102-1: Cryptographic Mechanisms — Recommendations and Key Lengths (current edition)
• NCSC (UK), post-quantum cryptography guidance and migration timelines (2025)
• ANSSI, BSI, NLNCSA and Swedish Armed Forces, joint position paper on quantum key distribution (January 2024)
• ENISA, Post-Quantum Cryptography: Current state and quantum mitigation (2021); Post-Quantum Cryptography: Integration study (2022)
• Commission Recommendation (EU) 2024/1101 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography
• NIST FIPS 203, FIPS 204 and FIPS 205

This page summarises public guidance as of October 2026; agencies update their positions regularly. Check the current documents before making design or procurement decisions. It is not legal advice.

← All resources · Home