Post-quantum: the Netherlands targets 2030 for high-risk government systems

On October 5, 2026, the Dutch government sent Parliament its government-wide quantum strategy (Rijksbrede Quantumstrategie), subtitled “Kansen benutten, belangen beschermen, integraal verbinden” (“Seizing opportunities, protecting interests, connecting in an integrated way”). Led by Minister of Economic Affairs and Climate Heleen Herbert and State Secretary for Digital Economy and Sovereignty Willemijn Aerdts, it includes a precise timeline for migrating central government to post-quantum cryptography (PQC). High-risk uses must be migrated by the end of 2030, and medium-risk ones by the end of 2035.

A five-step timeline

The document (pages 36 and 37) sets the following milestones for central government organizations:

• End of 2026: include quantum risk in risk management and have a dedicated cryptography policy;
• End of 2027: address the “harvest now, decrypt later” risk, draft a migration plan (at least a provisional one), prepare or run tests on high- and medium-risk uses, maintain a cryptographic inventory, and budget for human and financial resources;
• End of 2028: be able to require quantum-resistant cryptography in public procurement and have drafted guidelines to steer essential entities;
• End of 2030: have completed the migration of high-risk uses, with software and firmware that use quantum-resistant cryptography by default;
• End of 2035: have completed the migration of medium-risk uses, and of low-risk uses “where possible.”

A target, not a legal obligation

The text stays cautious about its scope. The Dutch state writes that it “strives” to meet this timeline, which is aligned with the coordinated European roadmap published in 2025. It may adjust or accelerate it if the threat changes. The timeline applies only to central government and, according to the legal website AIRecht, creates no legal obligation for businesses, local authorities or hospitals. The strategy does point out, however, that the Cyberbeveiligingswet, the Dutch law transposing NIS2, requires a specific cryptography policy in its Article 13, which paves the way.

According to international estimates cited in the document, a quantum computer capable of breaking today's asymmetric cryptography could emerge around 2029-2035, with no certainty on the date. The AIVD intelligence service and the Dutch digital infrastructure inspectorate (RDI) advise preparing for its arrival from around 2030. The document cites the migration handbook from the AIVD, TNO and CWI, according to which a migration takes at least eight years for a government organization. Finally, the state does not use quantum key distribution (QKD) to protect its information: several European security agencies, including ANSSI (France's national cybersecurity agency), have raised serious objections to this technology.

What to take away

For a French IT manager, this timeline shows concretely how to put the European roadmap into practice. The first two steps, the cryptography policy and the inventory, require no new technology and can start right now. The 2028 step also concerns vendors: a public buyer that demands PQC in its tenders will expect credible product roadmaps.