Post-quantum: what ANSSI actually recommends, and what it didn't say

For several months, many articles have claimed that ANSSI (France's national cybersecurity agency) will stop certifying products without post-quantum cryptography as early as 2027, or even that it is banning RSA. The reality, as the agency describes it in its official FAQ on post-quantum cryptography, is more nuanced. Here is what it says, with quotes.

Hybridization: strongly recommended, sometimes mandatory

ANSSI "strongly insists on the essential nature of hybridization," meaning the combination of a proven classical algorithm and a post-quantum algorithm, wherever post-quantum protection is needed. Its recommendations "do not currently have the force of a regulatory obligation," except within the regulated perimeter: for classified defense data or Diffusion Restreinte (restricted distribution) data, vital information systems, and certified or qualified products (ANSSI security visas), once PQC is deployed, hybridization is mandatory.

One exception: for hash-based signatures (SLH-DSA, XMSS, LMS), hybridization is not systematically recommended. For hybrid signatures, simply concatenating a classical signature and a post-quantum signature is enough.

The deadlines: 2026, 2027, 2030

• 2026: the revision of the IPsec DR reference framework is planned for the year.
• 2027: ANSSI aims for "the introduction of PQC obligations for products entering qualification." The wording targets entry into qualification: nothing in the FAQ mentions withdrawing products that are already qualified or banning RSA.
• 2030: according to the agency, "it will not be reasonable to buy products that do not include PQC after 2030."

Products that include PQC can already be certified and qualified. Diffusion Restreinte approval is possible, except when the applicable reference framework does not yet allow PQC, as is currently the case for IPsec DR.

What ANSSI asks organizations to do right now

1. Take inventory of the products and uses that rely on cryptography, the algorithms they use, and the data that must remain confidential or authentic after 2030, specifying for how long.
2. Identify the equipment to update and ask suppliers for their roadmaps.
3. Build PQC into the equipment renewal schedule.
4. Report blocking points to ANSSI, which offers support.

Coming next

Some of the publications announced in the FAQ have already appeared: the note "ANSSI views on crypto agility" (January 19, 2026), which "very strongly" recommends that products be able to switch between parameter sets standardized by NIST, and recommendations for the post-quantum transition of TLS 1.3, IPsec and SSHv2 (February 2, 2026). ANSSI is also still updating its guide to cryptographic mechanisms and continuing its work on key management infrastructures.

Key takeaways

For a French organization, the practical timeline is clear: start the inventory now, build the hybrid post-quantum requirement into purchases and renewals, and treat 2030 as the date beyond which equipment without PQC becomes a bad investment. This timeline aligns with the European roadmap, which recommends having started the transition by the end of 2026, migrated high-risk uses by the end of 2030, and medium-risk uses by the end of 2035.