In May 2026, Romania's National Cyber Security Directorate (DNSC) published “The Transition to Post-Quantum Cryptography (PQC) – A Roadmap for Romanian Civilian Infrastructure”. It is the first national document to treat post-quantum cryptographic migration not as a research topic, but as an operational problem, with phases, deadlines and a working methodology.
Its significance can easily go unnoticed. For two years, the subject could be filed away, with some justification, as a concern for Brussels, Berlin or the US agencies. Since May 2026, there is a document from the Romanian authority, explicitly aligned with the European timeline. And the first deadline in that timeline falls this very year: 31 December 2026.
The two-minute version for decision-makers
- The near-term deadline is 31 December 2026 (the cryptographic inventory, or CBOM), not the 2030–2035 migration targets.
- It applies to essential and important entities within the scope of NIS2 — not to every company.
- The threat, calibrated: the gap between today's hardware and a cryptographically relevant quantum computer is still about three orders of magnitude, but it is closing from both directions.
- Uncertainty about “Q-day” does not change the decision: if migration takes 6–10 years, the moment to start is the same in every scenario.
- The roadmap is guidance — it does not say which systems are high-risk, who is accountable internally or what it will cost. Those answers are exactly what the first phase is about.
The context, in brief
Since 1994, when Shor's algorithm was published, we have known that the algorithms underpinning secure communication on the internet (RSA, ECDH) can be broken by a sufficiently powerful quantum computer.
As such a computer gets closer to existing, the world is preparing to move to more secure algorithms. In 2016, NIST — the US standards institute — launched a global competition for cryptographic algorithms resistant to quantum attacks. Evaluation and selection took eight years, and the new standards were published in August 2024. From that point on, the standards problem was solved and the practical problem began: the world has to migrate. The US adopted a timeline that deprecates the old algorithms after 2030 and disallows them after 2035. In June 2025, the EU published its coordinated roadmap for the PQC transition, with an equivalent timeline — high-risk systems migrated by the end of 2030 and medium-risk systems by 2035 — and with a requirement that member states have national roadmaps and first steps in place by the end of 2026. As a result, in May 2026, DNSC published the document discussed here.
The deadline that matters. It is not 2030.
The deadlines above are real, but their distance creates a false sense of calm. The operational deadline is closer.
By publishing the roadmap in May, Romania took the step that fell to it under the European transition strategy. With that step, however, the key deadline moved from the state's shoulders to those of organizations: by 31 December 2026, essential and important entities must have completed their cryptographic inventory — the so-called CBOM (Cryptographic Bill of Materials). A CBOM is a structured record of all of an organization's cryptographic assets: the algorithms and key lengths in use, communication protocols, digital certificates and their expiry dates, software libraries, hardware security modules and — by no means least — cryptographic dependencies on suppliers.
Building a CBOM is not an administrative exercise that can be done in a week. An organization's cryptography does not sit in one place: it is in code, in network configurations, in containers, in equipment with firmware that is hard to update, and in third-party products about which nobody asked the right question at procurement. The DNSC document describes five technical discovery streams that have to be combined for a complete inventory — and it is unusually direct about the timeline: the roadmap was published in the final year of the window intended for this phase, and organizations that have not started are already behind. The precedent it cites is telling: the move from SHA-1 to SHA-256, a considerably simpler technical process, took more than five years in most organizations.
The legal framework already exists. NIS2, transposed into Romanian law by Government Emergency Ordinance (OUG) 155/2024 and Law 124/2025, requires the use of cryptography in line with the state of the art — a wording that, after the publication of the NIST standards in 2024 and the European guidance, includes post-quantum preparedness. For the financial sector, DORA adds its own layer of obligations. And a detail worth noting for any audit committee: NIS2 makes management bodies directly liable.
Why “wait and see” is no longer an option
The argument that changes the conversation at board level is no longer about the future. The “harvest now, decrypt later” strategy does not require a quantum computer to exist today. It only requires the capacity to intercept and store traffic — resources that advanced state actors have had for a long time.
The mechanism is simple to explain and hard to dispute. Data in transit is encrypted symmetrically, with AES, which holds up even against quantum attacks. But the AES session key is negotiated with asymmetric algorithms, RSA or ECDH — exactly the class of algorithms a sufficiently powerful quantum computer breaks completely. An adversary who stores an intercepted session today, including the key negotiation, needs only patience.
This leads to a practical test any organization can apply: which of our data must stay confidential for more than 10 years? The NIS Cooperation Group classifies exactly this category as high quantum risk — banking and financial data under legal retention, medical records, contracts with long-term effects, government communications. For this data, the window of vulnerability is already open; it does not open when the quantum computer arrives.
There is also a formal version of this reasoning: Mosca's inequality, which compares how long data must stay confidential plus how long migration takes against the time left until the threat materializes. Applied to long-lived data, the conclusion is uncomfortable: for many categories, the safety window has already been exceeded. I return to this calculation, with numbers, in a dedicated article.
A balanced look at the time horizon
As a researcher in the security of quantum computing systems, I am often asked the same question: when will a quantum computer capable of breaking RSA actually exist? The honest answer is that nobody knows precisely — and anyone who claims otherwise is after something, whether panic or complacency.
What can be said accurately comes down to two numbers and the direction each is moving in. The first is the estimate of the resources required. Gidney and Ekerå's reference calculation from 2019 put it at roughly 20 million physical qubits to factor RSA-2048 in eight hours. Later analyses, culminating in the update Gidney published in 2025, brought the estimate below one million qubits — a more than twentyfold reduction, achieved purely by optimizing the algorithms and the error correction. The second number: the largest publicly announced quantum processors today exceed one thousand physical qubits.
The gap between the two is still three orders of magnitude, and the central obstacle is error correction, which needs hundreds or thousands of physical qubits for a single reliable logical qubit. But the trend is unambiguous: the gap is closing from both directions. Hardware is growing, roughly doubling in capability every two to three years, and the estimated requirement drops with every round of optimization.
The consensus of the international community — including the planning assumption of BSI, Germany's federal cyber security authority — places a cryptographically relevant system in the 2030–2035 range. The Global Risk Institute's 2025 report puts the probability that RSA-2048 can be broken within 24 hours in the next decade at 28–49%, up from 19–34% in the previous edition.
The essential point, however, lies elsewhere: uncertainty does not change the decision. The EU Coordinated Roadmap cautiously estimates that a complete migration takes 5 to 10 years; the DNSC document speaks of 6–8 years for systems of medium and high complexity. If migration takes that long in any scenario, the moment to decide is the same whether Q-day arrives in 2031 or in 2038. The uncertain variable — the date of the threat — is under nobody's control. The certain variable — the date migration begins — is.
What the roadmap does not (and cannot) say
The DNSC document is worth reading in full. It is technically well grounded and realistic in its methodology. And it respects its own limits: it is guidance, it creates no new obligations and it does not assign institutional responsibilities — the right choice for a government document.
It is precisely these limits that define what remains to be done in each organization. The roadmap cannot say which of an organization's systems fall into the high-risk category. It cannot say who is accountable for the subject, how much migration will cost in a specific case, or what the first quarter of action looks like. Turning a national timeline into organizational decisions — an executive sponsor, priorities, a budget, a place on the audit committee's agenda — is, by design, the work of each entity.
A quick test says a lot about real preparedness. How many organizations can answer today the question “how many TLS certificates do we have, and when do they expire?” Where is the data that must stay confidential for more than 10 years? Who decides, across the supply chain, what cryptography the systems the business depends on use? Where the answers are missing, they are exactly what the first phase is about — the one whose deadline expires in December.
Conclusion
Having a national roadmap and being ready to act on it are different things. Since May 2026, the second part has explicitly become every organization's problem — and fewer than six months remain until the first checkpoint. Organizations that treat December 2026 as an administrative formality will discover in the years that follow that the hard part — the migration itself — comes with a queue: for expertise, for suppliers, for budgets. Those that start the inventory now will not solve the quantum problem, but they will turn a future crisis into a project that can be planned. That difference is what matters.
This article was first published in Romanian. The original is available on this site and on LinkedIn.