Somewhere right now, encrypted European data may be sitting in an attacker's archive, waiting for a quantum computer powerful enough to open it. This "harvest now, decrypt later" threat is why Brussels has put post-quantum cryptography (PQC) on the NIS2 agenda. If you build software or services for EU customers, here is what the 2026 proposal says, what it does not say, and what to do before the year ends.

What the 2026 EU Proposal Actually Says

On 20 January 2026, the European Commission published COM(2026) 13, a proposal to amend the NIS2 Directive alongside a revised Cybersecurity Act (COM(2026) 11). The PQC change is a new point (k) in Article 7(2): Member States must adopt policies, within their national cybersecurity strategies, for the transition to post-quantum cryptography, taking into account the timelines set in applicable EU law and policy.

Two points matter for developers. First, it is still a proposal.…