France aims to make post-quantum cryptography a condition of product qualification; today ANSSI's PQC recommendations carry no regulatory obligation. From 2027, ANSSI, the French cybersecurity agency, aims to require PQC for security products entering qualification. ANSSI's regulated perimeter covers classified and restricted data, vital information systems and its own security visas. By 2030, businesses are expected to buy only quantum-safe products. This is real pressure on vendors. It only measures the product, though. Whether a deployed server negotiates post-quantum key exchange is a separate question, and today almost none do.
The Gate
ANSSI qualification is the ticket into one of the largest government technology markets in Europe. From 2027, ANSSI aims to withhold that ticket from a product without PQC. Samih Souissi, ANSSI's chief of staff, called the decision "a matter of governance, industrial planning, regulation, and sovereignty."
Some coverage says France is forcing operators off older systems. The mechanism is smaller than that. The gate applies to products entering qualification and to new purchases. Systems already deployed keep running. The pressure arrives when equipment gets replaced, which is where every crypto migration happens anyway.
The date was also announced years ago. ANSSI's 2022 position paper described a three-phase transition with hybridisation mandatory wherever PQC is used through the first two phases. The 2023 follow-up moved the schedule up and said the first certifications of hybrid PQC products would come around 2024 to 2025. A 2027 date for classical-only products entering qualification is that plan arriving on time.
Certification Tests the Product
A certification says the product, as tested, contains quantum-resistant encryption. It says nothing about what your copy of that product negotiates on port 443 tonight. Our Q1 scorecard compared PQC announcements from 28 vendors with their actual TLS handshakes. The announcements and the handshakes often disagree. A government stamp on the announcement changes nothing on the wire.
This is the false floor with a legal layer added. Edge providers report PQC adoption above 50 percent. Origin servers sit near 1 percent. More than 90 percent of origin servers negotiate zero post-quantum key exchange today. France can run the strictest certification program in Europe and that number only moves when operators deploy, configure, and check. [PQ]probe grades the key exchange each server actually negotiates, per probe, per scan. That is the layer certification cannot see.
Hybrid, With Room to Diverge
For its security visas, ANSSI requires hybrid PQC, meaning a post-quantum algorithm combined with a classical one, and this includes signatures other than hash-based ones. ANSSI says in writing that this matches BSI's position in Germany. That puts France opposite CNSA 2.0's pure-PQC track and the new Geomys/OpenSSH position in the signature split.
ANSSI also keeps options open beyond NIST. Section 2 of the follow-up paper lists FrodoKEM, a conservative algorithm NIST did not select. Wang Xiaoyun of Tsinghua University says China will likely have its own standards, on different math, within three years. The tracks keep multiplying. A server tuned to pass ANSSI can grade differently against a CNSA 2.0 profile, and both grades are correct. Every new national gate adds one more profile to score against.
A Fourth Clock
CNSA 2.0 wants equipment that cannot support it phased out by the end of 2030 and mandates its algorithms by the end of 2031. EO 14412 wants key establishment by the end of 2030 and digital signatures by the end of 2031 for federal high value assets and high impact systems. BSI recommends classical key agreement alone only until the end of 2031. The EU roadmap wants high-risk systems migrated by 2030 and as many other systems as feasible by 2035. ANSSI's 2027 date applies to products entering its qualification, and CNSA 2.0's date of 1 January 2027 applies to new acquisitions for U.S. national security systems; ANSSI's 2030 buying guidance matches the rest. The full list is on [PQ]time.
Souissi gave harvest-now-decrypt-later as the reason: attackers record encrypted traffic today and decrypt it when quantum computers can. That threat is why key exchange comes first in every serious migration plan. These deadlines run on purchasing and certification cycles, with or without a working quantum computer. The hardware debate does not change any of them.
France put a date on the gate. The wire shows who got through, and the wire is already reporting.
Sources:
- Reuters, June 16, 2026: reports that ANSSI will halt certification of products lacking quantum-resistant encryption from 2027
- ANSSI views on the Post-Quantum Cryptography transition (2022 position paper)
- ANSSI 2023 follow-up position paper: hybrid requirement for security visas, faster schedule, KEM section
Scan your endpoints with [PQ]probe to see which side of the gate your deployments stand on.