The bibliography of Germany's national post-quantum guideline, published on 12 October by BMI, BMDS and BSI, cites BSI TR-02102-1 with the date December 2026. The edition in force is 2026-01, dated 23 January 2026. The guideline relies on TR-02102 for the list of mechanisms that count as quantum-safe, for their conditions of use, and for the state of the art that § 30 BSIG requires of regulated entities, so the reference is the one in the document with legal consequence. Whether the December date is an error for the January edition or refers to a revision not yet published is not stated.
The document carries three dates of its own: 11 September 2026 in the page header, August 2026 as the Stand in the imprint, and 12 October 2026 on the press release. The European Commission's policy page listed the German document on 20 October beside France and the Netherlands, the three national roadmaps listed sixteen months after the EU roadmap they implement. The federal government's 2023 Handlungskonzept Quantentechnologie set a migration strategy as a goal for 2026, which the guideline notes on its third page.
Scope, risk tiers and dates
The guideline is addressed to federal, state and municipal administrations, to organisations and companies, and to operators of critical infrastructure. It adopts the EU roadmap's timelines in one sentence and sorts use cases into high, medium and low quantum risk by the method of the PQC Migration Handbook of TNO, CWI and AIVD: the attackability of the mechanisms in use, the damage if they fail, and the effort of converting them.
| Date | What the guideline expects |
|---|---|
| End of 2026 | Preparation and planning complete; first conversion steps begun; initial cryptographic inventory complete; IT-Planungsrat and UP KRITIS adopt the deadlines as binding |
| End of 2030 | High-risk use cases quantum-safe |
| End of 2035 | Medium-risk use cases quantum-safe; overall conversion complete for as many systems as possible (summary), for nearly all systems (section 4), or largely (press release) |
| Low risk | No date |
Low-risk use cases, the third of the guideline's own tiers, receive no date on any page. Section 3 adds that organisations which cannot meet the recommended dates must assess their individual risk, and the tier a system falls into comes from the organisation's own assessment under section 4.5. Section 4.1 calls the deadlines urgent recommendations and names the bodies expected to make them binding by the end of 2026: the IT-Planungsrat for the states and municipalities, for whom BSI requirements often have only recommending character in the document's words, and UP KRITIS for critical infrastructure. The one binding date the guideline cites is in the classified domain, where the BSI agreed with manufacturers in September 2025 that quantum-safe products for restricted classified information be available by 2030. Everyone else is referred to TR-02102.
The inventory recommendation
Section 4.3 asks every organisation to produce an overview of its cryptographic components, modelled on the Krypto-Kataster of IT-Grundschutz module CON.1, requirement CON.1.A19, with the initial version complete by the end of 2026. The section names cryptographic inventory tools, repository scans and CycloneDX cryptographic bills of materials as the means, and asks for dependencies between components to be recorded, with the example of a card reader and its cards, which must both be converted before the channel between them is quantum-safe. Section 4.6 adds that a supplier's provision of a CBOM can be written into contracts. The guideline notes that the inventory improves security whether or not the migration follows.
Section 4.2 asks each organisation to set up a coordinating body or name a responsible office and assigns it the monitoring of progress. No report goes to the BSI, the ministries or the EU, and no metric is named. The one figure the guideline offers is from the BSI's 2023 market survey with KPMG, in which nearly 90% of participants expected not to counter the quantum threat in time. The survey had 28 participants.
§ 30 BSIG and TR-02102
Section 4.4 is where the recommendation meets an obligation. Cryptographic applications must meet the state of the art, for example by following TR-02102, and important and particularly important entities are obliged under § 30 BSIG to keep the state of the art for cryptography in line with their risk management. The NIS2 implementation act that wrote that section entered into force on 6 December 2025 and brought about 29,500 entities under BSI supervision, from about 4,500 before.
The chain runs from the Act to the state of the art, from the state of the art to TR-02102, and from TR-02102 to the dates it sets: classical key agreement alone only until the end of 2031, the end of 2030 for very high protection needs, and quantum-safe signatures by 2035, as covered in February. The guideline lays the risk tiers and the inventory date on top. The document that gives the recommendations their obligation is the one cited with the December 2026 date.
Two timelines in one document
The threat timeline is the BSI's study on the state of quantum computing, first commissioned in 2017 and updated in 2025. The guideline reads it as making a cryptographically relevant quantum computer likely within fifteen years, by 2040 or earlier, and adds that the basic assumptions of quantum error correction were fully verified in 2024 and that further progress could shorten the period considerably. Footnote 3 quotes the federal government's working hypothesis for the high-security domain from a Bundestag paper of February 2025: cryptographically relevant quantum computers available at the beginning of the 2030s. The end-2030 deadline for high-risk systems matches the second of the two.
German NIS2 endpoints in the monitor
The inventory the guideline asks for is not visible from outside. Key exchange on public endpoints is. The [PQ]probe NIS2 Monitor grades 353 German endpoints in NIS2 sectors; 118 of them, 33.4%, negotiate post-quantum key exchange, against 42.4% across the EU-27. Public administration is at 27 of 81, health at 19 of 56, banking at 10 of 31, energy at 5 of 20. Over the last ninety days the German share rose 10.7 points, which projects full key-exchange migration to 2028, inside the guideline's date for high-risk systems and behind the EU average. Key exchange is the part vendors switch on by default. Signatures and inventories move at the pace of the organisations the guideline addresses, and nothing in the guideline makes either visible.