Defense
The urgency of the quantum threat, EU policy alignment, and the implementation path forward.
The Urgency of the Quantum Threat
The need to act on quantum security is urgent and immediate. While fully scalable quantum computers are still in development, experts warn that cryptographically relevant quantum computers -- those capable of breaking common encryption -- could arrive within this decade.
The threat is not science fiction -- it is already influencing adversaries' behavior. Intelligence agencies and cybercriminals are likely intercepting and stockpiling encrypted data today, anticipating the day they can decrypt it with quantum means. Sensitive personal data, state secrets, financial records -- any information that must remain confidential for years -- is at risk under this "harvest now, decrypt later" strategy.
Preparing for the quantum threat is a time-sensitive endeavor. Transitioning an entire continent's cryptographic infrastructure to new standards is a massive undertaking that will span years.
In June 2025, EU Member States -- through the NIS Cooperation Group -- published a Coordinated Implementation Roadmap for the Transition to PQC, urging states to initiate national strategies by 2026. High-risk sectors must deploy quantum-safe encryption no later than 2030, and by 2035 as many systems as possible should be quantum-proof.
This timeline underscores a crucial point: the window for proactive action is finite. Each year of delay increases the risk that critical European data could be covertly collected now and exposed later.
Complementarity with EU Initiatives
The Quantum-Safe Stack is not a standalone effort, but a complementary initiative that builds upon and reinforces existing EU policies and programs. It acts as the connecting thread that weaves together various strands of Europe's digital strategy under the banner of quantum security and sovereignty.
EuroQCI
The Quantum-Safe Stack complements the European Quantum Communication Infrastructure's work on quantum key distribution networks. While EuroQCI focuses on deploying cutting-edge quantum communication channels, the Quantum-Safe Stack provides the broader policy framework to integrate these channels into Europe's overall security architecture.
NIS2 Directive and EU Cybersecurity Strategy
NIS2 modernizes Europe's cybersecurity rules, imposing risk management and security requirements on a broad range of sectors. The Quantum-Safe Stack directly supports NIS2's implementation by addressing a key emerging risk -- quantum threats -- in a coordinated way.
EU Chips Act and Semiconductor Initiatives
The Chips Act aims to boost Europe's capacity in semiconductor R&D and manufacturing. This is highly synergistic with the Quantum-Safe Stack's hardware layer. Developing quantum-safe hardware roots of trust can be championed as priority areas under the Chips Act's framework.
Data Act and European Data Spaces
Europe's Data Act seeks to create a single market for data. By guaranteeing that data shared or stored anywhere in the European Data Space is protected by quantum-safe encryption, the Quantum-Safe Stack reinforces the trust framework underpinning the Data Act.
Gaia-X and European Cloud Services
Gaia-X emphasizes interoperability, data sovereignty, and security. The Quantum-Safe Stack can be viewed as an evolution of the Gaia-X vision in light of quantum disruption, bringing the dimension of "quantum-resistance" into the design of cloud services.
Implementation Path
Translating the Quantum-Safe Stack vision into reality will require concerted action on multiple fronts. We recommend the European Commission and Member States launch a structured program with dedicated funding, a clear roadmap, and a robust governance mechanism.
European Quantum-Safe Infrastructure Fund
Establish a sizable, multi-year European Quantum-Safe Infrastructure Fund to finance this initiative. Achieving a quantum-safe European stack will demand significant investments -- in R&D, in pilot deployments, in upgrades of public infrastructure, and in skilling the workforce.
Pan-European Roadmap and Policy Framework
Develop a detailed Quantum-Safe Europe Roadmap 2025-2035, endorsed at the highest political level. This strategic roadmap should set clear milestones and targets, such as establishing national quantum-safe task forces by 2026 and achieving quantum-safe encryption of sensitive data EU-wide by 2030.
Governance and Coordination Framework
Launch a dedicated Quantum-Safe Europe Task Force or Coordination Board to govern the initiative. Given the multi-faceted nature of the Quantum-Safe Stack, a strong governance structure is needed to break silos and drive implementation across sectors and Member States.