Immediate threat considerations include store-now, decrypt-later risks, with requirements to comply with BSI TR-02102 and to adopt hybrid cryptography for long-lived data, alongside modernizing risk management for critical infrastructure operators.

A core objective is to map and integrate encryption across supply chains and systems, addressing fragmentation in public agencies with legacy networks and codebases.

Operational actions include creating cryptographic inventories (CBOMs), establishing formal migration governance, and setting legally binding deadlines via IT-Planungsrat and UP KRITIS.

High-risk systems should migrate to quantum-safe methods by 2030, with broader transition largely complete by 2035.

The Leitlinie endorses hybrid cryptography combining classical and post-quantum algorithms and requires organizations to maintain a crypto-inventory of components.

Architectural upgrades should occur within a 4-9 year window, emphasizing crypto-agility to prevent costly rebuilds.

Ongoing updates and links to the official guideline document and related press releases provide broader context.

Germany is rolling out a national framework to implement the EU roadmap on post-quantum cryptography (PQC), with a Leitlinie aligned to the three-stage EU timeline and binding deadlines for federal, state, and municipal levels by the end of 2026.

The federal agencies BMDS, BMI, and BSI issued joint guidelines guiding the migration of public and private digital infrastructure to PQC, including a crypto-ready inventory and governance structure.

The roadmap warns that AI accelerates vulnerability discovery and could enable future decryption of data that is currently secure, making proactive upgrades essential rather than reactive.

The guiding principle is to protect data with long shelf life ahead of the quantum era, using the collect-now, decrypt-later mindset.

A key rationale is that many cryptographic standards endure for years, so timely migration is essential to avoid security gaps.