Governing the PQC Transition in the US and the EU: A Comparative Analysis

Although the US has been regarded as a frontrunner in the global pursuit of quantum-readiness, distinguished by its top-down approach to the PQC transition, hosting the main institutional venue undertaking PQC standardisation, and producing a considerable amount of technical guidance through its specialist agencies, it has been facing significant domestic implementation challenges. Both executive and legislative bodies have cast a critical light, citing the slow pace of progress, the limited scope of the current US PQC migration strategy (making it mandatory only for federal government) and the lack of appropriate leadership.

The adjustments that have been proposed include, among others, more streamlined governance, performance measurement, and better encouragement for all sectors to embrace this change. New legislative proposals addressing the PQC transition have since proliferated and executive actions have reportedly been in the pipeline. After backsliding from some elements of the previous administration's PQC transition course in June 2025, the current administration released its Cyber Strategy in March 2026, promising to accelerate PQC deployment. Meanwhile CISA, one of the key actors in facilitating this transition, has been exposed to a rather precarious situation, leading to a sizeable reduction of its workforce, which may have some disruptive impact on the governance of this process.

In the EU the PQC migration has been unfolding quite differently. Here, the process has been driven for some time by strong policy entrepreneurship and expertise coming from national cybersecurity authorities in several Member States, which can be viewed as a bottom-up dynamic. The EU-level strategy formulated in 2024 appears to be more comprehensive than the US equivalent, as alongside public administrations it encompasses critical infrastructures. There is also a sound legal base in EU law, consisting of a set of regulatory instruments requiring state-of-the-art cybersecurity measures commensurate with the risks and fulfilment of the principles of privacy-by-design and security-by-design.

Arguably, however, this should be strengthened by making requirements regarding PQC more explicit and by streamlining them across the various existing instruments and guidelines for consistency and legal certainty. There is also a need for the EU to enhance its funding for PQC development and deployment, based on the rationale that it represents the main solution in countering the quantum threat, especially in the near term. Recent EU legislative proposals have generally stressed the increasing urgency of enacting the PQC migration, and although the EU has tangibly contributed to the US-led PQC standardisation endeavours with its scientific excellence in the field of cryptography, these new proposals also signal that the EU might now be set to pursue its own framework.

Attendees of this session will benefit from a granular view of how the PQC transition has been governed in these two jurisdictions and what future projections can be identified.