Making PQC Migration Verifiable: CBOM Profiles for the EU Roadmap and Beyond

The post-quantum transition has two problems: a deadline and a lack of proof. The EU Coordinated Implementation Roadmap sets clear milestones for moving to quantum-safe cryptography. Meeting them depends on something most organizations still don’t have: verifiable evidence of what cryptography runs in their own systems and in their suppliers’ products. Without it, migration plans rest on assumptions, and organizations can’t show progress to boards, customers or regulators.

Cryptographic Bills of Materials (CBOMs) give you visibility. CBOM profiles make that visibility verifiable. A profile sets out what must be disclosed, for what purpose and in how much detail. That makes cryptographic inventories consistent, comparable and auditable across the supply chain, whether they are written in CycloneDX or SPDX.

This hybrid session pairs a tutorial with hands-on work. We introduce two reference profiles developed in the PKI Consortium CBOM Profiles Working Group. One supports supply-chain PQC migration and is aligned with the EU Roadmap milestones. The other addresses procurement assurance. Working through real product examples, participants will apply the profiles to set supplier expectations, prioritize high-risk systems, measure migration progress and evidence readiness.

The EU Roadmap is where we start, not where we stop. We close with a discussion of how a common profile approach carries into other jurisdictions and sectors, giving organizations one framework for proving quantum readiness wherever they operate.