EU Cryptography Rules Beyond DORA: The Recommendation, Roadmap, NIS2 And CRA

Financial entities in the EU have a clear cryptography rule in the DORA technical standards. Everyone else has to piece the picture together from several instruments. Some are binding law that mentions encryption only in general terms. Others are detailed post-quantum plans that carry no legal force.

This article sets out the main EU instruments as of October 2026, explains which are binding and which are guidance, and shows how they relate to DORA. It assumes some familiarity with EU legislative terms.

The Overall Structure

It helps to think of the EU approach in three layers.

The post-quantum dates live in the top layer. The legal obligations live in the lower two, and their binding articles do not name quantum computing, although recital 9 of the DORA technical standard recognises quantum-related cryptographic risks.¹ Connecting them is a matter of interpretation, which this article points out where it happens.

The Recommendation And The Roadmap

On 11 April 2024 the European Commission adopted Recommendation (EU) 2024/1101 on a coordinated implementation roadmap for the transition to post-quantum cryptography.² A recommendation is not binding. It invited Member States to form a sub-group of the NIS Cooperation Group, the body that brings national cybersecurity authorities together under NIS2, and to produce a roadmap within two years.

They moved faster than that. Partners from 18 Member States had already issued a joint statement in November 2024 recommending that the most sensitive uses be protected against store now, decrypt later attacks by the end of 2030 at the latest.³ The roadmap itself, version 1.1, was published on 23 June 2025.⁴ Its timeline has three milestones:

• By 31 December 2026: all Member States have implemented the first steps, set initial national transition roadmaps and started planning and pilots for high-risk and medium-risk use cases.
• By 31 December 2030: the next steps are implemented, high-risk use cases have completed the transition, and quantum-safe software and firmware upgrades are enabled by default.
• By 31 December 2035: medium-risk use cases are complete, and low-risk use cases are complete as far as feasible.

The roadmap also says that, for high-risk use cases, quantum-vulnerable public-key mechanisms should not be used on their own after the end of 2030, and recommends standardised hybrid schemes that combine classical and post-quantum algorithms where feasible.⁴

In April 2026 the NIS Cooperation Group published an FAQ on the roadmap. It says that, at a minimum, entities in scope of NIS2 should create an inventory of cryptographic assets and dependency maps, involve their supply chain and perform a quantum risk analysis, and it encourages all organisations to do the same.⁵ It also makes clear that an inventory does not need to be finished before planning starts.

NIS2: A Cryptography Policy Requirement

The NIS2 Directive, (EU) 2022/2555, is binding, but as a directive it works through national laws. Member States had to adopt their transposing measures by 17 October 2024 and apply them from 18 October 2024.⁶

Article 21(2) lists the minimum cybersecurity risk management measures that essential and important entities must take. Point (h) covers policies and procedures on the use of cryptography and, where appropriate, encryption.⁶ The text does not specify algorithms or dates. In the author’s view, a cryptography policy that ignored a threat the EU’s own roadmap treats as urgent would be hard to defend, but that is an interpretation, not a stated rule.

For certain digital infrastructure and digital service providers listed in Article 21(5), the Commission was required to adopt implementing acts with more technical detail by 17 October 2024.⁶ It did so in Implementing Regulation (EU) 2024/2690 of 17 October 2024, which covers DNS service providers, top-level domain registries, cloud computing, data centre and content delivery network providers, managed and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers.⁷

For those providers, section 9 of its annex turns point (h) into specific duties. They need a cryptography policy based on their asset classification and risk assessment that sets the type and strength of protection for data at rest and in transit, the protocols and algorithms they approve (following, where appropriate, a crypto-agility approach, meaning systems can switch algorithms without major rework) and their approach to key management across the key lifecycle. They must also review the policy at planned intervals, taking the state of the art in cryptography into account.⁷ Other NIS2 entities are not bound by that annex, though they may find it a useful reference.

The Cyber Resilience Act: Encryption In Products

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements sold in the EU. Annex I, Part I, point (2)(e) requires such products, based on their risk assessment and where applicable, to protect the confidentiality of stored, transmitted or otherwise processed data, for example by encrypting relevant data at rest or in transit “by state of the art mechanisms”.⁸

The CRA was published on 20 November 2024 and entered into force on 10 December 2024. It applies in stages: the rules on conformity assessment bodies from 11 June 2026, manufacturers’ reporting obligations under Article 14 from 11 September 2026, and the rest, including the Annex I requirements, from 11 December 2027.⁸

What counts as state of the art moves over time. The NIS Cooperation Group’s FAQ states that post-quantum cryptography is necessary to protect CRA products from quantum threats.⁵ That is guidance, but it signals how authorities may read the requirement as the 2027 date approaches.

Where DORA Fits

NIS2 treats DORA as a sector-specific act for financial entities. Under Article 4 of NIS2 and its recitals, DORA’s ICT risk management and incident reporting rules apply to those firms instead of the matching NIS2 provisions.⁶ For a bank or insurer, the binding cryptography rules are therefore Articles 6 and 7 of Delegated Regulation (EU) 2024/1774, covered in a separate article in this section. The roadmap and FAQ still apply as guidance, and a financial firm that also manufactures software products may fall under the CRA.