Financial services in the EU
DORA already asks for a plan to change your cryptography.
EU financial entities have a binding rule about cryptography that ages. DORA’s technical standard requires an encryption policy that provides for replacing the cryptography when attacks on it improve. A quantum computer that breaks today’s public-key algorithms is that kind of improvement.
DORA has applied since 17 January 2025 (Article 64). DORA on EUR-Lex
What the rules say
Four sentences from the technical standard.
“provisions for updating or changing, where necessary, the cryptographic technology on the basis of developments in cryptanalysis”
Your encryption policy has to say how you will replace cryptography that stops being safe.
Read the source“a requirement to record the adoption of mitigation and monitoring measures adopted in accordance with paragraphs 3 and 4 and to provide a reasoned explanation for doing so”
Where you cannot update yet, you record what you did instead, and why.
Read the source“managing cryptographic keys through their whole lifecycle, including generating, renewing, storing, backing up, archiving, retrieving, transmitting, retiring, revoking, and destroying those cryptographic keys”
Retiring a key is part of the policy, which is what a migration does to every quantum-vulnerable key.
Read the source“a register for all certificates and certificate-storing devices for at least ICT assets supporting critical or important functions”
You need to know where your certificates are before you can replace them.
Read the sourceThese articles sit in Title II of the standard. Smaller entities listed in DORA Article 16(1), such as small and non-interconnected investment firms, follow its simplified framework in Title III instead.
The standard does not mention quantum computers. The EU’s post-quantum roadmap cites DORA and NIS2 as rules that already require state-of-the-art cryptography, and its FAQ says post-quantum migration is crucial for protecting financial systems. The roadmap and its FAQ
The dates
EU Coordinated Implementation Roadmap.
Issued 23 June 2025. A recommendation to EU Member States, not a law that binds a firm directly. It cites DORA and NIS2 as rules that already require state-of-the-art cryptography.
What an assessment gives you
Each part, against what it serves.
The inventory: the cryptography found in the code and dependency manifests you give us, each finding with the file and line where it was seen. It is a starting point for the register, not the register itself: certificates on devices we cannot scan come from you, and are marked as such.
The exposure ranking and the migration plan: which public-key uses a quantum computer breaks, in what order to replace them given how long their data must stay secret, and with what.
The evidence file: the inventory, the ranking and the plan as linked, signed records, with the assumptions behind the ranking sealed in. The reasoned explanation is yours to write; the file gives it something an auditor can check.
What this is not
- This is not a DORA compliance certification. Whether you comply is for you and your supervisor to decide.
- DORA sets no post-quantum deadline. The dates above come from the EU roadmap, which is a recommendation to Member States.
- The assessment covers the systems you put in scope. Cryptography we are not shown is not in the inventory.
Next
See what the deliverable looks like.
The sample is a made-up Spanish bank run through the real method, with each finding cross-referenced to the articles above.
Quotations read from EUR-Lex on 21 September 2026.