On November 27, 2024, Spain joined 18 EU member states in issuing a joint statement on transitioning to post-quantum cryptography. The statement, coordinated by cybersecurity agencies across the participating states, urged public administrations, critical infrastructure providers, and industry to begin preparing for the quantum threat to existing cryptographic systems.
The signatories called for organizations to treat preparation for the quantum threat as an integral aspect of cybersecurity risk management. The statement highlighted the risks associated with store-now-decrypt-later attack scenarios and the extended timelines required for cryptographic migration. It recommended completing the transition to PQC for the most sensitive use cases by 2030 at the latest.
The other participating member states included Austria, Belgium, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, and Slovenia. Spain’s participation followed its earlier publication of CCN-TEC 009 in December 2022, which had already set out national-level recommendations for the post-quantum transition.