Cybersecurity — Post-Quantum Cryptography

France Cuts Off Non-Quantum-Safe Gear From 2027

France's national cybersecurity agency has announced that from 2027, products without post-quantum cryptography will lose their official security label — forcing a continent-wide encryption overhaul that was still a recommendation just a year ago.

• ANSSI will stop certifying security products lacking PQC from 2027, with all business purchases expected to be quantum-safe by 2030.
• The clock is real: certification cycles take 12 to 18 months, so products entering the pipeline now are on a tight schedule.
• ANSSI requires hybrid schemes — pairing new post-quantum algorithms with classical cryptography — not a pure PQC swap.

The driver is a threat that does not require a working quantum computer today. "Harvest now, decrypt later" means an adversary can record encrypted traffic right now — bank transfers, state secrets, medical records — and crack it once a cryptographically relevant quantum machine appears. The data captured in 2026 may contain secrets that stay valuable for decades, so waiting for the quantum to arrive would already be too late.

The new algorithms at the centre of the shift, ML-KEM and ML-DSA, were standardised by the US National Institute of Standards and Technology in 2024. France is not writing its own mathematics from scratch; it is deciding which of these ready-made locks its critical infrastructure must use. ANSSI has also reserved the right to approve algorithm sets that do not exactly mirror NIST's picks, reflecting a broader European instinct to keep cryptographic sovereignty in its own hands.

The announcement lines up with a US parallel: the NSA's CNSA 2.0 gate, which demands quantum-safe algorithms in all new US national-security acquisitions from January 2027. A vendor selling into both markets now has to satisfy two strict, slightly different rule books at the same time. The message regulators are sending is consistent: post-quantum cryptography has stopped being a long-term research project. It is now a purchasing requirement, and the deadlines have arrived.