The Quantum threat and the urgent need for PQC
The coming era of quantum computing threatens to undermine much of the cryptographic infrastructure we rely on today. The asymmetrical algorithms that protect data, communications and digital services may, in time, become vulnerable. In response, both the European Commission and the Italian government have signalled that a transition to post-quantum cryptography is no longer optional but essential for public administrations and critical infrastructures.
European-level framework
On 11 April 2024 the European Commission issued the Commission Recommendation (EU) 2024/1101 “on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography”.
Key points include:
- Member States are invited to define a national “PQC Coordinated Implementation Roadmap” aligning with a joint EU-wide effort.
- The focus is on migrating infrastructures and services of public administrations and other critical infrastructures.
- The strategy must include clear goals, milestones and timelines.
- The need for hybrid schemes (i.e., PQC combined with current cryptography or quantum key-distribution) is explicitly mentioned.
- A rough roadmap: Member States should start by end-2026; high-risk transition areas (critical infrastructures) by 2030; ideally full migration by around 2035.
Despite the clarity of these milestones, one might ask: are these dates legally binding? Do they apply to all sectors equally? The recommendation nature of the document means enforcement depends on national conversion and regulation.
Italian national framework
Italy has also taken steps. The Strategia italiana per le tecnologie quantistiche (published by the Ministry of University & Research) explicitly mentions:
- “Affiancare la crittografia post-quantum alle primitive quantistiche …” (i.e., to accompany PQC with quantum primitives) in implementing the strategy.
- “Implementare la crittografia post-quantistica all’interno delle infrastrutture di rete tradizionali …” (i.e., PQC within traditional network infrastructure) which likely includes critical infrastructures. Additionally, the Italian document Ecosistema industriale italiano delle tecnologie quantistiche (Feb 2025) refers to the role of PQC and quantum key distribution (QKD) in the national industrial ecosystem.
However: the Italian strategy appears to articulate intention rather than strict deadlines for all critical sectors. The language is broader (“promuovere”, “implementare”) rather than prescribing detailed binding milestones for each infrastructure category.
Why this matters – and why it’s challenging
- For critical infrastructures (energy, transport, telecom, finance, public services) the lifetime of systems is long and migration complex. Delays in adopting PQC raise the risk of “store now, decrypt later” attacks: adversaries may intercept encrypted data today, wait until quantum computers can decrypt it tomorrow.
- While the EU roadmap gives time-targets, translating them into binding national regulation is a different matter. The Italian documents signal awareness and high-level commitment but less so hard deadlines.
- The technical and logistical burden is not trivial: inventorying cryptographic assets, assessing quantum-risk, migrating to quantum-resistant algorithms, ensuring interoperability, updating standards, replacing legacy systems.
- The interplay of PQC and quantum key distribution complicates matters further: Italy explicitly mentions QKD in its strategy but acknowledges it only as complementary.
Conclusion
In short: yes, both Europe and Italy are on board with the transition to post-quantum cryptography for critical infrastructures and public services. The European Commission has issued a roadmap with defined timelines; Italy has incorporated PQC into its broader quantum technologies strategy. But the gap remains between strategic intent and operational binding measures, especially for the most critical sectors of infrastructure. The coming years will be decisive: implementation will test whether the rhetoric becomes real.