Germany has adopted the EU's 2030 and 2035 post-quantum dates in its new national guideline. The date that German boards should have in mind now is 31 December 2026. On 12 October, the interior and digital ministries and the federal cybersecurity agency BSI published the guideline for administrations at every level of government, companies and critical-infrastructure operators. By 31 December, each of them should have a named owner with staff and budget, binding implementation plans with deadlines, a first cryptographic inventory and first migration steps under way. In the EU roadmap, member states agreed to take first steps by then. Germany turned that into a list for every organization. The dates are recommendations, but their authors want them made as binding as possible by the end of the year. They asked the IT-Planungsrat, the federal-state IT council, and the critical-infrastructure partnership UP KRITIS to do that. Section 30 of the BSI Act already requires most NIS2-regulated entities to include cryptography in their risk management, with measures that should meet the state of the art. For that standard, the BSI cites its own TR-02102, post-quantum schemes included. My reading is that a supervisor can ask today whether quantum risk is in an entity's risk register, with mitigation dates. The Netherlands published its version a week earlier, for central government only, with a draft migration plan due by the end of 2027. Germany wants plans this year from companies and all three levels of government. My full analysis: postquantum.com/security-pqc… #PQC #PostQuantumCryptography #QuantumSecurity #Cybersecurity #CISO #NIS2 #KRITIS #Germany