🇱🇹 LITHUANIA PQC SPOTLIGHT: THE ONLY EU MEMBER STATE TO REACH TIER 1

Brian Couzens
2 days ago
2 min read

Lithuania stands apart in our assessment of post-quantum readiness across the EU-27.

It is the only Member State to reach Tier 1, High Confidence.

This does not mean Lithuania has completed its PQC migration. It means something more useful at this stage: the country has established publicly verifiable migration machinery, with governance, mandatory actions, implementation dates, inventory requirements and procurement provisions.

Government Posture: From Awareness to Execution

On 25 March 2026, the Lithuanian Government approved a national post-quantum cryptography transition plan.

For essential cybersecurity entities, the transition is no longer simply encouraged.

By 1 May 2027, covered entities must complete a cryptographic inventory, identify high-risk systems and prepare PQC implementation plans.

By 1 January 2031, PQC or hybrid algorithms must be deployed in high-risk systems using asymmetric cryptography.

From 1 January 2036, covered systems must use PQC algorithms only, with legacy algorithms removed.

Cryptographic Inventory: A Major Difference

One of Lithuania's strongest features is that it has gone beyond simply telling organisations to inventory their cryptography.

A methodology has been published.

A downloadable inventory return form has been provided.

The inventory is not intended as a one-off exercise either. Covered organisations must repeat it at intervals of no more than three years.

That matters.

You cannot manage a cryptographic transition if you do not know what cryptography you have, where it sits, what it protects and what depends upon it.

Procurement and Suppliers

Lithuania also recognises that organisations cannot migrate everything themselves.

Cryptography is embedded throughout purchased technology, products and services.

Its approach therefore extends into procurement, crypto-agility and supplier dependency, including the need to establish whether suppliers can support the transition.

This is an area we believe will become increasingly important as European migration moves from policy into implementation.

Why Lithuania Reached Tier 1

Lithuania demonstrated the combination we were looking for:

• Government-approved national transition plan

• Named implementation structure

• Mandatory cryptographic inventory

• Published inventory methodology and return mechanism

• Defined 2027, 2031 and 2036 milestones

• PQC and hybrid transition requirements

• Procurement and supplier provisions

• Recurring inventory requirements

Bottom Line