🇳🇱 NETHERLANDS PQC SPOTLIGHT: SOME OF EUROPE’S STRONGEST GUIDANCE, BUT STILL NO NATIONAL MANDATE

The Netherlands sits in Tier 2 of SITG-Consulting’s Europe’s Post-Quantum Readiness 2026 assessment.

That is an important distinction.

The Netherlands has produced some of the strongest practical PQC migration guidance we found anywhere in Europe. But strong guidance is not the same thing as a governed national migration programme.

Government Posture: Strong Guidance, No Binding Migration Programme

The Dutch position is built around two important pieces of work.

The PQC Migration Handbook, second edition, was presented in December 2024 and produced jointly by AIVD, TNO and CWI.

It provides practical guidance covering:

• Risk assessment

• Cryptographic inventory

• Crypto-agility

• Migration strategy

• Technical and policy considerations

There is an important correction here because the handbook is often attributed to NCSC-NL.

It is not an NCSC-NL publication.

NCSC-NL separately published its own guidance on starting a quantum migration programme in March 2024.

The Netherlands also helped lead the working group responsible for the European coordinated PQC roadmap published in June 2025.

What Keeps the Netherlands in Tier 2?

This is where the distinction between preparation and execution matters.

Our assessment found no publicly verifiable:

• Binding national PQC migration instrument

• National migration deadline

• Mandatory cryptographic inventory requirement

• Accountable national delivery structure

That is why the Netherlands does not reach Tier 1.

The technical knowledge exists. The guidance exists. The institutions exist.

What is missing is obligation.

Cybersecurity Strengths

The Netherlands nevertheless enters the transition from a strong position:

• Detailed practical migration guidance

• Intelligence-service involvement through AIVD

• Strong applied research capability through TNO and CWI

• Separate NCSC-NL migration guidance

• Direct involvement in shaping Europe’s coordinated PQC roadmap

Bottom Line

The Netherlands is not short of PQC expertise.

It has already done much of the difficult thinking around inventory, crypto-agility and migration planning.

But Europe’s post-quantum transition will ultimately be measured by execution, not the quality of its guidance.

For the Netherlands, the next step is clear: turning strong preparation into accountable national delivery.

Tier 2. Strong foundations. Serious capability. But guidance is still not obligation.

#Netherlands #PQC #PostQuantumCryptography #QuantumSecurity #Cybersecurity #CryptoAgility #DigitalSecurity #CriticalInfrastructure #QuantumComputing #Europe

www.sitg-consulting.com