On June 23, 2025, The EU released a new PQC implementation roadmap with clear steps and timelines for all Member States, laying the groundwork for a smooth and coordinated transition to post-quantum cryptography.
Imagine knowing a storm is coming but not precisely when, how strong, or where it will hit first. That’s where cybersecurity stands today with quantum computing. The threat is real, the timeline unclear, and organizations everywhere are looking for direction.
Developed by the NIS Cooperation Group’s PQC workstream, this roadmap provides long-awaited clarity on what Member States need to do and when to ensure PQC readiness. With clear timelines, actionable steps, and a push for coordinated progress, the EU aims to get all Member States to a minimum baseline readiness by the end of 2026.
You Must Prioritize Post-Quantum Cryptography (PQC) and Shorter TLS Validity Readiness
Here’s a closer look at what the roadmap includes and why it matters.
What the Roadmap Covers (In a Nutshell)
A phased transition timeline for PQC with key milestones in 2026, 2030, and 2035
A list of concrete measures divided into First Steps and Next Steps every Member State should take to achieve national readiness
The Phased PQC Transition Timeline – A Quick Breakdown
The EU roadmap breaks the massive PQC transition into three manageable phases with clear priorities:
By the end of 2026: Every Member State should have a national PQC strategy in place. First Steps should be initiated, and pilots launched for high- and medium-risk use cases.
By the end of 2030: High-risk use cases must be fully migrated to PQC. Quantum-safe software and firmware upgrades should be enabled by default.
By the end of 2035: The transition should be complete for as many medium- and low-risk systems as possible.
To ease the transition, the EU recommends starting with hybrid cryptographic solutions that combine classical and quantum-safe algorithms whenever feasible.
Importantly, this phased timeline is designed to align with guidance and timelines set by other International bodies, such as NIST (US) and NCSC (UK). This global alignment is crucial, especially for organizations with cross-border operations or customers.
First Steps and Next Steps: Turning Strategy into Action
The EU wisely divides action into First Steps and Next Steps. This makes real progress feel achievable.
First Steps (By 2026):
The roadmap doesn’t assume you’re ready. Instead, it recommends foundational first steps like:
Identify and involve stakeholders
Support mature cryptographic asset management
Create dependency maps
Perform quantum risk analysis
Include the supply chain
Create a national awareness and communication program
Share knowledge and get involved with the NIS CG workstream on PQC
Develop a timeline and an implementation plan
Next Steps (By 2030):
Once the groundwork is in place, the roadmap suggests moving with next steps to ensure the transition is not just planned but also actionable.
Support cryptographic agility and a quantum-safe upgrade path
Allocate resources for the transition
Adapt certification schemes
Evolve the rules
Look for opportunities within the ecosystem
Considering transversal activities throughout the creation and implementation of the roadmap
Implement pilot use cases and contribute to testing centers
Assessing Quantum Risk: High, Medium, and Low
The roadmap offers a simple framework to assess quantum risk by classifying use cases as high, medium, or low based on how vulnerable existing cryptography is, the consequences of a potential compromise, and how complex migration would be.
High-risk systems (like those safeguarding long-term sensitive data) must be migrated by 2030. Medium-risk systems get until 2035. After those dates, the roadmap mandates that quantum-vulnerable algorithms should no longer be used independently.
How AppViewX Supports Every Step of PQC Readiness and Transition
AppViewX fully supports the EU’s commitment to a structured PQC transition. PQC isn’t just another cryptographic update; it is the biggest cryptographic transition in decades, one that demands time, effort, and meticulous planning. AppViewX is ready to help organizations accelerate their PQC readiness journeys with the right solutions.
How AppViewX Solutions Support PQC Readiness
Start with Cryptographic Discovery, Inventory, and Visibility
One of the first calls to action in the roadmap is building a mature cryptographic asset inventory. In other words, a comprehensive inventory of all cryptographic assets in your environment—certificates, keys, algorithms, configuration files, and their dependencies across devices, applications, workloads, and pipelines. This forms the foundation for everything that follows: dependency mapping, quantum risk analysis, and migration planning (other key aspects explicitly called out in the first steps).
The AppViewX PQC Assessment is built for this. It:
Scans your hybrid and multi-cloud infrastructures and CI/CD pipelines to identify every instance of quantum-vulnerable algorithms within codebases, configurations, dependencies, and certificates.
Generates a Cryptographic Bill of Materials (CBOM)
“Member States should promote and support that useful cryptographic inventories are being created and maintained. Generating and maintaining cryptographic inventories can be aided by tools (discovery and asset management tools). Using a standardised format for a cryptographic inventory, like CBOM Cryptographic Bill of Materials, an extension of the SBOM standard), is recommended.”
Build Crypto-Agility Into Your CLM Strategy
Another standout recommendation from the EU is cryptographic agility, the ability to quickly and safely replace cryptographic algorithms across systems without disruption.
Complete Visibility: Automated discovery and inventory of your cryptographic ecosystem, helping you prioritize PQC migration efforts.
End-to-end Lifecycle Automation: Advanced automation workflows to streamline certificate lifecycle operations and even the most complex cryptographic transitions.
Continuous Policy Control: Zero-touch policies that ensure strict PKI compliance, automatically enforcing PQC (or strong) algorithms without deviations.
AVX ONE PKIaaS is a modern, agile, and secure PKI-as-a-Service with full support for NIST-standardized PQC algorithms—ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and Falcon. You can seamlessly issue PQC-enabled certificates for internal use cases. AVX ONE PKIaaS also integrates with AVX ONE CLM for discovery, issuance, and lifecycle automation of legacy, hybrid, and PQC-ready certificates—at scale and speed.
Want to test quantum-safe certificates before rolling them out? The AppViewX PQC Test Center is a dedicated free online resource to assess your organization’s PQC readiness by generating and testing quantum-safe private trust certificates before their integration into existing systems, workloads, and machines. Quickly set up your own quantum-safe PKI hierarchy and generate PQC-ready certificates and keys to test their compatibility in your environment.
The Transition to PQC Doesn’t Start Later. It Starts Now.
The EU’s roadmap brings structure and momentum to a transition that has long felt like a moving target for many organizations. And that’s just the beginning.
Quantum threats are closing in. PQC algorithms are finalized, timelines are locked in, and the ecosystem is moving fast. If your organization operates in the EU or works with those who do, now is the time to act.
The next decade will define how resilient your cryptographic infrastructure really is. With the roadmap in hand and the right tools at your side, you can make that transition confidently.
When operations stall at 30,000 feet, it’s rarely the plane’s fault. It’s the tower.
Earlier this year, radar failures at Newark Liberty International Airport grounded flights across the United States, not because the aircraft failed but because coordination broke down. A combination of aging systems, staff shortages and manual overrides created a chain reaction that left passengers stranded and schedules in chaos.
Enterprise IT isn’t so different. Cloud systems, data platforms, ERP modernizations and AI pilots are all taking off, but the control layer that’s supposed to orchestrate them is often still stuck on the ground.
When the automation “tower” fails, everything stops.
Who’s guiding your IT traffic?
CIOs and CTOs are moving fast. They’re focused on cloud-first, generative and agentic AI and workflow automation. Under all that progress is a quiet problem: The automation architecture powering it all hasn’t kept up.
Companies are building smarter systems but still relying on old job schedulers and hard-coded scripts to orchestrate between them. That creates delays, disconnects and blind spots. The sky might look clear now, but storms are coming.
The more systems you modernize, the more complex your operations become. And as this modernization goes faster and faster over time, the harder it is to coordinate workloads with high fidelity, especially across legacy systems that require custom-coded connectors, manual refactoring for continuous integration and automation designed for a different era. While it feels like you’re accelerating, legacy systems beneath the surface are quietly pulling the brakes.
Modernization without orchestration is like asking your control tower to manage new aircraft using equipment they’ve never trained on. The sky is getting more crowded, but the systems guiding the traffic are stuck in the past.
The illusion of progress
The problem with mainframes didn’t begin and end in the early 2000s. It lingered for decades. Even as businesses moved to the cloud in the 2010s, their most critical workloads and data remained locked inside monolithic, closed mainframe applications with no APIs, no agility and shrinking pools of technical talent.
During the COVID-19 crisis in 2020, the issue broke into public view when multiple U.S. states issued emergency calls for COBOL programmers to stabilize aging unemployment systems. Rather than isolated IT issues, these were architectural bottlenecks that made rapid response impossible. No DevOps, no iterative improvement, no access to real-time data. Just batch cycles, manual updates and fragile processes buried under decades of technical debt.
Today, many enterprises are facing the same limitations, just in a different disguise. Legacy job schedulers and automation tools are the modern mainframe, standing in the way of AI adoption, API-driven integration and autonomous orchestration across cloud-native ecosystems.
These schedulers were designed for predictable workflows and tightly coupled environments, not for hybrid cloud, continuous delivery and interconnected platforms like SAP Business Technology Platform (BTP), Salesforce and Snowflake. As a result, they can’t scale, they can’t adapt and they certainly can’t keep pace with AI-driven transformation.
None of that works without modern orchestration via a control center that can coordinate business processes, eliminate human error, trigger event-based workflows and deliver consistent outcomes. Without it, transformation becomes a patchwork of short-term fixes and long-term headaches.
Static scheduling vs. intelligent orchestration
Orchestration requires controlling systems with precision and context, rather than just connecting them. That’s where event-based architecture becomes critical.
Unlike traditional scheduling, which runs on fixed times or batch jobs, event-driven orchestration allows your processes to respond dynamically to business and system events. You react to what’s happening now, not just what’s scheduled. Orders get fulfilled the moment inventory updates. Reports run the second data hits the warehouse. Downtime shrinks. You meet service-level agreements (SLAs).
At Redwood Software, we call this architecture an automation fabric: a unified layer that weaves together cloud and on-premises systems and AI innovation with full visibility, scalability and control. What makes it different?
Built for hybrid: Connect SAP, Oracle, cloud services and custom apps across environments.
Agentless integration: Connect systems without installing or maintaining local agents, so no need for custom scripts. Reduce risk, friction and security vulnerabilities.
AI-powered observability: Identify SLA risks and optimize performance before problems arise.
Unified monitoring: View everything through a single pane of glass.
Why would you custom-code or patch together manual workflows when intelligent orchestration can adapt autonomously?
Avoid a Newark moment: Your flight plan
Let’s say your global energy company is modernizing for sustainability and scale. You’re juggling regulatory demands, transitioning to RISE with SAP, piloting AI in financial planning and managing dozens of custom systems. But your core automation is still dependent on a legacy scheduler designed for batch processing and nightly jobs.
You’re not alone.
This is where modernization breaks down. It’s not in the cloud migration or the AI launch, but in what keeps it all together. By upgrading to a modern orchestration platform, your company could retire fragile custom scripts, slash risk across compliance-heavy processes and move faster with fewer people.
Rather than just picking a tool, it’s essential to choose a partner with a forward-looking vision. RunMyJobs by Redwood is designed to be air traffic control for the modern enterprise. Even if you’re not feeling the turbulence yet, the future is coming faster than you think.
Don’t wait until delays, outages or compliance gaps force your hand. Modern orchestration isn’t optional — it’s foundational.
See it in practice: Read our guide to learn how automation fabrics are helping teams orchestrate SAP and non-SAP data across industries.
If you haven’t heard, starting July 8, 2025, Sonos will begin rolling out updates to its platform to comply with new EU Radio Equipment Directive (RED) Regulations. While these regulations originate in the EU, the upcoming platform changes will affect all Sonos users globally, including those using SmartThings integrations. Read on for a breakdown of […]
The world of PKI and certificate management is evolving faster than ever. Tech giants like Google and Apple are advocating for shorter-lived certificates, Certificate Authorities (CAs) are undergoing major disruptions, and the push for post-quantum cryptography (PQC) readiness is intensifying. On top of these challenges, machine and non-human identities that rely on certificates for trust, secure access and encryption continue to grow at a significant rate. If you’re in security, staying ahead of these shifts is critical.
That’s why RSA Conference 2025 (RSAC) is the place to be. It’s where the industry’s brightest minds come together to tackle the biggest security challenges and explore path breaking solutions, and AppViewX will be right in the middle of it all.
Join AppViewX at RSAC as we break down the latest PKI trends, share future-ready certificate lifecycle management (CLM) strategies, and show you how automation and crypto-agility can help your organization stay resilient in an ever-changing security landscape. Whether you’re looking to streamline your CLM, manage machine and non-human identities at scale, get PQC-ready, or eliminate certificate-related outages and vulnerabilities—we’ve got you covered.
Here’s everything you need to know about AppViewX and RSAC 2025 to make the most of the event.
About RSA Conference 2025
Mark your calendars! The RSA Conference 2025 is happening from April 28 – May 1 at the Moscone Center in San Francisco, CA.
As one of the biggest cybersecurity events in the world, RSAC brings together top experts, thought leaders, and innovators to tackle the most pressing challenges and showcase the latest advancements in cybersecurity. This year’s theme, “Many Voices. One Community,” highlights the power of a united cybersecurity community that can “foresee risks, address threats and embrace challenges.”
Get to Know AppViewX at RSA Conference 2025
Of course, AppViewX is thrilled to be a part of RSAC 2025. You can meet us at booth #4608.
We are looking forward to discussing the latest developments challenges in machine and non-human identity management, crypto-agility and PKI, such as:
Google’s 90-day and Apple’s 47-day TLS validity proposals
Disruptive CA incidents and industry changes
Post Quantum Cryptography readiness
Swing by our booth #4608 in the North Expo (Moscone Centre) to see how the AppViewX AVX ONE Certificate Lifecycle Management and PKI platform can help your organization navigate these changes with confidence.
You can meet our experts, see live product demos, and discover how AppViewX AVX ONE:
Automates certificate issuance, renewal, and endpoint binding to help prepare for Google’s 90-day and Apple’s 45-day TLS certificate validity proposals
Enables enterprise crypto-agility to accelerate post-quantum cryptography readiness
Migrates seamlessly from one CA to another, minimizing disruptions, reducing the risk of outages, vulnerabilities and risk to ensure security and compliance
Eliminates certificate expiry related outages that lead to downtime and revenue loss
Ensures PKI and cryptography compliance with industry standards and regulations
Exclusive AppViewX Events
There is also an exciting lineup of AppViewX activities to engage with us at RSAC 2025:
1. AppViewX Customer Conference – April 28, 2025
Kick off your RSAC experience with AppViewX at our exclusive customer conference! Join us at the W Hotel, where industry pioneers, security leaders, and technical experts converge for an afternoon of insightful discussions, hands-on learning, and networking that will help you achieve crypto-agility and accelerate your journey to PQC readiness.
This invite-only event will dive deep into machine and non-human identity management trends, Certificate Lifecycle Management and PKI solutions, and real-world strategies to help you get ready for shorter validity TLS certificates and post-quantum cryptography now.
Why Attend?
Exclusive live product demos and insider previews
Hands-on technical labs and deep-dive sessions
Collaborative roundtables with CISOs and industry experts
Sneak peek into Post-Quantum Cryptography readiness with crypto-agility from AppViewX
Networking and dinner with peers and thought leaders
2. Meet One-on-One with the AppViewX Executive Team
This is your opportunity to discuss your certificate lifecycle management and PKI strategy with AppViewX leadership. Schedule a private meeting in our executive meeting suite at the W Hotel. Meet with key members of our executive team and subject matter experts to explore how AppViewX can help you get the most value out of our partnership..
Join us for an exclusive evening at the CyAlliance Waterbar Dinner event that brings together top cybersecurity professionals, thought leaders, and industry executives. Hosted at San Francisco’s iconic Waterbar, this invite-only dinner offers a relaxed setting to engage in meaningful conversations, exchange ideas, and strengthen industry connections while enjoying spectacular views of the Bay Bridge.
To get the best value from RSAC 2025, make sure to plan ahead. Here are some key things to keep in mind:
Register Early – Passes are available at different rates, so register as soon as possible to secure the best price.
Build Your Agenda – With hundreds of sessions and keynotes, planning your schedule in advance will help you maximize your experience.
Connect with AppViewX – Whether you choose to join us at our customer conference, in our meeting suite, or at our booth, we’d love to meet with you!
See You at RSA Conference 2025!
RSAC 2025 promises to be an incredible event, and we can’t wait to connect with you in San Francisco. Stay tuned for more updates, and don’t forget to register for our customer conference and book a meeting with our leadership team.
Get a free expo pass for RSAC 2025 with this exclusive AppViewX discount code “52EAPPVXXP”. Looking for a full conference pass? Use this exclusive AppViewX discount code “52FCDAPPVX” to get $150 off the full conference pass rates.