EU and global timelines: NIS CG, DORA, G7

Mental model

In the previous lesson you saw the US’s binding (EO 14412, CNSA 2.0) and advisory (IR 8547) documents. This lesson shows three different regulatory shapes on the EU and global side: concrete dates but indirect (the EU roadmap), binding but with no date (DORA), and dated but explicitly non-binding (the G7 CEG).

The EU coordinated roadmap: concrete dates, in its own wording

The Coordinated Implementation Roadmap published by the EU’s NIS Cooperation Group (v1.1, 11 June 2025) contains three milestones: member states publish national roadmaps by 31 December 2026^SOURCED, the PQC transition of “high-risk use cases” is completed by 31 December 2030^SOURCED, and medium and low-risk use cases are completed by 2035^SOURCED. There is a subtlety to note here: the document’s own wording is “high-risk use cases”, not “critical financial infrastructure”; it is a correct inference that the financial sector falls within that scope (the roadmap references DORA separately), but it is not a verbatim quote of the document’s own sentence. When presenting these dates to an architect, rather than saying “the EU roadmap says 2030 for the financial sector”, it is more accurate to say “the EU roadmap says 2030 for ‘high-risk use cases’, and finance falls within that scope”.

DORA: no date, but a discipline

DORA (Digital Operational Resilience Act) is the EU financial regulation in force since January 2025, but the cryptography clause of its own ICT risk management RTS (Delegated Regulation 2024/1774) does not give a date. The document’s own Recital 9 is clear: “Given the rapid technological developments in the field of cryptographic techniques, financial entities… should remain abreast of relevant developments in cryptanalysis and consider leading practices and standards.” So instead of a fixed date, DORA asks for continuous, risk-based vigilance; a regulatory approach categorically different from the concrete dates of EO 14412 or the EU roadmap. The right answer to a bank asking “when does DORA tell us to do it”: “it gives no specific date, but it obliges us to keep our cryptography policy current and to follow leading practices.”

G7 CEG: dated, but explicitly non-binding

The roadmap published on 13 January 2026 by the G7 Cyber Expert Group (co-chaired by the US Treasury and the Bank of England) names 2035^SOURCED as a general target for the financial sector; it recommends building crypto inventories, identifying the most sensitive systems, planning transitions and testing PQC technology. But the document itself describes this date explicitly as non-binding and open to change with the development of quantum technology. That is a third level of certainty, between the EU roadmap (not binding, but from an official EU body and aimed at member states) and EO 14412 (fully binding); presenting all three to an auditor with the same certainty would be an indefensible overclaim.

Update, October 2026

Two more signals since this lesson was written, neither changing the frames above. On 3 September 2026 the G7 Cybersecurity Working Group, a different G7 group from the CEG, published a call to action urging governments and organizations to start the PQC transition as soon as possible, without setting new dates. On 5 October 2026 the Dutch cabinet sent a government-wide quantum strategy to parliament; according to a secondary summary of the strategy document, it sets milestones for central government of high-risk systems migrated by end of 2030 and medium-risk by end of 2035, in line with the EU roadmap’s dates. Sources are on the news desk.