Post-Quantum Cryptography: What Swiss SMEs Should Do Now

Since 27 October 2026, NIST's timeline has been final: RSA and elliptic curves are deprecated after 2030 and disallowed in NIST standards after 2035. The EU and Germany set similar deadlines. For SMEs, the transition starts with a crypto inventory.

On 27 October 2026, the US National Institute of Standards and Technology (NIST) published the final version of its report IR 8547. Under it, RSA, Diffie-Hellman and elliptic-curve schemes are deprecated after 2030 and may then only be used after weighing the risk. After 2035, they are disallowed under NIST standards, now for every key length.

No quantum computer capable of breaking these schemes exists yet. Even so, NIST, the EU and Germany advise starting the transition now: whatever is transmitted in encrypted form today can be recorded and decrypted later.

What a Quantum Computer Would Break

The threat is to asymmetric cryptography (public-key cryptography). It negotiates the session key when a connection is set up, for example for HTTPS, VPN and SSH, and underpins every digital signature. Symmetric encryption, for example with AES, is far less exposed. The Federal Office for Cyber Security (BACS) recommends AES-256 instead of AES-128 here.

Nobody knows when such a machine will arrive. A guideline from Germany's Federal Office for Information Security (BSI) and two federal ministries considers it likely that one can be built within 15 years at most. The estimated effort keeps falling: in 2019, researchers estimated 20 million qubits for a 2048-bit RSA key, in 2025 fewer than one million. Hardware is far from this. Experiments with error-corrected qubits have so far reached a few dozen.

Why the Clock Is Already Running

Attackers can capture encrypted traffic today and store it until decryption becomes possible. This is known as "harvest now, decrypt later". For the BACS, this possibility is currently "the primary motive" for finding practical solutions as quickly as possible.

What matters is how long your data must remain confidential. The EU roadmap classifies a use case as high-risk if disclosure after ten years or more would still cause significant damage. In SMEs, this can apply to personnel files, contracts or design drawings. Such data is at risk wherever its protection relies on public-key cryptography, for example email, cloud synchronisation and VPN. Data additionally encrypted symmetrically with a key held only by you remains protected.

Signatures can only be forged once such a quantum computer exists. Long-lived devices are the issue. The EU roadmap highly recommends that new products with an expected lifetime beyond 2030 should be upgradable to post-quantum cryptography and secure their updates with post-quantum signatures. A machine controller that verifies firmware updates with RSA today will probably still be running in 2035.

What the EU, Germany and Switzerland Require

The EU Member States adopted a joint roadmap in June 2025: first steps and initial national roadmaps by the end of 2026, migration of high-risk use cases by the end of 2030 and of medium-risk ones by the end of 2035. According to the FAQ, at a minimum the entities covered by NIS2 should create a crypto inventory. The roadmap also recommends that every organisation talk to its suppliers, because the transition depends on them.

Germany is implementing the roadmap through this guideline. Published on 12 October 2026, it explicitly addresses companies as well and calls for an initial crypto inventory by the end of 2026. The BSI recommends hybrid schemes that combine classical and quantum-safe algorithms.

Switzerland has no binding deadline. The BACS recommends that organisations "consider a migration and plan it in the medium term". On 16 September 2026, the Council of States adopted motion 26.3628 by Charles Juillard. It calls for a national roadmap with a migration strategy by the end of 2027, migration of high-risk use cases by the end of 2030, minimum requirements for critical infrastructure, among others, and post-quantum readiness requirements in federal tenders. The National Council is next.

Support for the cantons, SMEs and universities, for example through guidelines and inventory templates, was dropped. Among other reasons, the Federal Council rejected it so as "not to weaken personal responsibility for cyber security". Juillard withdrew the point, on the understanding that the Federal Council would still provide guidelines within its responsibilities. Most SMEs will be reached through suppliers and EU customers under NIS2. For manufacturers selling in the EU, the Cyber Resilience Act also applies in full from 11 December 2027.

Data protection law is relevant too: under the Swiss Data Protection Ordinance, the state of the art must be taken into account when setting measures to protect personal data, and the measures must be reviewed over the entire duration of processing. According to the German guideline, using outdated or vulnerable cryptography may be considered negligent even quite apart from quantum computers.

What Is Already Quantum-Safe Today

Much of this arrives with updates. Since autumn 2024, desktop Chrome and Firefox have used a hybrid key exchange with the new ML-KEM standard by default, as has Apple since iOS 26 and macOS 26 for connections through the system's networking interfaces. According to Cloudflare, around 70 percent of browser traffic on its network was protected this way at the end of September 2026. OpenSSH has used a quantum-safe key exchange by default since version 9.0, and OpenSSL supports the new schemes from version 3.5.

The gaps lie in your own servers and devices. According to Cloudflare, only around 15 percent of its customers' origin servers used the hybrid scheme. Windows 11 from version 24H2 and Windows Server 2025 support it with TLS 1.3 but do not enable it by default. Fortinet and Palo Alto firewalls and Cisco routers support ML-KEM for IPsec in current versions, but only with IKEv2 and configured on both ends of the tunnel.

The First Step: A Crypto Inventory

NIST, the EU roadmap and the BACS name the same starting point: an inventory of the cryptography in use. For an SME, a spreadsheet with one row per system is enough: protocol and version, such as TLS 1.2 or 1.3, scheme and key length, who is responsible for updates and how long the data must remain confidential.

Start with the connections to the outside world: website, mail server, VPN, remote maintenance, interfaces to customers and banks, off-site backups. Then move on to internal systems such as SSH, your own certificate authority and applications that use certificates. Top priority goes to connections carrying data that needs long-term confidentiality and to systems that cannot be migrated by an update.

What You Can Do Now

Keep your systems up to date. Check where OpenSSH older than version 9.0 or OpenSSL older than version 3.5 is still running, whether your servers speak TLS 1.3 and whether your firewall can receive firmware with ML-KEM. From version 10.1, the OpenSSH client automatically warns about connections without a quantum-safe key exchange.

Align your plans with your suppliers' roadmaps, as the BACS recommends. Four questions are enough to start: Does the product support ML-KEM in hybrid mode? From which version? How are software and firmware updates signed? How long will the version you use still receive updates? For new purchases that will run beyond 2030, get a commitment that they can be upgraded to quantum-safe schemes.

Rely on hybrid, standardised schemes, as the BACS, the BSI and the EU roadmap recommend. If a product is advertised as "quantum-safe", ask which standard it uses: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) for signatures, and for firmware also LMS or XMSS (NIST SP 800-208). According to the BACS, quantum key distribution (QKD) is explicitly not a solution. Hard-coded algorithms and certificates renewed by hand are warning signs of missing crypto-agility.

How MilesGuard Helps

MilesGuard builds the crypto inventory with you as part of a security audit. We record the schemes on your connections and inside your network, rank them by how long your data must stay confidential and show what an update fixes and what needs replacing. The result is a prioritised roadmap. As part of CISO as a Service, we support the implementation. A quantum computer that breaks RSA does not exist yet. The deadlines do.