France tightens cryptography requirements: post-quantum protection becomes mandatory from 2027
France's National Agency for the Security of Information Systems (ANSSI) has announced a radical change in cybersecurity standards. Starting in 2027, the agency will cease certifying products that are not equipped with encryption resistant to quantum attacks. This decision, announced by ANSSI Chief of Staff Samih Souissi at the France Quantum conference, marks a transition to a new era of data protection.
ANSSI certification is not just a formality. It is mandatory for the use of software and hardware in French government agencies and critical infrastructure facilities. Souissi emphasized that by 2030, all procurements must include exclusively quantum-resistant solutions. This means that developers and suppliers must already revise their product roadmaps.
The "Harvest Now, Decrypt Later" Threat
The main catalyst for this move is the risk known as "harvest now, decrypt later." Attackers can already intercept and accumulate encrypted data today, storing it in anticipation of sufficiently powerful quantum computers. Once such systems become a reality, all current cryptography based on RSA and ECC will be cracked within minutes.
This is not a hypothetical threat. According to expert estimates, the first quantum computers capable of breaking 2048-bit RSA could emerge within the next 10–15 years. Data we consider protected today—state secrets, financial information, medical records—will be at risk.
My analysis: ANSSI's decision is not just a bureaucratic initiative but a signal to the entire market. France is effectively setting a new standard that will likely be adopted by other EU and NATO countries. Companies that do not begin integrating post-quantum cryptography now risk losing access to government contracts and the critical infrastructure market. For the crypto industry, this is a reminder: protection based on classical algorithms is a temporary solution. The future lies in lattices resistant to quantum decoding.