France’s cybersecurity agency ANSSI just set a hard deadline. Starting in 2027, it will stop certifying security products that don’t use quantum-resistant encryption. By 2030, the agency says businesses should only be buying quantum-safe products.
This isn’t optional. ANSSI approval is required for any security product used in French government agencies and critical infrastructure. The policy effectively phases out older encryption standards.
Samih Souissi, ANSSI’s chief of staff, announced the timeline at the France Quantum conference. The message was clear: the transition to post-quantum cryptography is happening now, not somewhere in the distant future.
It’s a smart move. Quantum computers powerful enough to break current encryption standards may still be years away, but the migration itself takes years. Standards need to be set, products need to be built and tested, and supply chains need to adapt. Waiting until the threat is imminent is waiting too long.
Other governments are watching. France is one of the first to set a concrete certification cutoff. Expect more to follow.
