up:: The Mandates MOC

ENISA

ENISA is the European Union Agency for Cybersecurity, the EU-level body that produces cross-Union cybersecurity guidance and underpins the certification schemes the Cyber Resilience Act leans on, and its post-quantum publications are among the early authoritative European treatments of the transition. It sits at a different altitude from the national authorities: where Germany’s BSI and France’s ANSSI publish exact algorithms, key sizes, and dates that bind their own countries, ENISA produces higher-level, Union-wide guidance and analysis that informs the shared European position rather than binding any one member state directly.

Its two flagship PQC reports, “Post-Quantum Cryptography: Current State and Quantum Mitigation” (2021) and the “Post-Quantum Cryptography, Integration study” (2022), established the survey of the algorithm families and the hybrid-and-integration framing that European policy later built on.

The short version:

1. ENISA is the EU’s cybersecurity agency, an EU-level advisory and coordinating body, not a national regulator, so it complements rather than replaces BSI and ANSSI.
2. Its “Post-Quantum Cryptography: Current State and Quantum Mitigation” report (May 2021) surveyed the five PQC algorithm families and recommended hybrid deployment plus mixing pre-shared keys, an early European framing of the transition.
3. Its “Post-Quantum Cryptography, Integration study” (October 2022) addressed the post-standardization problem of integrating PQC into existing protocols, the practical layer above the algorithm choice.
4. ENISA underpins the EU cybersecurity certification framework, which is the machinery the CRA uses, so its role is structural in how EU product-security law reaches vendors.
5. It sits alongside ETSI (telecom and technical specs) and the national bodies in the European mandate picture, as the Union-level coordinating voice rather than a source of dated deadlines.

Think of the European cryptography landscape as a federation with a shared standard and local building inspectors. BSI and ANSSI are the national inspectors who issue exact, enforceable specifications for their own jurisdictions, down to the key length and the year. ENISA is the federal coordinating office that writes the shared guidance everyone reads to stay aligned, runs the certification framework that lets a product approved in one place be recognized across the Union, and publishes the analysis that shapes where the whole federation is heading. It sets direction and infrastructure more than it issues individual permits.

What is ENISA?

ENISA is the European Union Agency for Cybersecurity, the EU institution responsible for achieving a high common level of cybersecurity across the Union, providing expertise, guidance, and coordination to member states, institutions, and industry. Its identity, for reference:

1. What it is. An agency of the European Union, established to strengthen cybersecurity across the Union, providing analysis, recommendations, and operational cooperation rather than issuing binding national regulation.
2. Its certification role. Under the EU Cybersecurity Act, ENISA supports and helps develop the European cybersecurity certification framework, the scheme machinery that lets products, services, and processes be certified against common EU criteria.
3. How it differs from the national bodies. BSI and ANSSI are single member states’ authorities with granular, enforceable cryptographic rulebooks. ENISA is the Union-level body producing coordinating guidance and running the certification framework, so its output is broader and structural rather than a table of dated key sizes.

Source: ENISA, “About ENISA, the European Union Agency for Cybersecurity,” enisa.europa.eu.

The reason ENISA matters to a post-quantum migration is that it shapes the shared European direction and the certification infrastructure, so even though it doesn’t hand you a deadline, its framing feeds the instruments that do, most importantly the certification schemes the CRA relies on to turn product security into a condition of market access.

What did ENISA’s post-quantum reports say?

ENISA’s two flagship PQC reports established the European survey-and-integration framing of the transition, the first mapping the algorithm families and recommending hybrid, and the second addressing how to integrate post-quantum schemes into real protocols. They’re the substance behind ENISA’s PQC position:

1. “Post-Quantum Cryptography: Current State and Quantum Mitigation” (May 2021). This report surveyed the five main families of post-quantum algorithms, code-based, isogeny-based, hash-based, lattice-based, and multivariate, and walked through the NIST process candidates. Its practical recommendations for system owners centered on hybrid implementations, combining a pre-quantum and a post-quantum scheme, and on mixing pre-shared keys into public-key systems for extra assurance, an early and influential European statement of the hybrid-first instinct that ANSSI and BSI also hold.
2. “Post-Quantum Cryptography, Integration study” (October 2022). This follow-up addressed the post-standardization challenge: designing new protocols and integrating post-quantum systems into existing ones, which is the practical layer above choosing an algorithm and the problem the whole protocol migration wrestles with.

Source: ENISA, “Post-Quantum Cryptography: Current State and Quantum Mitigation,” May 3, 2021, enisa.europa.eu; ENISA, “Post-Quantum Cryptography, Integration study,” October 18, 2022, enisa.europa.eu.

The framing to take from these is that ENISA reached the same hybrid-and-integration conclusions the national bodies did, which is part of why the European position converged: BSI, ANSSI, and ENISA all lean toward hybrid deployment through the transition, so a product built for the European market inherits a consistent direction even though the binding dates come from elsewhere.

Does ENISA set post-quantum deadlines?

No, and understanding why is the key to placing it correctly in the mandate picture. ENISA produces guidance, analysis, and certification infrastructure, so it shapes what “good” looks like across the Union, but the dated obligations that force a migration come from binding instruments: the CRA for product security, the separate EU Coordinated Implementation Roadmap for the concrete PQC dates, and the national authorities for their own jurisdictions.

Body	Role	Binding?	Output shape
ENISA	EU-level guidance and certification framework	No, advisory and structural	Reports, recommendations, certification schemes
BSI (Germany)	National cryptographic rulebook	Yes, within Germany	Exact algorithms, key sizes, dates (TR-02102)
ANSSI (France)	National cryptographic rulebook	Yes, within France	Hybrid-first rules, certification gate from 2027
EU Cyber Resilience Act (CRA)	EU product-security law	Yes, market-access condition	State-of-the-art confidentiality, update obligations

So ENISA’s place is the coordinating and enabling layer. It doesn’t tell a company “migrate by 2030,” but it produces the shared analysis that aligns the member states and runs the certification machinery through which the CRA’s requirements are actually assessed. For a migration plan, you cite ENISA for the European framing and the certification context, and you cite the CRA, the EU roadmap, and the national bodies for the dates that bind you.

Common misconceptions

1. “ENISA sets EU cryptography deadlines.” It doesn’t. ENISA produces advisory guidance and runs the certification framework. The binding PQC dates come from the CRA, the separate EU Coordinated Implementation Roadmap, and the national authorities.
2. “ENISA is the EU version of BSI or ANSSI.” They operate at different altitudes. BSI and ANSSI issue exact, enforceable national rulebooks; ENISA produces Union-wide coordinating guidance and the certification infrastructure, so it complements the national bodies rather than duplicating them.
3. “ENISA’s PQC reports are outdated because they predate the finalized standards.” They surveyed the algorithm families and set the hybrid-and-integration framing that European policy built on, which remains the direction of travel. The specific algorithm names have since been finalized by NIST, and ENISA’s structural framing carried forward.
4. “ENISA has nothing to do with the CRA.” It’s structural to it. ENISA supports the EU cybersecurity certification framework that the CRA uses to turn product security into a market-access condition, so its role underpins how the CRA reaches vendors.
5. “You can ignore ENISA if you follow your national authority.” For the dated rules, your national authority and the CRA govern. ENISA still matters because it shapes the shared European direction and the certification context that the whole Union, including your national scheme, aligns to.

Questions people ask

What is ENISA? ENISA is the European Union Agency for Cybersecurity, the EU-level body providing cybersecurity guidance, coordination, and the certification framework across the Union. It’s an advisory and structural authority rather than a national regulator, so it complements BSI and ANSSI rather than replacing them.

Does ENISA publish post-quantum guidance? Yes. Its “Post-Quantum Cryptography: Current State and Quantum Mitigation” report (May 2021) surveyed the algorithm families and recommended hybrid deployment, and its “Post-Quantum Cryptography, Integration study” (October 2022) addressed integrating PQC into existing protocols.

Does ENISA set a deadline for PQC migration? No. ENISA is advisory and produces the certification infrastructure. The binding dates come from the CRA, the separate EU Coordinated Implementation Roadmap, and the national authorities like BSI and ANSSI.

How is ENISA different from BSI and ANSSI? BSI and ANSSI are national authorities with granular, enforceable cryptographic rulebooks binding their own countries. ENISA is the Union-level body producing coordinating guidance and running the certification framework, so its output is broader and structural rather than a table of dated key sizes.

How does ENISA connect to the Cyber Resilience Act? ENISA supports and helps develop the EU cybersecurity certification framework, which is the machinery the CRA uses to assess product security. So ENISA’s certification role is structural to how the CRA’s requirements are actually applied to products.

What did ENISA recommend for the transition? Hybrid deployment, combining a pre-quantum and a post-quantum scheme, and mixing pre-shared keys into public-key systems for extra assurance. That’s the same hybrid-first direction BSI and ANSSI hold, which is part of why the European position converged.

Is ENISA relevant if I only operate in one EU country? Yes, indirectly. Your national authority and the CRA give you the binding rules, and ENISA shapes the shared European direction and the certification context that your national scheme aligns to, so it’s the backdrop your specific obligations sit against.

---

Everything here is the map, given freely. When your team needs the European mandate landscape, ENISA’s framing, the CRA’s obligations, and the national rulebooks, turned into a single migration plan sequenced against the deadlines that actually bind you, that’s the work I do, and there’s an alignment briefing for it.

Last verified 2026-07-14 · Maintained by Addie LaMarr, LaMarr Labs.