up:: The Mandates MOC

G7 Cybersecurity Working Group Post-Quantum Call to Action

The G7 Cybersecurity Working Group’s post-quantum call to action is a joint publication titled “Preparing for the Post-Quantum Era: A Call to Action,” published on September 3, 2026, in which the working group of G7 national cybersecurity authorities tells governments and organizations to “begin their PQC transition as soon as possible” and identifies five priority areas for national action. It carries no deadline of its own. Organizations are told to complete their transitions within the timelines their national cybersecurity authorities set, and the document’s sharpest line is commercial: organizations that delay “may be excluded from contracting opportunities, including public procurement.”

It comes from a different G7 body than the G7 Cyber Expert Group Quantum Roadmap. The Cybersecurity Working Group brings together the national cyber agencies of G7 states, while the Cyber Expert Group advises G7 Finance Ministers and Central Bank Governors on the financial sector.

The short version:

1. The G7 Cybersecurity Working Group (CWG) published “Preparing for the Post-Quantum Era: A Call to Action” on September 3, 2026, with the participation of the European Commission and the support of ENISA. ANSSI, which holds the working group’s 2026 presidency, published it, and Canada’s Cyber Centre announced it on a page dated the same day.
2. It asks for action “across all sectors,” with critical infrastructure named as one part of that scope, and frames the quantum threat as near-term because harvest now, decrypt later collection is possible today.
3. It repeats the working group’s earlier baseline: a phased, risk-based strategy, an early start, a cryptographic inventory, mapped dependencies, and a transition plan, with quantum-safe replacement folded into normal renewal cycles.
4. It names five priority areas for governments: awareness, national strategies, research and development, public-private partnerships, and PQC in cybersecurity requirements, including public procurement.
5. It sets no date. Timelines come from national authorities, and the document does not discuss hybrid deployment or crypto-agility, both of which the working group’s earlier, longer statement covers.

Think of it like a joint storm advisory issued by seven national weather services at once. It tells everyone the storm is coming, explains why boarding up early is cheaper than boarding up late, and lists what each government should be doing to get ready. The evacuation order, with an actual date on it, still comes from your own country’s emergency authority.

What is the G7 post-quantum call to action?

It’s a short policy document issued in the name of the G7 Cybersecurity Working Group, running from a threat summary through five priority areas to a one-paragraph conclusion. Its identity, as the primary sources give it:

Field	What the source says
Title	”Preparing for the Post-Quantum Era: A Call to Action”
Issuer	G7 Cybersecurity Working Group, “with the participation of the EU Commission,” “supported by the EU Agency for Cybersecurity (ENISA)“
Published	Thursday, September 3, 2026 (ANSSI publication page); Canada’s announcement page is dated 2026-09-03
Document date	September 2026, under the Etalab v2.0 open license
Publisher credited on the document	France’s Cybersecurity Agency, ANSSI, Paris
Binding status	A call to action. It states no requirement of its own and defers timelines to national cybersecurity authorities
Stated purpose	To “highlight some of the risks that can be posed by cryptographically relevant quantum computers (CRQCs),” to “reaffirm our collective efforts,” and to identify “five priority areas for PQC migration”

It presents itself as a record of work member states have already started, saying it “highlights initiatives that G7 countries have advanced, in whole or in part, to encourage timely measures today and inspire other countries to take similar actions.”

Source: G7 Cybersecurity Working Group, “Preparing for the Post-Quantum Era: A Call to Action,” September 2026, ANSSI PDF; ANSSI, publication page, published Thursday 3 September 2026, cyber.gouv.fr; Canadian Centre for Cyber Security, “G7 Cybersecurity Working Group call to action on preparing for the post-quantum era,” date modified 2026-09-03, cyber.gc.ca.

Who is the G7 Cybersecurity Working Group?

The G7 Cybersecurity Working Group is a forum of the national cybersecurity authorities of G7 member states, set up in 2024 on the initiative of the Italian G7 presidency and launched at its first meeting in Rome in May 2024. ANSSI describes its aims as sharing experience, threat analyses and good practice, contributing to common cybersecurity guidelines, and reinforcing the collective resilience of states and essential infrastructure. It meets under the authority of the annual G7 presidency, and ANSSI took over the presidency on January 1, 2026. Post-quantum migration was one of the priority topics it took up under the Italian (2024) and Canadian (2025) presidencies.

The call to action itself does not list its member agencies. The working group’s earlier post-quantum statement does, and names seven national bodies plus the European Commission:

1. Canada’s Communications Security Establishment (CSE), whose Canadian Centre for Cyber Security hosts the statement
2. Germany’s Federal Office for Information Security (BSI)
3. Italy’s National Cybersecurity Agency (ACN)
4. France’s National Cybersecurity Agency (ANSSI)
5. The US Cybersecurity and Infrastructure Security Agency (CISA)
6. The UK’s National Cyber Security Centre (NCSC) and Department for Science, Innovation and Technology (DSIT)
7. Japan’s National Cybersecurity Office (NCO)

Source: ANSSI, “The G7 Cybersecurity Working Group,” cyber.gouv.fr; G7 Cybersecurity Working Group, “Statement on preparing for a post-quantum cryptography migration,” list of publishing agencies, cyber.gc.ca.

How is it different from the G7 Cyber Expert Group roadmap?

They’re two separate G7 bodies writing for two different audiences, and their names are close enough to confuse. The working group’s own earlier statement draws the line itself: it points readers to the Cyber Expert Group’s financial-sector roadmap as a separate document “which readers may find useful.”

	G7 Cybersecurity Working Group call to action	G7 Cyber Expert Group roadmap
Who writes it	National cybersecurity agencies of G7 states, with the European Commission	An advisory group to G7 Finance Ministers and Central Bank Governors
Sector	”All sectors,” critical infrastructure included	The financial sector
Published	September 3, 2026	January 2026
Shape	Threat framing, organizational baseline, five priority areas for governments	Six migration phases, each split between financial entities and public authorities
Dates	None; defers to national cybersecurity authorities	2035 as an overall target range, described as “non-authoritative”
Binding	No	No

Source: G7 Cybersecurity Working Group call to action, September 2026, ANSSI PDF; G7 Cybersecurity Working Group statement, introduction, cyber.gc.ca; G7 Cyber Expert Group, “Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector,” January 2026, treasury.gov PDF.

What does the call to action say about the quantum threat?

It makes four claims about the threat, and each one is worded with care about timing.

1. The timeline is uncertain and the direction is clear. “Although the exact timeline is uncertain, several recent advances suggest an anticipation of the development of quantum computers able to break widely used public-key cryptography mechanisms.” It defines a CRQC as a computer “powerful enough to solve factorization and discrete logarithm problems of sizes that are used in quantum-vulnerable cryptography today.”
2. Confidentiality is exposed now. Adversaries “can already intercept and store encrypted data protected by public-key cryptography,” which it calls “store now, decrypt later” or “harvest now, decrypt later,” relevant “where confidentiality of information must be protected for longer than the time required to develop a CRQC.” Its examples are governmental data, sensitive personal data, and trade or business secrets.
3. Authentication is exposed later. Actors with a CRQC “will also be able to target authentication mechanisms,” which “could allow malicious cyber actors to impersonate trusted entities, compromise equipment, forge trusted data, or access confidential data.” This guide covers that exposure under digital signatures, and it sits apart from harvesting, which threatens confidentiality.
4. Exposure spreads between organizations. “Because supply chain risks can cascade and compromises to authentication can allow immediate lateral movement, the vulnerabilities of one organization may expose other organizations and sectors to these risks.” See Cryptographic Supply-Chain Risk.

It also asks readers to “reframe the quantum threat from a distant future problem to a near-term threat that demands action across all sectors,” a scope it explicitly extends past critical infrastructure, and describes the transition as “a collective transition that can only be achieved with early engagement, coordinated planning, and informed decision-making across the public and private sectors.”

Source: G7 Cybersecurity Working Group call to action, pages 2 to 3, ANSSI PDF.

What does it ask organizations to do?

It restates the organizational baseline from the working group’s earlier statement and adds two cost arguments. In the document’s own sequence:

1. Identify the systems holding the most critical data and assets first, and prioritize transition work accordingly. “Acting proactively, rather than waiting for confirmed CRQC availability, is important to managing quantum risk.”
2. Adopt a phased and risk-based strategy.
3. Start the transition early.
4. Inventory cryptographic assets, the work covered in Cryptographic Discovery and captured in a CBOM.
5. Map dependencies.
6. Develop a transition plan.
7. Buy products that integrate PQC, and “replace their systems with quantum-safe ones as part of their standard renewal schedule,” to limit transition costs. The document concludes that “starting the transition early could result in lower migration costs overall.”
8. Plan and conduct the transition properly, which it says “would enable organizations to prevent insecure implementations and avoid increased exposure to conventional cyber threats.”

A footnote adds that organizations can follow the working group’s earlier statement “but should refer to their national guidelines and cybersecurity agencies for additional information.”

Source: G7 Cybersecurity Working Group call to action, page 4 and footnote 3, ANSSI PDF.

What are the five priority areas?

The five areas are addressed to governments. The document says G7 countries “are individually advancing some, or all, of the initiatives” in them, so the list describes a menu that members draw from, with each country’s pace tied to “the infrastructure, regulatory environment, and technological maturity of each country.”

Priority area	What the call to action says
1. Raising awareness	The threat “remains off the radar for many organizations and not properly resourced,” and transition depends on organizations understanding it as “an economic and business risk, and not merely a cryptographic risk.” Tools named: awareness campaigns, technical guidance, upskilling
2. Developing national strategies	Strategies should aim at “both attaining an adequate supply of PQC hardware and software products and encouraging users to adopt them,” and fold PQC into broader security and digital privacy strategies
3. Research and development	Funding programs for PQC research and development, plus “pilot projects and testbeds for organizations transitioning to PQC”
4. Public-private partnerships	Partnerships “aimed at developing domestic expertise and industry capabilities in quantum-safe technologies,” which “may help reduce the cost of PQC transition,” plus cross-sector sharing of playbooks and case studies
5. Integrating PQC into cybersecurity requirements	Treat PQC adoption “as a foreseeable evolution of cryptographic best practices rather than a standalone compliance obligation,” and use “specific requirements within the framework of public procurement” to push organizations to start

Source: G7 Cybersecurity Working Group call to action, pages 4 to 5, ANSSI PDF.

Does the G7 call to action set a post-quantum deadline?

No. It tells organizations they “should begin planning their PQC transition now” and should aim to complete their transitions within the timelines “set out by their national cybersecurity authorities.” The document names no year and gives no schedule for any class of system.

The dates therefore live in the national instruments the member agencies publish: the UK NCSC’s 2028, 2031 and 2035 milestones, Canada’s end-of-2031 and end-of-2035 Government of Canada roadmap, the EU’s Coordinated Implementation Roadmap, and the U.S. federal schedule in Executive Order 14412 and OMB M-26-15. US vs EU vs UK Post-Quantum Timelines compares three of them side by side.

The working group’s earlier statement is the closest thing to a G7-level date, and it’s a planning expectation stated loosely: “Migration is expected to be completed in the private sector during the 2030s (specific dates will vary slightly by country; refer to your national guidelines for additional information).”

What the call to action adds in place of a date is a consequence. “In addition to quantum-related risks, organizations that delay their PQC transition may lose competitive advantage or may be excluded from contracting opportunities, including public procurement.” Read beside priority area 5, that points at procurement as the channel through which the transition reaches organizations no regulator directly covers. See PQC Procurement and RFP Language.

Source: G7 Cybersecurity Working Group call to action, page 3, ANSSI PDF; G7 Cybersecurity Working Group statement, “Timeframes,” cyber.gc.ca; Canadian Centre for Cyber Security, “Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),” cyber.gc.ca; NCSC, “Timelines for migration to post-quantum cryptography,” March 20, 2025, ncsc.gov.uk; European Commission, “A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,” ec.europa.eu.

How does it relate to the working group’s earlier post-quantum statement?

The call to action is the short public-policy layer, and the earlier “G7 Cybersecurity Working Group Statement on preparing for a post-quantum cryptography migration” is the long practical one. The call to action cites the statement in footnote 2 and says its organizational recommendations were “proposed in” it.

The difference in scope matters for anyone quoting either document:

1. Audience. The statement says it is “targeted at technical management of medium-to-large organizations.” The call to action addresses governments and organizations generally, and its five priority areas are written for governments.
2. Hybrid cryptography. The statement’s appendix discusses post-quantum/traditional hybrids and says hybrid approaches must be “carefully” assessed “to select the appropriate scheme for the desired need.” The call to action does not mention hybrid deployment. For the national positions, see Hybrid Cryptography and ANSSI vs BSI vs NCSC vs NSA on Hybrid.
3. Crypto-agility. The statement has a full section on cryptographic agility, defined as “the design of cryptographic protocols and systems in a modular way that enables replacing the cryptographic components,” and says “the fundamental step to becoming cryptographically agile is the ability to detect weaknesses in deployed systems and to know where changes will need to be made,” which is why it asks for a continuously maintained cryptographic inventory. The call to action does not use the term. See Crypto-Agility.
4. Governance detail. The statement recommends designating a board member accountable for PQC migration and sets out project teams by function. The call to action stays at the level of strategy and national priorities.
5. Advice status. The statement says it “is not intended to be a source of cyber security advice” and “does not supersede any guidance or regulatory requirements published by your national authorities.” The call to action carries the same deference in its footnote 3.

Source: G7 Cybersecurity Working Group statement, audience, terminology, cryptographic agility, governance, and appendix sections, cyber.gc.ca; G7 Cybersecurity Working Group call to action, footnotes 2 and 3, ANSSI PDF.

Why does a non-binding G7 document matter?

Because it records that the national cyber agencies of the G7 and the European Commission agree on three positions at once, and because those same agencies shape the national guidance their own governments and industries follow.

1. The threat is near-term for confidentiality. The G7’s national cyber agencies publicly tying harvest-now-decrypt-later to action “across all sectors” removes the argument that post-quantum work belongs only to government and critical infrastructure.
2. The work starts with inventory and planning. The baseline it repeats is the same starting point every national mandate in the mandates section converges on.
3. Procurement is a lever. Priority area 5 and the contracting-exclusion warning both describe buyers, public buyers first, setting post-quantum requirements for the products and services they purchase.

Source: G7 Cybersecurity Working Group call to action, pages 3 to 5, ANSSI PDF.

Common misconceptions

1. “The G7 set a post-quantum deadline in September 2026.” The call to action contains no date. It sends organizations to the timelines of their national cybersecurity authorities.
2. “This is the same G7 document as the 2035 financial-sector roadmap.” The 2035 target range comes from the G7 Cyber Expert Group, a separate body advising finance ministers and central bank governors, in January 2026. The call to action comes from the cyber agencies’ working group.
3. “It only concerns critical infrastructure.” It calls for action “across all sectors” and names critical infrastructure as only one part of that scope.
4. “It tells organizations to rip and replace now.” It recommends a phased, risk-based approach that starts with the most critical systems and replaces systems with quantum-safe ones “as part of their standard renewal schedule.”
5. “It endorses hybrid cryptography.” It does not discuss hybrid at all. The working group’s earlier statement discusses hybrids and asks for careful, case-by-case assessment.

Questions people ask

Is the G7 post-quantum call to action binding? No. It’s a joint publication from a working group of national cybersecurity authorities, it states no requirement of its own, and it tells organizations to complete their transitions within the timelines their national authorities set. Its weight comes from the agencies behind it, which shape national guidance in their own countries.

Which countries and agencies are behind it? The G7 Cybersecurity Working Group, with the participation of the European Commission and the support of ENISA. The call to action does not list members; the working group’s earlier post-quantum statement names Canada’s CSE, Germany’s BSI, Italy’s ACN, France’s ANSSI, the US CISA, the UK’s NCSC and DSIT, and Japan’s NCO.

When was it published? September 3, 2026. ANSSI’s publication page gives that date, Canada’s Cyber Centre announcement is dated the same day, and the document itself is dated September 2026.

Does it apply to companies outside government and critical infrastructure? It addresses them directly, calling for action “across all sectors” and extending that scope explicitly past critical infrastructure. It creates no legal obligation for them, and it warns that delay may cost competitive advantage or exclude them from contracting opportunities, including public procurement.

What does it tell an organization to do first? Identify the systems holding the most critical data and assets and prioritize them, then follow a phased, risk-based approach: start early, inventory cryptographic assets, map dependencies, and develop a transition plan.

Does it recommend quantum key distribution? It does not mention quantum key distribution. It describes post-quantum cryptography as the field “designed to be resistant to both classical and quantum cryptographic attacks” and frames the whole transition around it. For the agencies’ separate positions on QKD, see QKD vs PQC.

How is it different from the G7 Cyber Expert Group roadmap? Different body, audience and shape. The Cyber Expert Group advises G7 Finance Ministers and Central Bank Governors and published a six-phase financial-sector roadmap in January 2026 with a non-authoritative 2035 target range; the Cybersecurity Working Group of national cyber agencies published this all-sector call to action in September 2026 with no dates.

Where are the actual deadlines? In national instruments: the UK NCSC’s 2028, 2031 and 2035 milestones, Canada’s Government of Canada roadmap, the EU Coordinated Implementation Roadmap, and the U.S. federal schedule under Executive Order 14412 and OMB M-26-15. The Binding-Date Questions is the framework for finding which of them reaches a given organization.

Where to go next

• G7 Cyber Expert Group Quantum Roadmap, the separate G7 finance-sector roadmap from January 2026
• US vs EU vs UK Post-Quantum Timelines for the national dates this document defers to
• CCCS (Canada), BSI, ANSSI, and UK NCSC Quantum-safe Cryptography for four of the member agencies’ own positions
• Cryptographic Discovery for the inventory step every one of these documents starts from

---

Everything here is the map, given freely. When your team needs the G7 baseline and your own national deadlines turned into a single transition plan sequenced against your systems and your contracts, that’s the work I do.

Last verified 2026-09-15 · Updated 2026-09-15 · Maintained by Addie LaMarr, LaMarr Labs.