EU CRA and Post-Quantum Readiness: Future-Proofing Products with a QBOM
Products placed on the EU market must stay secure for their whole support period. With a harvest-now-decrypt-later threat on the horizon, a QBOM is how you evidence quantum readiness under the CRA.
- The CRA expects appropriate security across a defined support period that can run for years, inside the window where quantum risk becomes material.
- A QBOM rates the quantum resistance of the cryptography found in a product and tracks migration to post-quantum standards.
- Harvest-now-decrypt-later means data captured today can be decrypted later; long-lived products need a migration plan now.
- NIST's post-quantum standards and the IR 8547 transition milestones give a concrete timeline to plan against.
The CRA, the support period and quantum risk
The Cyber Resilience Act, Regulation (EU) 2024/2847, requires manufacturers to keep products with digital elements secure across a defined support period and to handle vulnerabilities throughout it [1]. For products that will be on the market and in service for years, that window overlaps with the period in which a cryptographically relevant quantum computer could break today's public-key cryptography. Security that is adequate at launch may not hold for the life of the product.
Why a QBOM
A quantum bill of materials (QBOM) builds on a cryptographic inventory to rate how exposed each algorithm is to quantum attack and to track the move to post-quantum cryptography (PQC). It answers the question the CRA's lifecycle duties imply: will this product's cryptography still be sound in five or ten years, and if not, what is the plan?
Harvest now, decrypt later
Adversaries can capture encrypted traffic today and store it until quantum hardware can decrypt it. For data with a long confidentiality lifetime, the risk is present now even though the decryption is future. See harvest-now-decrypt-later. A QBOM identifies which data flows and components rely on quantum-vulnerable cryptography so you can prioritise them.
Planning against the standards
NIST has published post-quantum standards (ML-KEM, ML-DSA, SLH-DSA), and NIST IR 8547 sets out a transition in which quantum-vulnerable algorithms are deprecated around 2030 and disallowed after 2035 [2]. A QBOM lets you track migration coverage against these milestones as a measurable KPI:
| QBOM signal | Use under the CRA |
|---|---|
| Quantum-vulnerable component count | Scope of the migration needed within the support period |
| Post-quantum safe count | Progress evidence for lifecycle security |
| Migration coverage % | A single headline KPI for readiness |
How IntelliXBOM helps
IntelliXBOM derives a QBOM from the cryptography it discovers, scores quantum readiness, buckets certificates against the NIST milestones and reports migration coverage over time. See preparing for post-quantum cryptography. It supplies the evidence; CRA conformity remains the manufacturer's duty.
Frequently asked questions
Does the CRA explicitly require post-quantum cryptography?
Not by name. It requires appropriate, state-of-the-art security across the support period. For long-lived products, demonstrating a credible post-quantum plan is the practical way to meet that duty, and a QBOM provides the evidence.
What is a QBOM versus a CBOM?
A CBOM inventories the cryptography in a product; a QBOM adds a quantum-risk rating and migration tracking on top of that inventory. A QBOM is usually derived from the CBOM.
When does quantum risk become a CRA problem?
Whenever a product's support period, or the confidentiality lifetime of the data it protects, extends into the period where quantum attacks become feasible. For many products that window is already open.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/2847/oj
- NIST IR 8547: Transition to Post-Quantum Cryptography StandardsNISTcsrc.nist.gov/pubs/ir/8547/ipd
- EU Agency for Cybersecurity (ENISA)ENISAwww.enisa.europa.eu/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.