Post-Quantum Cryptography Transition Governance in the European Union: Regulatory Architecture, Member State Models, and Compliance Obligations for Implementing Entities

This article examines the governance architecture that European Union Member States must construct to operationalise the post-quantum cryptography (PQC) transition mandated by EU Recommendation 2024/1101 and the binding instruments that surround it — NIS2, DORA, the Cyber Resilience Act, the CER Directive, and eIDAS2. Drawing on comparative documentary analysis of the NIS Cooperation Group Coordinated Implementation Roadmap v1.1 (June 2025), the G7 Cyber Expert Group financial sector roadmap (January 2026), and published national transposition acts, the paper reconstructs the actor–obligation matrix across six organisation types, analyses the three-milestone timeline (2026/2030/2035), and classifies Member State governance configurations into three stylised archetypes: single authority, distributed functions, and Ministry-integrated. The paper identifies four structural risks generated by the soft-law primacy of the Recommendation — cryptographic debt accumulation, the already-operative Harvest Now Decrypt Later (HNDL) threat, competitive fragmentation within the single market, and board-level de-responsibilisation — and argues that the legal toolkit already available to Member States is sufficient to drive meaningful transition without awaiting further binding legislation. A five-deliverable compliance framework and an eight-phase executive roadmap are proposed for implementing entities. The Italian governance architecture (ACN) is used as an illustrative reference for the single-authority typology. An additional section examines Germany's BSI-led national approach as a real-world case whose migration activities are consistent with the governance milestones proposed in the framework.