Quantum risk in manufacturing

Yes, for most of the sector. Annex II lists the manufacture of medical devices and in vitro diagnostics, computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles, trailers and semi-trailers, and other transport equipment among the other critical sectors, which makes medium and large manufacturers in those lines important entities. Article 21 then requires ten measures, including supply chain security and policies on the use of cryptography and, where appropriate, encryption, and Article 20 makes the management body approve and oversee them. Member States had until 17 October 2024 to transpose the directive, so the obligations now sit in national law.

The CRA, Regulation (EU) 2024/2847, applies to hardware and software products with digital elements placed on the EU market, wherever they are made. It entered into force on 10 December 2024. From 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents. From 11 December 2027 products must meet the essential cybersecurity requirements in Annex I, which include protecting the confidentiality of data with mechanisms appropriate to the state of the art, such as encryption, and must receive security updates for a declared support period. A product whose signing or boot cryptography cannot change during that support period is a design problem the technical file will expose.

Regulation (EU) 2023/1230 replaces the Machinery Directive and applies on a mandatory basis from 20 January 2027. Alongside the familiar essential health and safety requirements it integrates provisions for cyber-safety: compliance-relevant software and data, and safety control systems, must be protected against corruption, including malicious attempts. Machinery placed on the market before 20 January 2027 still follows the Directive. For a machine builder the practical consequence is that the integrity of the safety software, and the signing cryptography that proves it, becomes part of the conformity assessment.

Not yet. IEC 62443-3-3:2013 sets system requirements and security levels and IEC 62443-4-2:2019 sets component requirements, and both are written in terms of capabilities rather than named algorithms. The Commission Recommendation of April 2024 asks standards bodies to integrate PQC into their work, and we have found no published IEC 62443 post-quantum work item. Use the series for what it does well: the zones and conduits model gives you the structure to sequence the migration plant by plant, and the security level targets tell you which conduits to move first.

Because it is the trust anchor for everything else and it lives longest. Every unit you ship verifies updates against a public key, often fixed in a secure element or boot ROM at the factory. Once an attacker can forge an ECDSA or RSA signature, every device still trusting that key accepts their firmware. The fix is a dual-signature period, classical plus ML-DSA or a hash-based signature, with the post-quantum root provisioned at manufacture. Secure boot roots that cannot be changed in the field need a hardware revision, which is why product families shipping in 2027 should carry a post-quantum root even if the first firmware does not use it.

Some can, many cannot. ML-KEM-768 has a 1,184-byte public key and ML-DSA-65 signatures run to about 3.3 KB, which matters on devices with kilobytes of RAM, deterministic cycle times and firmware that only changes at a planned shutdown. The realistic approach is Purdue-model sequencing: enterprise and DMZ systems first, then historians, MES and SCADA servers with hybrid TLS, then OPC UA certificate profiles where the stack supports them, and a deferral strategy for Level 0 to 2 devices until vendor firmware or replacement arrives. The ICS course works through each layer.

More than the plant, usually. Suppliers hold your drawings in their PLM, exchange orders over EDI and AS2 links with RSA key exchange, and reach your machines through vendor VPNs. Any of that traffic recorded now is readable later, and a forged signature on a supplier's component firmware arrives inside your product. NIS2 Article 21 puts supply chain security on your list of measures, and the OEMs will flow their own requirements down. Start with the Third-Party Cryptographic Exposure Model and a questionnaire to every machine builder and automation vendor.

Two exposures at once. The fab is an OT estate whose recipes and mask data are the most valuable process IP in any sector, protected by the same remote-maintenance tunnels and PLM transfers as everyone else's. The chips are the roots of trust that every other manufacturer will ship for the next twenty years, so room for ML-DSA verification and ML-KEM key establishment in silicon is a decision taken now. The EU Chips Act has applied since September 2023 with a Chips Act 2.0 proposed in June 2026, and the US CHIPS and Science Act put $39 billion into manufacturing incentives, which brings security expectations with the money.

With a cryptographic inventory that spans plant, product and enterprise; a map of which designs, recipes and records must stay confidential beyond 2030; a classification of devices and product families by whether they can change algorithm by update, retrofit or not at all; and roadmaps requested from every machine builder, automation vendor and critical supplier. Those four give the board the evidence to set priorities and fit the work to the shutdown calendar.

Everything on this page. The two-minute readiness check scores your plant and product security programme and routes you to the right next step. The free tools, including the OT Protocol Quantum Vulnerability Scanner and the OT Cryptographic Asset Prioritisation Matrix, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

It depends on the role. Boards and executives start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, risk and IT teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. OT security leads, plant engineers and IT/OT integration teams take PQC Migration for Industrial Control Systems, the sector course for SCADA, DCS and ICS environments, and procurement and supplier security teams take Quantum-Safe Supply Chain Security for Manufacturers. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your OT, product security and supply chain teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving manufacturing who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed. The manufacturing courses are listed with their formats on the training pages: the ICS course is a half day of three hours, the supply chain, scheduling and quality control workshops are full days of six hours.