Amsterdam conference in December gathers those already migrating to post-quantum cryptography

The PKI Consortium, the association of organisations from the public key infrastructure (PKI) sector, is holding the fifth edition of its post-quantum cryptography (PQC) conference in Amsterdam from 1 to 3 December 2026. It takes place at the Meervaart in a hybrid format, and attendance is free, both in person and online. Consortium membership is not required.

The organisers frame the conference as a forum for migration experience rather than awareness-raising: who is migrating, what broke along the way and how it was fixed. They announce around 75 speakers and more than 50 sessions, and ban product promotion in talks.

Two tracks: one for decision-makers, one for implementers

The programme is split across two main rooms:

• Strategic track (red room), for senior management, risk officers and programme offices: compliance with NIS2 and DORA, budgeting and scoping a multi-year migration, assessment of suppliers and hardware security modules (HSMs), and timelines.
• Technical track (blue room), for architects and implementers: cryptographic agility in continuous integration and deployment pipelines, hybrid key exchange in TLS, certificate automation as maximum certificate validity is cut to 47 days, and available libraries.

There are also smaller rooms for workshops, sector round tables and off-the-record discussions.

What is already on the agenda

The agenda is provisional, but many sessions already have a title and a speaker. Some of those most relevant to decision-makers:

• Banking. Jaime Gómez García, global head of cryptography and of the quantum threat programme at Santander Digital Services, takes part in a session on budgeting for PQC readiness (1 December) and presents a framework for coordinated action in the financial sector (3 December). Citi explains how it prioritises use cases for its migration, and an IBM session describes HSBC’s move from early pilots to enterprise-wide execution.
• Public administrations. There are sessions on Estonia’s migration roadmap, the PQC-ready German identity card (Bundesdruckerei), migration in European public institutions and a comparison of how the United States and the European Union govern the transition. On 3 December a session reviews the European PQC roadmap; its speaker has not yet been announced.
• Cryptographic inventory. Vodafone explains the role of the cryptographic bill of materials (CBOM) in its migration; Iván Fernández Mora, of Airbus, presents the use of AI agents to automate that inventory; and a panel compares inventory requirements across sectors.
• Protocols. Sessions on IPsec and IKEv2, SSH in Fedora, DNSSEC with real-world data (SIDN Labs), mutual certificates with ML-DSA between machines, and stateful hash-based signatures (LMS) deployed at scale.
• The real state of migration. On the first day, a census of 2.8 million software packages from several ecosystems is presented to measure where migration actually stands.

How to attend

In-person registration is full. Anyone who signs up now joins a waiting list and, according to the organisers, gets automatic access to the online version. Virtual attendance is still available: a live stream of the two main rooms, questions via chat, and later access to the recordings of those rooms and to the slides.

The Meervaart is at Meer en Vaart 300, between Amsterdam city centre and Schiphol airport. It is served by trams 1 and 17.