On 30 July 2026 NATO Allies approved a quantum technology roadmap that schedules a pilot of quantum-safe communications between NATO Headquarters and SHAPE for the last quarter of 2027, and bids for the contractor that will build it are due on 12 November 2026. The pilot is experimental, but it arrives at a moment when the main European bodies that set cryptographic policy have put dates on the retirement of the public-key mechanisms that protect today’s military and government networks. Those dates are not the same from one authority to the next. They are mostly recommendations rather than law, and the European Union’s own product legislation excludes dedicated defence products. At the same time, a first generation of post-quantum products has started to receive European certificates, and national agencies have begun to buy the software building blocks on which future equipment will depend. For a defence buyer the practical problem is not whether to migrate but how to turn a moving technical standard into contract terms: what to specify, what evidence to accept, and how to avoid buying something that cannot be changed when the standard moves again. The question that follows is precise. What do European and NATO buyers already require from suppliers of post-quantum cryptography for defence communications, which instruments give those requirements force, and where do public certification and procurement still stop short of an accredited, deployable capability?