Croatia’s €9.9M pilot joins EU quantum shield

Every encrypted message sent over the internet today could be recorded and stored by a hostile intelligence service, waiting for the day a sufficiently powerful quantum computer can crack its mathematical lock. The threat even has a name: "harvest now, decrypt later" (CSO Online). That day may be a decade away, but government secrets, military plans and critical infrastructure data need to stay confidential for decades, too. Which is why the EU has been assembling, mostly outside public attention, a continent-wide quantum communication network designed to make eavesdropping on key exchanges physically detectable.

Croatia just placed its tile in that mosaic. The €9.9 million CroQCI project demonstrated quantum-secure communication across eight locations in Zagreb (Večernji list), moving beyond the lab into real data-centre environments and end-user applications (CroQCI). Led by CARNET, Croatia's academic network, with scientific direction from the Ruđer Bošković Institute, the pilot tested the fibre-optic infrastructure and key-management architecture needed to eventually plug into the EU's broader system. One capital-city pilot is modest by itself. As part of a 27-country plan, it matters.

A tamper-evident seal made of light

Quantum key distribution (QKD) is easier to grasp than it sounds. It creates encryption keys using individual particles of light, then hands those keys to ordinary encryption to protect the actual data (ITU). The trick is physics: if anyone intercepts the light particles to copy the key, they disturb their quantum states in ways the sender and receiver can detect. Think of it as a tamper-evident seal. If the seal is broken, you know someone looked.

This protects one specific step: the exchange of keys. Compromised devices, bad software, insider threats and metadata exposure remain perfectly real problems (Fraunhofer IPMS). Quantum signals are also fragile. They can't be amplified like normal internet traffic, which limits range without trusted relay nodes or satellite links.

The continental puzzle

The EU framework that gives Croatia's pilot its strategic meaning is EuroQCI, a programme launched in 2019 involving all 27 member states and the European Space Agency (European Commission). Its purpose is protection of government data, critical infrastructure and sensitive research from future quantum-enabled decryption (HADEA).

The architecture has two layers. National fibre networks, like Croatia's, form the ground segment. Satellites will eventually connect countries that fibre alone cannot bridge. The Connecting Europe Facility has funded 19 cross-border projects with €193 million in total investment and €96 million in EU grants covering 25 member states (HADEA). The TransEuroOGS project is building optical ground stations across Germany, Greece, Ireland and Luxembourg to receive quantum keys from satellites (FAU, HellasQCI). Another backbone project, QUANT-GPICz, aims to link Frankfurt, Berlin, Warsaw and Prague through quantum-secured fibre.

The satellite piece carries schedule risk. The Eagle-1 prototype was officially due for late 2026, but reporting suggests delays could push the launch to late 2027 or early 2028 (Space Intel Report).

Two shields, not one

QKD is only one part of Europe's defence against the quantum threat. The broader shield is post-quantum cryptography: new mathematical algorithms designed to resist quantum attack, which NIST finalised in its first three standards in August 2024 (NIST). France's cybersecurity agency, ANSSI, plans to stop certifying products that lack quantum-safe encryption from 2027 (MarketScreener). That affects every software product used by government and critical operators.

The two approaches solve different parts of the problem. Post-quantum algorithms are a software upgrade for the entire digital world: VPNs, certificates, messaging apps. QKD adds a physics-based layer for the most sensitive links, the ones where even mathematical assumptions feel like too much trust (NIST, ITU). Europe is pursuing both, and the Commission opened a public consultation running until 24 June 2026 to shape EuroQCI activities from 2027 onward (Quantum Flagship).

Croatia's eight quantum-linked locations in Zagreb will not, by themselves, protect European secrets. The value emerges when national pilots, cross-border fibre, certification frameworks and satellites become an interoperable whole. The realistic timeline is a late-2020s infrastructure build-out with a broader quantum-safe migration around 2030. The race is not dramatic, but it is real: encrypted traffic captured today does not expire, and the computers that could read it are getting closer.