Looking Into QUANTUM Computing
Computing, Cryptography, Control and the Coming Transition
A briefing on quantum computing development, the cryptographic stack, artificial intelligence, regulation, energy and chip production
Executive Summary
Quantum computing has moved from laboratory curiosity to strategic priority. In 2026, IBM, Google, IonQ, Microsoft and a growing field of well-funded challengers are each reporting genuine hardware progress: larger qubit counts, better error correction and, in places, credible claims of scientific quantum advantage over classical supercomputers for narrow tasks. None of this yet amounts to a machine capable of breaking modern public-key cryptography. Still, the gap is closing faster than most public roadmaps suggested even two years ago, and algorithmic improvements have repeatedly reduced the hardware bar required to reach that point.
The consequence is a live and widely acknowledged risk. Encrypted data intercepted and stored today can be decrypted retrospectively once a sufficiently capable quantum computer exists, a strategy known as harvest-now-decrypt-later. Because migrating cryptography across an organisation's certificates, firmware, identity systems and long-lived products routinely takes five to fifteen years, national authorities including the US National Institute of Standards and Technology (NIST), the UK National Cyber Security Centre (NCSC) and the European Union have concluded that the sensible migration deadline is not the arrival of a cryptographically relevant quantum computer itself, but a point safely in advance of it. NIST finalised its first three post-quantum cryptography (PQC) standards in August 2024, and regulatory timelines built around discovery, prioritised migration and full transition by the early-to-mid 2030s are now in place across the United Kingdom, the European Union, the United States and the G7.
This briefing argues, drawing on an internal paper on the Quantum Fault Line, that the post-quantum problem should not be understood as solely a cryptography problem. The same period in which cryptographic foundations are weakening is the period in which artificial intelligence agents and autonomous machine-to-machine systems are being given growing authority to act without waiting for human approval. Where those two trends intersect, a compromised cryptographic identity ceases to be a data breach and becomes a compromised actor capable of instructing other systems. Organisations should therefore treat cryptographic exposure, machine autonomy and human control distance as three dimensions of a single risk, not three separate workstreams.
Beyond cryptography and control, this briefing sets out the physical and industrial realities behind the technology: the substantial and largely fixed energy cost of cryogenic cooling, the scarcity of helium-3, the reshoring of semiconductor and quantum-specific fabrication capacity under the US CHIPS Act and comparable European and Asian programmes, and the tightening web of export controls that now shapes where quantum and classical chips alike can be built and sold. It closes with a conclusion, a forward-looking statement, an indicative implementation timeline, a glossary and a list of reference sources for further reading.
The central message for boards and risk functions is straightforward. No organisation needs to panic about an imminent quantum breach. Every organisation with data, infrastructure or supplier relationships worth protecting for more than a few years needs a funded, multi-year plan, and needs to start it now.
1. Introduction
Quantum computing exploits superposition and entanglement to process information in ways that, for a narrow but expanding class of problems, no classical computer can efficiently replicate. For most of its history, the field has been a research pursuit. That has changed. Since 2024, hardware vendors have published dated, increasingly specific roadmaps; national governments have issued binding and semi-binding migration timelines for cryptography; and artificial intelligence, itself advancing at extraordinary speed, has become entangled with the quantum story in two distinct ways, as a tool that helps build better quantum computers, and as the reason weakening cryptography now matters more than it once did.
This briefing draws together seven threads that are usually discussed separately: the pace of computing development, the cryptographic stack that quantum computing threatens, the interaction between quantum computing and artificial intelligence, the regulatory response, realistic timelines, energy and environmental concerns, and chip production and supply chains. Where a single source has shaped the analysis most directly, that is the internal paper The Quantum Fault Line: Cybersecurity, Control, and the Post-Quantum Threat, whose central argument, that post-quantum risk is a control problem as much as a cryptography problem, runs through the whole of this document.
2. The State of Quantum Computing Development
Quantum hardware is being pursued along several competing physical approaches, and 2026 is the first year in which the differences between them have become commercially material rather than purely academic.
2.1 The competing architectures
● Superconducting circuits (IBM, Google): the most mature approach, cooled to roughly 10 to 20 millikelvin in dilution refrigerators. IBM's Nighthawk processor (120 qubits) became available to early users in January 2026, and IBM's published roadmap targets a fault-tolerant Starling system that can run around 100 million quantum gates on about 200 logical qubits by 2029. Google's Willow chip demonstrated below-threshold error correction in December 2024 and, through 2026, has reported logical qubit stability that improved by roughly a factor of 3.5 using reinforcement-learning-based calibration.
● Trapped ions (IonQ, Quantinuum): typically slower per operation but with longer coherence and very high gate fidelity. IonQ's modular Cepheus-1 system, launched in April 2026, links twelve nine-qubit chiplets into a 108-qubit device, an early demonstration of the modular scaling strategy the whole industry expects to need.
● Topological qubits (Microsoft): still earlier-stage, but pursued because topological encoding promises intrinsically lower error rates than physically encoding information in a single particle's state.
● Neutral atoms and photonics (QuEra, Pasqal, PsiQuantum, Xanadu): attractive partly because some configurations can, in principle, avoid the deep cryogenic cooling superconducting systems require, with implications for the energy profile discussed in Section 7.
2.2 Quantum advantage versus fault tolerance
Two milestones are routinely conflated in public commentary and are worth separating clearly. Quantum advantage (sometimes called quantum supremacy) means a quantum processor has solved a specific, often contrived, problem faster than any classical computer could in practice; Google's Sycamore claim in 2019 and its 2025 to 2026 successors are of this kind. Fault tolerance means a system can run long, useful, arbitrary computations reliably by using many noisy physical qubits to construct a smaller number of stable logical qubits protected by quantum error correction. IBM's own roadmap explicitly acknowledges the distinction, targeting scientific quantum advantage by the end of 2026 but reserving 2029 as the target for a large-scale, fault-tolerant machine, with a roughly 2,000-logical-qubit system (Blue Jay) pencilled in for around 2033.
This distinction matters directly for the cryptographic threat discussed in Section 3. Breaking RSA-2048 with Shor's algorithm requires not narrow advantage on a contrived benchmark but sustained, fault-tolerant computation at scale, which is precisely the harder milestone every vendor still places several years out.
2.3 Where the investment is going
Government and private investment in quantum hardware has accelerated sharply through 2025 and 2026, spanning national quantum initiatives in the United States, United Kingdom, European Union, China, Japan and elsewhere, alongside venture and public-market capital flowing into both quantum processor makers and the specialised supply chain of control electronics, cryogenics and packaging that supports them. The quantum chip market itself, while still small in absolute terms, is estimated to be growing at a compound annual rate above 40 per cent as vendors move from research prototypes to commercially sold systems.
3. The Cryptographic Stack Under Pressure
3.1 Cryptography does more than hide data
Public discussion of quantum risk tends to start and end with confidentiality, the idea that a quantum computer might read messages we thought were secret. That framing understates the problem. Cryptography also underpins authentication (proving a system or message is what it claims to be) and integrity (proving nothing has been altered). It is what tells a browser it is genuinely talking to a bank, what tells an operating system a software update came from a legitimate vendor, and what allows two machines that have never met to establish trust across an untrusted network. A quantum computer capable of breaking today's algorithms therefore threatens not just secrecy, but the entire fabric of digital trust: signed code, validated firmware, authenticated transactions and machine identity.
3.2 The NIST standards and what they replace
RSA, elliptic-curve cryptography (ECC) and Diffie-Hellman key exchange all rely on mathematical problems, principally integer factorisation and the discrete logarithm problem, that are intractable for classical computers but fall to Shor's algorithm on a sufficiently large, fault-tolerant quantum computer. In August 2024, NIST finalised its first three post-quantum cryptography standards:
● FIPS 203, ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), for establishing shared secret keys;
● FIPS 204, ML-DSA (Module-Lattice-Based Digital Signature Algorithm), for digital signatures;
● FIPS 205, SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), a conservative, hash-based signature scheme intended as a backstop should the lattice-based approaches later prove weaker than expected.
The UK NCSC and most other national bodies now recommend ML-KEM-768 and ML-DSA-65 as the practical defaults for most organisations, generally deployed in hybrid mode alongside existing classical algorithms during the transition period, with the long-term goal of running pure post-quantum cryptography once confidence and interoperability are established.
3.3 Harvest-now-decrypt-later
The most consequential feature of the post-quantum threat is that part of the attack can happen years before the quantum computer that makes it useful. An adversary can intercept and store encrypted traffic today and wait. This changes the risk calculus for anything with a long shelf life of confidentiality: genomic data, defence and intelligence material, intellectual property, critical infrastructure architecture, or long-lived commercial secrets. A password that expires next month is a minor exposure. A dataset that must remain confidential for twenty years is a very different one, and it is already, in practice, exposed to any adversary with the patience to wait.
3.4 Why crypto-agility alone is not enough
Migrating an organisation's cryptography is a substantial engineering programme, not a configuration change. Cryptographic dependencies are embedded in applications, certificates, identity systems, APIs, VPNs, embedded and industrial equipment, firmware and cloud services, much of which may remain deployed for ten to twenty years. Building a cryptographic inventory, developing crypto-agile architectures capable of swapping algorithms without redesigning systems, and reissuing certificates at scale are necessary first steps, but, as argued in Section 4, they do not by themselves answer the harder governance questions raised by autonomous systems acting on the trust those certificates provide.
4. Quantum Computing Meets Artificial Intelligence
Quantum computing and artificial intelligence interact in two quite different ways, and both deserve attention: AI is already an engineering tool that makes quantum hardware work better, and the growing autonomy of AI systems is what turns the cryptographic transition from a technical exercise into a governance problem.
4.1 AI as the tool that builds better quantum computers
In practice, the traffic between the two fields runs mostly from classical AI into quantum hardware rather than the reverse. Quantum processors require extremely precise calibration: gate parameters, qubit frequencies and control pulses must be tuned continuously, and machine learning has become the standard way to automate that tuning. Researchers at the US National Institute of Standards and Technology, for example, have used machine learning models trained to recognise quantum states from sensor data to cut the number of measurements needed to tune quantum-dot devices by around 70 per cent. Google's reported 3.5-times improvement in logical qubit stability on its Willow chip during 2026 similarly relied on reinforcement-learning-based calibration rather than a hardware redesign.
The reverse direction, quantum computers accelerating AI and machine learning workloads, remains largely experimental. Hybrid architectures, in which a classical optimiser drives an outer training loop. At the same time, a quantum processor evaluates a small parameterised circuit in the inner loop, which is the dominant pattern in 2026 and is already used commercially in narrow financial and generative modelling applications. However, the field's most credible practitioners are notably cautious about exaggerated claims of exponential speed-up, and current quantum hardware still lacks the scale and quality to deliver a broad, general advantage in mainstream machine learning.
4.2 The control problem: why authentication may matter more than secrecy
The more significant interaction, and the one this briefing treats as central, concerns what happens when cryptography weakens at the same moment software systems are given growing authority to act without a human approving every step. Traditional computer systems largely waited for people: a person authenticated, a person initiated a transaction, a person investigated an alert. That model is disappearing. Security platforms automatically isolate endpoints, trading systems execute transactions without a human in the loop, and AI agents increasingly call APIs, access databases, generate code, and instruct other agents directly.
This changes what a compromised digital identity means. Compromising a human employee's credentials may grant access to a system. Compromising the identity of an autonomous machine with permission to execute transactions, deploy code or instruct other machines may compromise an actor. That is a materially different security model, and it is why authentication and signature integrity, not only confidentiality, may be the more consequential casualty of a weakened cryptographic stack. NIST's decision to finalise two signature standards (ML-DSA and SLH-DSA) alongside one key-establishment standard (ML-KEM) reflects exactly this priority: if confidentiality fails, information is exposed; if authentication fails, a system can lose the ability to determine who, or what, is issuing its instructions.
4.3 Human authority versus operational control
A further distinction is worth making explicit. Formal human authority over a system- an accountable administrator, a named owner- is not the same as operational control over it. The practical test is whether a human can actually understand what an autonomous system is doing, decide what to do about it, and stop it before an action becomes irreversible. As decision chains cross more services and one automated action triggers another, that test increasingly fails, not because oversight has been removed, but because systems now act faster than the review cycle built around them. A person watching a dashboard is not necessarily a person controlling the system the dashboard describes.
4.4 The autonomy multiplier and the Quantum Fault Line
A conventional intrusion typically follows a linear path: credential compromise, attacker access, reconnaissance, human action. An autonomous compromise can instead propagate through identity compromise, machine acceptance, automated execution, machine-to-machine propagation, and cascading action. Critically, the attacker may not need continuous access at all, only the ability to introduce a single instruction that downstream systems believe came from a trusted source. Automation therefore risks converting some cybersecurity failures from intrusion problems into propagation problems, in which autonomous systems spread decisions, not merely malware.
I think organisations need to look at post-quantum exposure across three dimensions: Cryptographic Exposure (how dependent is the system on quantum-vulnerable cryptography), Machine Autonomy (how much authority can software exercise without human approval), and Human Control Distance (how difficult is it for a human to understand, interrupt, contain or reverse what the system is doing). The highest-risk systems sit where all three are high. That intersection is the Quantum Fault Line.
Adapted from The Quantum Fault Line: Cybersecurity, Control, and the Post-Quantum Threat
A legacy database of old encrypted records illustrates the low-risk end of this framework: high cryptographic exposure, but almost no autonomous authority attached to it. An AI-enabled operational platform that authenticates across multiple systems, issues instructions, triggers transactions and modifies infrastructure sits at the opposite end. Where such a platform's trust relationships rest on vulnerable cryptography, and humans cannot quickly interrupt its decisions, the risk profile is fundamentally different from a simple data breach, and the relevant board-level question shifts from "are we quantum safe" to "what happens if trust becomes uncertain while the machines keep operating".
4.5 From Zero Trust to Verifiable Control
Zero Trust established the principle that nothing should be trusted merely because of its position on a network. The next step, appropriate to an era of autonomous, AI-driven systems, is broader: organisations should verify not only identity but control, meaning who or what is acting, what authority it holds, where that authority originated, what decision produced a given action, and whether a human can meaningfully intervene. For critical autonomous systems, identity, authorisation, provenance, decision traceability, containment and human override should be treated as parts of a single security architecture. An emergency stop that takes 45 minutes to invoke is not meaningful control over a system that makes decisions in milliseconds.
5. The Regulatory Landscape
Regulatory attention has shifted markedly since 2024, from general awareness-raising to specific, dated migration guidance and, in some jurisdictions, to binding obligations.
5.1 United States
NIST finalised its first three PQC standards in August 2024 and now explicitly recommends organisations begin applying them rather than waiting for a large-scale quantum computer to appear. The National Security Agency's CNSA 2.0 guidance sets a comparable transition path for national security systems, covering software and firmware signing, certificates and network components. Executive Order 14412 extends a 2030 migration deadline to federal contractors, though a sector-wide binding requirement for financial services specifically had not been issued as of mid-2026.
5.2 United Kingdom
The NCSC published Timelines for Migration to Post-Quantum Cryptography on 20 March 2025, setting three indicative milestones aimed primarily at large organisations, operators of critical national infrastructure and organisations with complex bespoke IT: cryptographic discovery and an initial migration plan by 2028; migration of the highest-priority services by 2031; and completion across all systems, services and products by 2035. The NCSC recommends ML-KEM-768 and ML-DSA-65 as the standardised defaults, with hybrid deployment during the transition. These milestones are not, for most commercial organisations, legally binding deadlines in themselves, but the NCSC has launched an Assured Cyber Security Consultancy pilot to qualify firms to deliver PQC discovery and migration planning. Readiness is increasingly treated as a supervisory benchmark within broader cyber resilience and operational risk oversight, particularly for financial services and the NHS.
5.3 European Union
The EU NIS Cooperation Group published a Coordinated Implementation Roadmap in June 2025, and in January 2026 the European Commission published COM(2026) 13, proposing to make PQC transition a binding legal obligation under the NIS2 Directive for covered entities. The EU has called for member states to begin transition by the end of 2026, with critical infrastructure required to transition no later than the end of 2030. For UK and EU financial entities specifically, the Digital Operational Resilience Act (DORA), in force since January 2025, already requires demonstrable cryptographic resilience and key lifecycle management under Articles 6 and 7, and explicitly expects crypto-agility; non-compliance risk sits alongside GDPR exposure of up to 4 per cent of global turnover and, under DORA, potential personal liability for senior management.
5.4 Coordinated international and sector action
The G7 Cyber Expert Group issued a coordinated financial sector roadmap in January 2026, setting 2026 to 2027 for awareness and strategy development across G7 financial institutions, 2027 to 2028 for cryptographic discovery and inventory, 2028 to 2029 for risk assessment and tailored migration plans, 2030 to 2032 for migration execution on critical systems, and full validation from 2035. A December 2025 report from the CEPS Task Force identified quantum computers as a systemic risk to financial systems but, as of mid-2026, stopped short of recommending binding sector-specific requirements at EU level.
5.5 The commercial pace is outrunning the regulatory floor
Several large technology platforms are moving faster than any regulator requires. Google announced in March 2026 a 2029 target for completing its own PQC migration, some four to six years ahead of the NCSC's 2035 backstop, reflecting a judgement, echoed elsewhere in the industry, that resource estimates for breaking RSA-2048 have fallen sharply enough (from roughly 20 million noisy qubits in 2019 to estimates in the low hundreds of thousands to around one million by 2025, on some analyses) that regulatory deadlines calibrated a few years ago may prove conservative.
6. Timelines: When Might a Cryptographically Relevant Quantum Computer Arrive?
No cryptographically relevant quantum computer (CRQC), meaning one capable of running Shor's algorithm at the scale needed to break RSA-2048 or comparable elliptic-curve systems, exists as of September 2026. Estimating when one might exist is genuinely difficult because it depends on simultaneous progress across qubit quality, error correction, algorithmic efficiency, and control electronics, rather than on a single measurable trend.
A range of credible, differing estimates illustrates the uncertainty rather than resolving it. Global Risk Institute expert surveys put the probability of a CRQC existing by 2034 at around 34 per cent in the most recent assessment, roughly double the 17 per cent estimate given for the same date two years earlier, a shift attributed to error-correction breakthroughs, more aggressive vendor roadmaps and algorithmic improvements that have repeatedly lowered the hardware bar. Other analyses place less than 5 per cent confidence that RSA-2048 will be broken before 2039. What is consistent across nearly all serious sources is that expert planning now centres on the 2030 to 2035 window, and that the resource estimate for the attack itself has fallen substantially over the past several years as improved variants of Shor's algorithm have reduced the qubit counts believed necessary.
The practical response to this uncertainty, echoed by NIST, the NCSC and industry security teams alike, is that the meaningful deadline is not Q-Day itself but the point set by Mosca's theorem: migration must complete before the sum of a dataset's required confidentiality lifetime and the time needed to migrate exceeds the time remaining until a CRQC exists. Given that cryptographic migration programmes routinely take five to fifteen years, and that harvest-now-decrypt-later attacks make today's data collection retrospectively dangerous regardless of when Q-Day itself arrives, migration planning is, in practice, already overdue for organisations holding long-lived sensitive data.
7. Energy Usage and Environmental Concerns
7.1 Where the power actually goes
A common misconception is that quantum computers are inherently energy-efficient because a single-qubit operation consumes only a tiny fraction of the energy of a classical transistor operation. At the level of the qubits themselves, this is broadly true; the practical reality is instead dominated by the infrastructure surrounding them. Superconducting quantum processors must be cooled to around 10-20 millikelvin, roughly 150 times colder than the cosmic microwave background, using multi-stage dilution refrigerators. Typical cloud-accessible superconducting systems draw around 25 kilowatts of continuous power, the great majority of which goes into refrigeration and supporting control electronics rather than the qubits themselves, and this power draw does not fall appreciably when the processor is idle rather than running.
7.2 Architecture matters for the long-term energy profile
Not every qubit technology carries the same cooling burden. Neutral-atom systems, which operate at or near room temperature, report total system power below 10 kilowatts even at comparable processor scale, roughly a third of the draw of a dilution-refrigerator-based system at today's modest scales. Technology roadmaps for full-scale, fault-tolerant machines suggest this gap could widen to as much as two orders of magnitude between architectures as systems grow, meaning the choice of underlying qubit technology- superconducting, trapped-ion, neutral-atom or photonic- will materially shape the industry's aggregate energy footprint over the next decade, quite apart from any headline performance differences.
7.3 The helium-3 constraint
Dilution refrigerators depend on helium-3, a rare isotope produced as a by-product of tritium decay in nuclear weapons stockpiles, costing on the order of $1,900 to $2,600 per litre, several hundred times the cost of the much more abundant helium-4 used in MRI cooling. As the number of deployed dilution refrigerators grows, helium-3 supply, not electricity, may become the binding physical constraint on scaling superconducting quantum computing, and it is a constraint with no straightforward substitute.
7.4 Whether the energy cost is justified
The relevant efficiency comparison is not between quantum and classical computing in the abstract, but between quantum and classical computing for a specific problem. A calculation that a quantum computer completes in minutes, where a classical supercomputer would require months and correspondingly vastly more energy, is a net environmental gain even accounting for cryogenic overhead. Where a problem is efficiently solvable classically, routing it through a quantum system is very unlikely to be the more sustainable choice. Analysis suggests quantum acceleration needs to exceed roughly a hundred-fold speed-up to offset the fixed cryogenic energy overhead of superconducting systems, underscoring that quantum computing's environmental case rests on selecting the right problems, not on any inherent efficiency advantage across the board.
8. Chip Production and the Quantum Supply Chain
8.1 Classical semiconductor reshoring
Quantum computers depend heavily on conventional advanced semiconductors for control electronics, and the wider chip industry in which quantum hardware sits has seen its industrial policy and export controls transform since 2022. The US CHIPS and Science Act appropriated $52.7 billion in federal funding; by 2026 the Commerce Department had disbursed more than $52 billion in grants and loan guarantees, catalysing an estimated $450 billion in private investment. TSMC's Arizona fabs are now producing 4-nanometre chips at scale, Samsung's Taylor, Texas facility has reached full capacity for 3-nanometre gate-all-around production, and Intel's Ohio site has begun shipping 18A (1.8-nanometre-class) wafers. The US share of global advanced chip manufacturing capacity has risen from roughly 12 per cent in 2020 to around 22 per cent by early 2026, according to estimates from the Semiconductor Industry Association. Comparable state-backed buildouts are under way in the European Union (TSMC Dresden, Intel Magdeburg, STMicroelectronics Catania), Japan (the government-backed Rapidus consortium, targeting 2-nanometre-class production) and India (Micron's Sanand facility and Tata Electronics' Dholera fab).
8.2 Export controls as an operating constraint
US export controls on advanced semiconductors and semiconductor manufacturing equipment, tightened progressively since October 2022 and again through 2025 and into 2026, now restrict the sale of advanced logic chips and accelerators and the export of manufacturing equipment to China and roughly 40 other jurisdictions. A Boston Consulting Group analysis published in March 2026 estimated that maintaining parallel supply chains for advanced, export-controlled semiconductors adds 25 to 35 per cent to landed costs for chips destined for controlled markets, and procurement functions are responding with multi-region sourcing mandates, larger buffer stocks and systematic bill-of-materials audits for US-origin content. Estimates suggest China's advanced chip production capacity remained at only around 1 to 4 per cent of US capacity through 2025, and this compliance environment is now, in practice, a standing operational constraint for any organisation with a global electronics supply chain, quantum or otherwise.
8.3 The quantum-specific supply chain
Quantum hardware makers are increasingly moving to secure their own fabrication capacity rather than relying entirely on third parties. IonQ's announced $1.8 billion acquisition of SkyWater Technology in early 2026 would give it dedicated semiconductor fabrication capacity; PsiQuantum has instead pursued a fabrication partnership with GlobalFoundries for its photonic chips. Consolidation is also under way in the specialised supporting industry of cryogenics and control electronics: Rohde & Schwarz's acquisition of Zurich Instruments combined RF test expertise with quantum-specific control electronics, and Quantum Design's £60 million acquisition of Oxford Instruments NanoScience created a broader cryogenic instrumentation platform. Private supply-chain specialists such as Quantum Machines, Qblox and Maybell Quantum continue to attract venture investment on a picks-and-shovels thesis, supplying every major qubit-technology maker regardless of which architecture ultimately dominates.
9. Wider Concerns
9.1 Geopolitical concentration
Quantum hardware leadership, like advanced semiconductor manufacturing, is concentrated in a small number of jurisdictions, principally the United States, China, the European Union, the United Kingdom and Japan, with export controls, national quantum initiatives and CHIPS-style industrial policy now functioning as tools of strategic competition rather than purely commercial decisions. Governments increasingly treat the ability to build and to deny others access to cryptographically relevant quantum capability as a matter of national security in its own right.
9.2 Migration cost and organisational readiness
Even organisations that accept the risk face a genuine capability gap: cryptographic inventories are frequently incomplete, crypto-agile architectures are the exception rather than the rule, and few organisations outside financial services and critical national infrastructure have begun the discovery phase that NCSC and NIST guidance both treat as the necessary first step. Cyber-insurance underwriters and major counterparties are beginning to treat PQC readiness as a factor in their own risk assessments, meaning the practical deadline for many organisations is increasingly commercial and contractual rather than purely regulatory.
9.3 Verifiable Control as an unresolved governance question
As Section 4 sets out, no regulatory framework yet requires organisations to demonstrate Verifiable Control, meaning that identity, authorisation, provenance, decision traceability, containment, and human override are treated as parts of a single security architecture for autonomous, AI-driven systems. Existing guidance overwhelmingly addresses cryptographic migration; the governance of machine autonomy that depends on that cryptography remains, for the most part, an emerging practice rather than a settled discipline, and is likely the more difficult of the two problems to solve.
9.4 Overstated and understated claims coexist
Commentary on quantum computing runs to extremes in both directions. Some coverage announces imminent breakthroughs or an imminent Q-Day that outpaces what serious practitioners in the field are prepared to claim; other commentary dismisses the entire field as decades away and therefore not yet worth funding. The evidence reviewed in this briefing supports neither extreme: measurable, credible hardware progress is occurring year on year; resource estimates for breaking today's cryptography have fallen meaningfully; yet no fault-tolerant, cryptographically relevant machine exists, and every serious vendor roadmap still places one several years out.
10. Conclusion
Quantum computing in 2026 sits at a genuine inflection point, not because a cryptographically relevant machine has arrived, but because the combination of falling resource requirements, accelerating hardware roadmaps and firm regulatory migration timelines has turned what was once a speculative, long-range risk into a funded, dated engineering programme across government and industry. The technology itself remains some years from the milestone that would make current public-key cryptography unsafe in practice, and estimates of that milestone continue to diverge by a decade or more between credible experts.
What is not in doubt is the shape of the sensible response. Because cryptography is embedded so deeply and for so long in modern infrastructure, and because harvest-now-decrypt-later attacks make today's data collection a live threat regardless of when a quantum computer capable of decrypting it eventually exists, migration to post-quantum cryptography needs to begin now rather than when uncertainty resolves. Equally, because the same period is seeing artificial intelligence systems granted rapidly growing operational authority, migrating algorithms without also addressing who, or what, can act on the trust those algorithms provide would solve only half the problem. Cryptographic exposure, machine autonomy, and human control distance need to be assessed together, not in separate workstreams that answer to separate teams.
Energy, environmental, and industrial realities, cryogenic cooling costs, helium-3 scarcity, and a semiconductor and quantum supply chain being actively reshaped by industrial policy and export controls add a further layer of practical constraints that will shape which quantum architectures scale fastest and where. None of these constraints changes the underlying conclusion: the transition is under way, its rough shape and timing are reasonably well understood even where its precise date is not, and the organisations best placed to manage it will be those that treat it as a standing, board-level, multi-year programme rather than a distant technical curiosity.
11. Forward-Looking Statement
This briefing contains forward-looking statements and estimates concerning quantum computing hardware timelines, cryptographic migration deadlines, and the likely arrival of a cryptographically relevant quantum computer. These statements are based on publicly available vendor roadmaps, government and regulatory guidance, and expert survey data current as at September 2026. They are provided for general informational and strategic planning purposes only. They do not constitute legal, regulatory, investment or technical advice, and should not be relied upon as a guarantee of future events.
Quantum hardware roadmaps published by vendors, including the specific dates and qubit counts referenced throughout this briefing, represent stated intent and are explicitly subject to change or withdrawal; the industry's historical track record on meeting self-published roadmap dates is mixed, and both earlier and later outcomes than those described here remain plausible. Expert probability estimates for the arrival of a cryptographically relevant quantum computer vary by a decade or more among credible sources and are themselves subject to revision as hardware, error-correction, and algorithmic progress continue. Regulatory timelines set out in Section 5 reflect guidance in force or proposed as at September 2026 and may be amended, accelerated or relaxed by the relevant authorities. Readers should treat all dates in this document as indicative planning assumptions, monitor primary regulatory and vendor sources directly, and take independent legal, technical and risk advice before making migration or investment decisions.
12. Indicative Timeline
The following consolidates the principal dated milestones referenced throughout this briefing. Vendor dates are stated intentions, not commitments; regulatory dates reflect guidance and proposals current as at September 2026.
Period Milestone Source / Domain
2024 NIST finalises first three PQC standards: ML-KEM, ML-DSA, SLH-DSA Cryptography (NIST)
2024 Google Willow demonstrates below-threshold quantum error correction Hardware
Jan 2025 EU DORA enters into force, requiring financial entities to demonstrate cryptographic resilience. Regulation (EU)
Mar 2025 UK NCSC publishes PQC migration timelines: 2028 / 2031 / 2035 Regulation (UK)
Jun 2025 EU NIS Cooperation Group publishes Coordinated Implementation Roadmap Regulation (EU)
2026 (end) IBM targets first scientific quantum advantage with a fault-tolerant module Hardware (IBM)
2026 EU member states asked to begin PQC transition (COM(2026) 13 proposes binding NIS2 obligation) Regulation (EU)
2026–2027 G7 financial sector: awareness raising and strategy development begins Regulation (G7)
2027–2028 G7 financial sector: cryptographic discovery and inventory Regulation (G7)
2028 UK NCSC target: cryptographic discovery complete, initial migration plan produced Regulation (UK)
2028–2029 G7 financial sector: risk assessment and tailored migration plans Regulation (G7)
2029 IBM Starling target: ~200 logical qubits, ~100 million gates (fault-tolerant target) Hardware (IBM)
2029 Google's self-imposed PQC migration completion target (ahead of regulatory deadlines) Industry
2030 EU deadline for critical infrastructure PQC transition (proposed backstop) Regulation (EU)
2030 US Executive Order 14412 migration deadline for federal contractors Regulation (US)
2030–2032 G7 financial sector: migration execution on critical systems Regulation (G7)
2030–2035 Range in which expert surveys place meaningful probability of a CRQC existing Cryptography / Hardware
2031 UK NCSC target: migration of highest-priority services complete Regulation (UK)
~2033 IBM Blue Jay target: ~2,000 logical qubits Hardware (IBM)
2034–2035 G7 financial sector and UK NCSC: full validation/completion of PQC migration Regulation (G7 / UK)
2035 US national security policy goal: transition away from vulnerable cryptography largely complete Regulation (US)
2035 UK NCSC and EU: full PQC transition across all systems, services and products Regulation (UK / EU)
13. Glossary
Cryptographically Relevant Quantum Computer (CRQC): A quantum computer large, stable and fault-tolerant enough to run Shor's algorithm at the scale needed to break real-world public-key cryptography such as RSA-2048 or comparable elliptic-curve systems. None is known to exist as of September 2026.
Crypto-agility: The capacity of a system or organisation to switch cryptographic algorithms without redesigning the underlying architecture, generally regarded as essential to a manageable post-quantum migration.
Fault tolerance: The capacity of a quantum computer to run long, arbitrary, useful computations reliably by encoding a smaller number of stable logical qubits from a larger number of noisy physical qubits using quantum error correction.
Harvest-now-decrypt-later (HNDL): An attack strategy in which encrypted data is intercepted and stored today for retrospective decryption once a sufficiently capable quantum computer becomes available.
Logical qubit: A single, error-corrected unit of quantum information constructed from multiple physical qubits, used as the basic unit of fault-tolerant quantum computation.
ML-DSA / ML-KEM / SLH-DSA: The three NIST-standardised post-quantum cryptographic algorithms finalised in August 2024: ML-DSA and SLH-DSA for digital signatures, ML-KEM for key establishment.
Mosca's Theorem: An informal rule stating that data must be migrated to quantum-safe protection before the sum of its required confidentiality lifetime and the time needed to migrate it exceeds the time remaining until a CRQC exists.
NISQ (Noisy Intermediate-Scale Quantum): The current era of quantum hardware, characterised by tens to a few thousand physical qubits without full error correction, too noisy for large-scale fault-tolerant computation but capable of narrow demonstrations of quantum advantage.
Post-quantum cryptography (PQC): Cryptographic algorithms designed to be secure against attack by both classical and quantum computers, standardised by NIST from August 2024 onward.
Q-Day / Y2Q: Informal terms for the point at which a cryptographically relevant quantum computer becomes operational and public-key cryptography as currently deployed is broken. Not a fixed calendar date.
Quantum advantage (or supremacy): A demonstration that a quantum computer has solved a specific problem faster than any classical computer could in practice, distinct from and less demanding than fault tolerance.
Quantum machine learning (QML): The intersection of quantum computing and machine learning, most commonly implemented in 2026 as hybrid architectures in which a classical optimiser drives training while a quantum processor evaluates a parameterised circuit.
Shor's algorithm: A quantum algorithm developed by Peter Shor in 1994 that can factor large integers and solve the discrete logarithm problem exponentially faster than any known classical algorithm, thereby threatening RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange.
Verifiable Control: A proposed extension of Zero Trust principles for autonomous, AI-driven systems, in which identity, authorisation, provenance, decision traceability, containment, and human override are treated as components of a single security architecture.
Zero Trust: A security model that assumes no system or user should be trusted by default, regardless of its position on a network, and requires continuous verification of identity and authorisation.
14. Reference and Source List
This briefing draws on the following categories of source. Vendor roadmaps and dated technical claims should be treated as stated intentions rather than verified outcomes, and readers are encouraged to consult primary sources directly given the pace of change in this field.
Government and regulatory sources
● US National Institute of Standards and Technology (NIST) – FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), finalised August 2024; CNSA 2.0 guidance.
● UK National Cyber Security Centre (NCSC) – “Timelines for Migration to Post-Quantum Cryptography”, published 20 March 2025.
● European Commission – EU NIS Cooperation Group Coordinated Implementation Roadmap (June 2025); COM(2026) 13 proposal under the NIS2 Directive (January 2026).
● EU Digital Operational Resilience Act (DORA), in force from January 2025, Articles 6 and 7.
● G7 Cyber Expert Group – coordinated financial sector post-quantum roadmap, January 2026.
● US Executive Order 14412 and the 2022 National Security Memorandum on Promoting United States Leadership in Quantum Computing.
● US CHIPS and Science Act (Public Law 117-167) and associated Commerce Department / CHIPS Program Office disclosures.
Industry, hardware and market analysis
● IBM Quantum – published hardware and development roadmap, 2024–2026 updates.
● Google Quantum AI – Willow chip technical disclosures and PQC migration announcements, 2024–2026.
● IonQ, Quantinuum, Microsoft Azure Quantum, QuEra, Pasqal, PsiQuantum, Xanadu – published roadmaps and technical announcements, 2025–2026.
● Global Risk Institute – Quantum Threat Timeline Reports (expert survey series).
● Semiconductor Industry Association (SIA) – capacity and market share estimates, Q1 2026.
● Boston Consulting Group – analysis of export-control cost impact on semiconductor supply chains, March 2026.
● World Economic Forum – “Scaling quantum computing for maximum energy efficiency”, January 2026.
Academic and technical literature
● Shor, P. “Algorithms for quantum computation: discrete logarithms and factoring.” Proceedings, 35th Annual Symposium on Foundations of Computer Science, 1994.
● Arute, F. et al. “Quantum supremacy using a programmable superconducting processor.” Nature, 2019, and supplementary energy-consumption analysis.
● Peer-reviewed and preprint literature on quantum error correction, post-quantum migration in financial services, quantum machine learning, and quantum computing energy and resource estimation, 2025–2026 (arXiv and journal sources).
This document was prepared for internal briefing purposes. Figures, dates and vendor claims reflect publicly available information as at September 2026 and should be independently verified before being relied upon for decision-making.
Disclaimer
This document has been prepared for general informational purposes only and does not constitute legal, regulatory, financial, investment, technical or professional advice of any kind. While reasonable care has been taken to ensure the accuracy of the information contained herein as at the date of preparation, no representation or warranty, express or implied, is given as to its accuracy, completeness or currency, and no responsibility or liability is accepted for any error or omission.
The subject matter of this document, including quantum computing hardware, cryptographic standards, and regulatory timelines, is evolving rapidly, and information accurate at the time of writing may become outdated without notice. Vendor roadmaps, technical claims and dated milestones referenced in this document represent stated intentions and third-party disclosures rather than verified or guaranteed outcomes.
This document should not be relied upon as the sole basis for any business, technical, compliance or investment decision. Readers should seek independent professional advice appropriate to their own circumstances before acting, or refraining from acting, on any information contained herein. To the fullest extent permitted by law, the author and any associated organisation accept no liability for any loss or damage arising directly or indirectly from the use of, or reliance on, this document.
This document may not be reproduced, distributed or disclosed to any third party, in whole or in part, without prior consent, save where such disclosure is required by law or regulation.
EAJW (c) 2026. All rights reserved.
