Prepare the transition.
Do not predict Q-day.

THE ORIGINAL BACKSTORY

A technology opportunity with a long security lead time.

Quantum computing uses quantum-mechanical behaviour to perform certain computations differently from a classical computer. It does not simply make every application faster. A benchmark against a selected task is not a general business-performance guarantee.

Further reading includes a Financial Times visual explainer and a commentary on the dangers of quantum computing. The commentary is subscription content. Its existence is not independent verification of a date for a future cryptographic breakthrough.

The useful distinction is between opportunity and readiness. A firm may explore a specialist application while also preparing for a change to the cryptography used across ordinary business systems. Those are different workstreams with different evidence requirements.

FINANCE & LAW ENFORCEMENT / 2023

What the original reports add.

UK Finance published separate reports on quantum risks and opportunities in 2023. The risk report examines the dependence of financial services on cryptography and the need to prepare for migration. The opportunity report belongs alongside it as a counterpart, rather than allowing security concern to stand in for an assessment of business value.

Europol’s 23 October 2023 report announcement similarly considered opportunities in analysis, forensics, and communication, alongside the possibility that future quantum capability could undermine current cryptography. It called for preparation, not a claim that the capability was already available.

For a board, the common lesson is lead time. An application can be replaced relatively quickly while its supplier chain, archived records, embedded systems, or long-lived signatures remain much harder to change.

THE CURRENT PLANNING REFERENCE

Use a migration programme, not a guessed “Q-day”.

The NCSC’s migration guidance sets indicative milestones: discovery and an initial plan by 2028, early high-priority migration and a refined roadmap by 2031, and completion by 2035. It is primarily aimed at large organisations, critical infrastructure, and bespoke IT; smaller firms should work through their relevant suppliers and services.

Post-quantum cryptography is cryptography designed to resist the relevant quantum attacks. It is not the same thing as buying a quantum computer or a quantum communications product. Supplier claims should make clear which problem and system are covered.

A PRACTICAL INVENTORY

Ask where secrecy, trust, and replacement time overlap.

• Information: which records need confidentiality well beyond their immediate working life?
• Services: where do encryption, digital signatures, certificates, and secure connections support a critical process?
• Suppliers: what migration support is available for the actual product and version?
• Change: what testing, interoperability, procurement, and replacement work will the transition require?

Include external services and equipment that cannot be upgraded easily. An inventory should connect a technical dependency to a business owner and a realistic change route. A list of algorithm names without that connection will be difficult to prioritise.

Use procurement and normal renewal cycles to improve visibility. Ask suppliers for plans and supported migration options, then assess compatibility and operational consequences before adopting them. Avoid untested combinations or claims of universal quantum immunity.

READ THE HISTORICAL VISUAL CAREFULLY

A 2023 policy comparison is a record of its time.

The European Policy Centre policy agenda reflects the policy debate at the time of publication. For operational planning, use current guidance and the milestones above alongside evidence from the suppliers involved.

For a broader introduction, see general background reading. Use accessible explainers to establish vocabulary, then use the primary guidance and your suppliers’ evidence for decisions about migration.