September 2026: Where the world stands
The starting positions, as of September 2026.
Hardware. Google’s Willow chip crossed the threshold in late 2024: logical error rates halved as code patches grew6. Quantinuum’s Helios has been commercially live since November 2025 with 48 error-corrected logical qubits from 98 trapped ions7. IBM’s roadmap runs Kookaburra (2026), Cockatoo (2027), Starling (2029, 200 logical qubits); in August 2026 it linked and cooled the first two cryogenic modules Starling will live in8. Quantinuum’s Apollo, hundreds of logical qubits, is due 2029 to 20309. In Hefei, Zuchongzhi 3.2 reached below-threshold error correction in December 2025, the first result of its kind outside the United States10.
Money. Quantinuum’s June 2026 IPO raised $1.68 billion at a valuation near $14 billion: the moment quantum acquired a public scoreboard11.
The clock. NIST deprecates RSA and elliptic-curve cryptography in 2030 and disallows them in 20351. The NCSC wants a cryptographic inventory and plan by 2028, priority systems moved by 2031, everything by 20352. The G7 gives critical financial systems a 2030 to 2032 window3. The Bank of England’s words: quantum computing “could render obsolete the asymmetric cryptography algorithms underpinning the entire financial system”4.
Primer: five ideas that carry the whole story
1 · Logical qubits are the only count that matters. Physical qubits fail about once per thousand operations; useful algorithms need one in a trillion. Error correction weaves many physical qubits into one logical qubit. A headline count that does not say “logical, with error rate” is marketing.
2 · The threshold is a band, not a number. Gidney’s 2025 construction breaks RSA-2048 in under a week with 1,537 logical qubits on under a million physical ones5. What actually sets the date is magic-state throughput, so this scenario draws the threshold as a band from roughly 1,000 to 2,000 logical qubits.
3 · Harvest now, decrypt later. Ciphertext archived today is opened the day a CRQC exists. For long-lived secrets the breach has already happened; only the disclosure date is open.
4 · Mosca’s inequality. If the years your data must stay secret plus the years your migration takes exceed the years until a CRQC, you are already exposed15. The deadline is earlier than the machine.
5 · The verification gap. Quantum computations are hard to check classically, and no agreed standard exists for verifying logical-qubit counts, error rates or capability claims. This gap, not qubit counts, is the hinge of the scenario.
A footnote on the other clock. Nobody buys a quantum computer to run Shor’s algorithm. They buy it for chemistry and materials, and the machine that results can also break keys. That is the only place the commercial story enters this one.
Winter 2026: The race gets a ticker symbol
The metric changes, the money follows, and the seeds of the verification crisis are sown.
The Quantinuum IPO does to quantum what Netscape’s float did to the web. Within a quarter two more vendors file to list, and equity desks settle on the one number that predicts revenue: verified logical qubits.
The trouble is the word. In December 2026 Centaurus Quantum, the US frontrunner in this scenario, announces a 60-logical-qubit system with error rates “below 10⁻⁶”. The claim adds $4 billion to its valuation in a week. Three weeks later a postdoc at ETH Zürich, Lena Aebischer, spends a weekend trying to make the number reproduce and writes a two-page note: the figure describes the idle-memory error of the best qubit in the array, not computation. The note changes nothing. The number is already in every pitch deck. She starts a spreadsheet with three columns, claimed, reproduced, gap, and one row.
In Copenhagen, Øresund Quantum publishes its full error budget with every release and watches its sales cycle lengthen anyway: a buyer cannot tell a careful number from a flattering one, so both get discounted. Øresund becomes the first vendor to ask, in public, for a referee.
At Lombard Exchange Bank in London, the CISO reads both documents. Her inventory, mandated by the NCSC’s 2028 milestone, has found 14,000 uses of public-key cryptography so far; the consultants say six to nine years to migrate. She does the Mosca arithmetic on a whiteboard and moves quantum from the emerging-risk register to the operational one. What moves the credible Q-Day estimate this year is not physics. It is that capital, for the first time, is pricing the race.
Why ‘verified’ is doing so much work
A logical-qubit claim bundles four numbers: physical-per-logical ratio, error rate per operation, sustainable circuit depth, and real-time decoder speed. Vendors quote whichever flatters. There is no quantum equivalent of an audited financial statement, no disclosure schema, no independent test house, no liability for optimistic rounding. In 2026 this is an inconvenience. By 2029, with national strategies riding on the numbers, it is a systemic vulnerability.
Early 2027: Claims nobody can check
The habit that will govern the code-breaking numbers sets now.
In March 2027 Centaurus announces a result it calls “infeasible to reproduce classically”. The phrase appears eleven times in the press release and zero times in the technical paper. By June, forty-one companies have made claims of the same shape and quantum-washing enters the vocabulary of the financial press.
Three groups attempt replication, Aebischer’s among them. Two match the result with tensor networks on a GPU cluster in nine days; Centaurus says the comparison misunderstands the workflow. There exists no referee. A UK pension administrator signs a seven-figure “quantum risk mitigation” contract for what is, on inspection, a VPN with a marketing layer. The FCA opens a file. It lands with Daniel Okafor, a case lawyer, who notices it is his third quantum file in a year and that all three vendors cite the same benchmark. He asks the vendors for the benchmark. He does not get it. The file will matter later.
| What AI had by its benchmark wars | What quantum has in 2027 |
|---|---|
| MLPerf, shared benchmarks run by a consortium | Vendor benchmarks, on vendor hardware, scored by vendor software |
| Model cards and datasheets as a disclosure norm | Press releases; no disclosure schema anyone is bound to |
| Independent replications within weeks | Replications contested; no agreed test of “infeasible classically” |
| Liability for misleading claims, eventually | None, and no one to bring the case |
“The market has decided quantum is real. The market has no instrument for deciding which quantum is real.” Sell-side note, April 2027
Meanwhile the engineering grinds forward, indifferent. The qLDPC memory module ships. Systems reach 80 logical qubits. The first dedicated decoder chips tape out. None of it makes headlines. All of it matters more than everything that does.
Late 2027: The denominator shrinks
Beijing merges its programme. A coding result bends the curve.
In September 2027 Beijing consolidates: USTC laboratories, spinouts and CAS institutes fold into the Tianshu Collective, one budget line, one reporting chain, a purpose-built campus in Hefei. Western analysts estimate the five-year allocation at $40 billion.
The consolidation is partly a response to California. In October Centaurus publishes “Relay”: a qLDPC-family code that cuts its physical-to-logical ratio from 900:1 to under 200:1, with a decoder that keeps up. The paper is rigorous, replicated, and quietly terrifying. Aebischer reproduces it in six weeks and says so in public, the first Centaurus claim to survive her; her spreadsheet now has eleven rows, and the gap column is empty only once. The denominator of every CRQC timeline just shrank by a factor of four. A million physical qubits had looked like a mid-2030s fabrication problem. A quarter of a million looks like a 2030 problem.
At Lombard Exchange the board slide that used to say “monitor” now says “credible worst case has moved to the early 2030s; our migration completes 2033 on current funding”. The CISO asks for a tripling of budget and gets 40% of it. In December the NCSC and its Five Eyes counterparts issue joint guidance: organisations should no longer assume that cryptographically relevant quantum capability will not exist before 2035. Double negatives are how agencies scream.
The inflection, technically
Three curves compound: better codes, qLDPC needs five to ten times fewer physical qubits than surface codes; better decoders, real-time decoding moves from FPGAs to ASICs; magic-state factories, distillation costs fall eightfold. Compounded: resources for a given computation fall thirtyfold in eighteen months. Nobody planned for the curves to multiply. They multiplied.
Early 2028: The curve bends
Logical counts triple. The bottleneck moves, the market reprices, the first secret leaks.
Through the first half of 2028 Centaurus scales Relay to a 190-logical-qubit machine sustaining million-gate circuits. Roadmaps suddenly look conservative rather than heroic, and private investment trebles the 2026 figure.
The bottleneck migrates. With codes and decoders largely solved, the constraint becomes magic-state throughput, T-gates per second, and the league tables keep ranking a number that no longer matters. In May a Tianshu paper describes a distillation factory three times more efficient than the Western state of the art: the first time the frontier of a strategic computing technology has been visibly advanced from Hefei.
At the NQCC’s Quantum Software Lab, Sam Whitfield has been running verification protocols across the UK testbeds for three years without anyone asking for the results. He reads Aebischer’s spreadsheet, adds a fourth column, what the vendor’s own benchmark harness does to the number, and starts re-running public claims on the vendors’ own cloud instances. Nobody has asked him to. Nobody has told him not to.
In February a Centaurus decoder-firmware repository turns up, briefly, on infrastructure attributed to the Ministry of State Security. Detected, attributed and disclosed within eleven weeks. Export controls on cryogenics and specialised lasers tighten within the quarter.
Lombard Exchange completes its inventory thirteen months early: 31,000 cryptographic dependencies, 9% on hybrid post-quantum exchange, and the unhappy topology every institution discovers: a fifth of the estate cannot move until vendors move first, and three gating vendors have no published timeline. The machines are not breaking codes in 2028. Cryptography is nonetheless the only application where the possibility of the machine moves trillions.
Late 2028: The harvest disclosure
A leaked assessment turns an abstract risk into a political fact. London moves first.
In October 2028 a Five Eyes assessment leaks: a state adversary has, since at least 2019, archived encrypted traffic at scale, exabytes of intercepts indexed against the day a CRQC can open them. Sovereign-debt negotiations, defence-industrial correspondence, and “material relating to the personal affairs of public officials in allied states”.
Harvest-now-decrypt-later had been a conference slide for a decade. Now it is a constituency issue, and the political logic inverts overnight: before the leak, spending billions against a machine that does not exist was unjustifiable; after it, not having spent the billions is the scandal.
The United Kingdom moves first, by institutional wiring rather than foresight: the Bank of England co-chairs the G7 cyber workstream, CMORG has a playbook, the NCSC milestones were already law-adjacent. From the third quarter of 2029 firms must file an annual Quantum Readiness Attestation: board-signed, covering inventory, funding, vendor dependencies and, the clause that quietly creates an industry, independent assurance of any quantum-related claim relied on in procurement. The G7 pulls its window in to 2030. Brussels drafts a DORA amendment.
The drafts the clause will lean on already exist. ISO/IEC JTC 3 has a capability-disclosure schema at committee stage; the NQCC and the Quantum Software Lab have run verification protocols across UK testbeds since 2025; IEEE has a benchmarking group. None is binding. A PRA supervisor writes the memo everyone will later quote: push too hard, too fast, and you harvest box-ticking attestations. Okafor’s one file is now forty-one. The clause on independent assurance is lifted, almost word for word, from a memo he wrote in 2027 that nobody answered.
The retrospective breach
The disclosure reframes quantum risk in the only language boards reliably parse: the loss has already occurred; only recognition is deferred. Insurers get there before regulators finish consulting. From early 2029 cyber policies carry quantum exclusion clauses and premium discounts for attested migration. Actuaries, not physicists, end up writing the era’s most consequential timeline estimates.
Early 2029: Compression
Timelines collapse from both ends: the machines accelerate and the migration estimate lengthens.
- Global Risk Institute, Quantum Threat Timeline 2025 (26 experts). The optimistic estimate of a CRQC within ten years rose from 34% (2024) to 49% (2025), the sharpest upward move in the survey’s history.GRI and evolutionQ, published March 2026
- DARPA Quantum Benchmarking Initiative. Eleven companies advanced to Stage B on 6 November 2025. The programme exists to check, independently, whether any approach reaches utility scale by 2033: the working prototype of this scenario’s verification facility.darpa.mil, Stage B selection
Centaurus’s “C-480” comes online in March: 480 logical qubits, magic-state factories occupying two-thirds of the floor plan, sustained billion-gate computations. For the first time RSA-2048 sits on the visible curve: this architecture, scaled threefold and run for a fortnight, would do it. Threefold is no longer a paradigm shift. It is a procurement order.
In March, Whitfield’s testbed re-runs Veridian Q’s published benchmark on Veridian’s own cloud instance and gets 90 logical qubits, not 350. He sends the result to the FCA with a covering note. It goes into a drawer.
The supply chain becomes the story: dilution-refrigerator lead times hit twenty months, helium-3 quintuples, and the two cryo-CMOS foundries allocate by geopolitical bloc.
Meanwhile the defensive estimate moves the wrong way. HSMs with burned-in RSA, payment terminals on fifteen-year cycles, one un-migratable intermediate certificate authority blocking ten thousand certificates, and four under-funded open-source projects that gate the TLS of the whole world. Tier-one migration estimates rise during 2029, from 5.5 to 7 years, even as spending triples. The Bank of England discovers it is also a migrator: RTGS and CHAPS sit on the same vendor-gated topology as Lombard’s estate.
At Lombard it is the CRO, not the CISO, who unlocks the budget, the week the insurer’s exclusion clause hits the capital model. The CISO institutes the metric later copied everywhere: share of crown-jewel data flows on quantum-safe channels, attested end to end. January 2029: 23%. Target: 90% by the end of 2030. Her private estimate: 70%, “if nothing interesting happens”. Something interesting is about to happen.
Magic states, in one paragraph
Error-corrected machines run most gates almost free, but universality requires consuming “magic states”, distilled in dedicated factory regions of the chip. Logical qubits are the registers; magic-state throughput is the clock speed. By 2029 the honest answer to “when can it break RSA?” is a function of factory acreage, not qubit count, which is why naive qubit comparisons mislead policymakers throughout the period.
Mid-2029: The Benchmark Affair
The verification gap detonates, in public, at the worst possible moment.
In June 2029 a whistleblower at Veridian Q, a second-tier vendor whose “verified 350 logical qubits” had won slices of two national programmes and a $2.1 billion order book, shows regulators that its flagship benchmarks used undisclosed classical co-processing and aggressive post-selection. The machine works. It is perhaps a 90-logical-qubit machine. It was sold as a 350. The whistleblower’s documents match, to the qubit, a number that has been in an FCA drawer since March.
The affair is quantum’s Enron in miniature, not because everyone was lying but because it reveals that nobody could have known. Every diligence process relied on benchmark data generated by the vendor, on the vendor’s hardware, scored by the vendor’s software. Audit never touched the physics. Sector equities lose a third of their value in three weeks; honest vendors fall as hard as the dishonest.
What turns a leak into an affair is three people who have never met being put in one room by a reporter who has been reading a spreadsheet for two years: a postdoc with two hundred rows, a physicist with a testbed, and a lawyer with forty-one files. Between them they can say what every diligence process in the sector could not: which numbers reproduce, which do not, and by how much. The story runs on a Sunday. By Friday nine vendors have called the Quantum Software Lab to ask to be checked first. Øresund was the first call.
Out of the wreckage, fast, because the drafts had been waiting: the UK stands up the first independent quantum verification facility on the NQCC testbed protocols, with statutory access rights; ISO/IEC fast-tracks the JTC 3 disclosure schema, in effect audited accounts for quantum machines. The facility is Whitfield’s protocols with the force of law; Aebischer’s spreadsheet, four hundred rows by now, becomes the first annex of the schema; Okafor writes the access-rights clause. “Quantum claims auditor” goes from joke to shortage occupation in six months.
And then, in August, the reason this scenario has a branch point: allied intelligence concludes the Tianshu Collective is running a 500-logical-qubit machine, eight months behind, with a magic-state factory design possibly ahead, and helium-3 procurement implying scale-up to the band by late 2031. The assessment lands the same week the verification regime is being legislated. The two instincts it triggers point in opposite directions.
| Centaurus Quantum (US) | Tianshu Collective (China) | |
|---|---|---|
| Logical qubits, best system | 800, disclosed | 500, assessed |
| Magic-state factory design | C-480 lineage | possibly ahead |
| Helium-3 procurement implies | scale-up 2030 | scale-up late 2031 |
| Can the numbers be checked | partly, from Q3 2029 | no |
Three doors
The same facts, three readings, three futures. All three are written in full.
The same brief sits on desks in Washington, London, Brussels and Tokyo: the adversary is close; our machines are close; migration is at best half done; and the public, after the Benchmark Affair, trusts no number anyone publishes.
The Transition reading. Both blocs arrive within months of each other, as every strategic race since 1949 has ended. The danger is arriving with the estate un-migrated, claims unverifiable, and no channel for managed disclosure. So: fund migration, internationalise verification as a confidence-building measure, pre-agree disclosure, treat the harvest archives as the shared time-bomb they are.
The Race reading. Verification is unilateral disarmament: we disclose, they do not. A one-year lead is decisive, read their archive before they read ours. So: classify capability data, exempt national programmes, redirect verification budgets to acceleration, treat migration as second-order.
The third reading, which nobody argues for and which happens anyway. The verified counts, once someone can check them, come in below the claims. The machine does not arrive on the 2031 timetable. The clock keeps running.
Choose your ending
All three are written from the same September 2029 state of the world. Our split, conditional on reaching this point: Transition 30, Q-Day 35, the long middle 35.
The orderly handover
Boring, expensive, and very nearly on time.
- Q4 2029Geneva Protocol signed
Logical-qubit and T-gate accounting, reciprocal inspection, a pre-agreed disclosure ladder. China publishes under its own schema. - Q1 2030Marketplaces require disclosed claims
The hyperscalers make checkable capability claims a listing condition: the referee arrives by terms of service. - Mar 2030The payment scheme finishes; UK critical systems pass 50%
Attestation is a board KPI; insurance prices it; the facility unfreezes procurement. - Jun 2030Migration above 70% in the G7
Lombard attests 81% of priority flows. - Oct 2030The band is crossed, and disclosed
A joint statement, dry as a rates decision. Markets rotate 4%. No panic. - Nov 2030Tianshu crosses, nineteen days later
The harvest archives become mutually pointless.
Q4 2029. The G7 plus Australia, South Korea and India sign the Geneva Protocol on Quantum Capability Verification: standardised logical-qubit and T-gate accounting, reciprocal inspection of declared facilities, a pre-agreed disclosure ladder for cryptanalytic milestones. China declines to join but starts publishing Tianshu figures under its own schema; opacity, Beijing concludes, now reads as imminence, and imminence invites pre-emption. The facility publishes its first annual register of checked claims in December; it is forty pages, and every row has a reproduced column.
H1 2030. The hyperscalers, who have run hybrid post-quantum key exchange on most of the world’s TLS since 2024, make disclosed capability claims a listing condition on their quantum marketplaces: the referee arrives by terms of service before it arrives by statute. Attestation makes migration a board KPI, insurance makes it a premium input, and the facility makes vendor claims checkable, which unfreezes procurement. The interbank payment scheme, the gating item for everyone, finishes in March. UK critical systems pass 50% in March, 60% by June. Lombard attests 81% of priority flows. The CISO is offered three jobs a week and stays, “to see the graph finish”.
H2 2030. Centaurus crosses the band in October with T-gate throughput sufficient for week-scale RSA-2048 runs: the Gidney configuration, real at last. Under the Protocol the milestone is announced jointly with government, dry as a rates decision: allied capability has crossed the threshold inside a monitored facility; legacy-encrypted traffic should be assumed readable by major powers from this date. Because the statement was wargamed for a year, because migration stands above 70%, and because the claim was checked by an institution built for the purpose, the market reaction is a 4% rotation, not a panic. Tianshu announces its own crossing nineteen days later. The harvest bombs are defused slowly, by becoming mutually pointless.
2031 from here. Quantum exits its trust crisis the way aviation exited its early-crash era: through boring institutions that made extraordinary machines insurable. The race was never the dangerous part. The dark was.
The silent break
Nobody announces Q-Day. It is discovered, deduced, and then it is everywhere at once.
- Q4 2029The verification regime is gutted
National-security carve-outs; the Geneva track collapses; talent and maintainers are bid into national programmes. - May 2030GCHQ sees certificate authorities being inventoried
Briefed at ministerial level, not released. The public clock still says 2035. - 14 Sep 203090,000 BTC leave wallets nobody could open
An insider’s three hours of machine time. The state cannot deny it without confirming the machine, so it says nothing. - 72 hoursThe cascade
Revocations break payment APIs; one cloud rotation script fails for eleven hours; two depositor runs; equities −19% in nine sessions. - Nov 2030The archive disclosures begin
Curated leaks of 2022 correspondence, surgically timed. Three governments in crisis. - 2031Emergency re-keying at eleven times the planned cost
Hybrid configurations fall back to classical; fraudulent ‘quantum-safe’ certification fills the gap the referee would have.
Q4 2029. The verification regime is gutted in committee: national-security carve-outs swallow the disclosure schedule and the Geneva track collapses. Capability data classifies exactly when the public stakes go vertical. Migration budgets survive on paper; the talent does not. Cryptographic engineers, and the maintainers of the four open-source libraries everyone depends on, are bid into national programmes at multiples no bank matches. Whitfield goes in November. The spreadsheet stops updating. Okafor’s files are sealed under the same carve-out. Migration, 31% at the branch, will not reach 36% by the end of 2030.
H1 2030. The race delivers. Both classified programmes push past 1,000 logical qubits by spring. In May GCHQ detects something odd: probing against UK certificate authorities, not intrusion, inventory. Someone is mapping which long-lived signing keys protect what. The assessment is briefed at ministerial level and not released. The public clock still says 2035.
14 September 2030. A Sunday. Blockchain-forensics analysts publish a thread: over six weeks, 90,000 BTC have moved out of long-dormant wallets whose keys were exposed on-chain in the format vulnerable to Shor’s algorithm, untouched for a decade, including coins universally attributed to lost keys. By Monday’s Asia open the inference is consensus: somebody has a CRQC, and has had it for at least six weeks.
No state with a CRQC would spend it on wallets; Ultra taught that lesson in 1941. The coins were moved by someone inside the programme with three hours of unlogged machine time and a list of exposed keys copied from a forensics blog, a systems contractor later named in a sealed indictment. The state cannot deny the drains without confirming the machine, and cannot confirm the machine. So it says nothing. That silence, not the theft, is the catastrophe’s engine. Absent verified disclosure every actor must assume the worst about who, since when, and what else.
Within seventy-two hours: legacy interbank traffic treated as compromised; emergency certificate revocation breaking payment APIs, update chains and airline check-ins in cascading waves; one cloud provider’s rotation script failing for eleven hours and taking a seventh of European payment APIs with it; depositor runs at two mid-tier banks. One of them, a building society in Leeds, had done everything right until its core-banking vendor slipped twice. Equities fall 19% in nine sessions. The three hyperscalers re-key the traffic they carry in nine days, which is the only reason it is not worse; estates that ran their own PKI take nine months.
Q4 2030. Emergency re-keying under panic costs eleven times planned migration and is botched in ways planning would have prevented: hybrid configurations silently falling back to classical, and fraudulent “quantum-safe” certification that the never-built verification regime existed to prevent. The archive disclosures begin in November: curated leaks of harvested diplomatic traffic, surgically timed. Three governments face crises rooted in correspondence ministers sent, encrypted, in 2022. The lesson every state draws is not “we should have coordinated”. It is “we should have run faster”.
2031 from here. The machines work, the science is glorious, and the commercial story arrives anyway, years late, at a trust discount, under emergency regulation written in anger. The commissions’ consensus is uncomfortable in its precision: the hardware was never the problem; every element of the catastrophe was a trust failure, and every one had a known fix by 2026.
The machine that does not come
As likely as Q-Day. The ending nobody writes, because nothing explodes.
Q4 2029. The UK facility opens on the NQCC protocols, Whitfield running it, and does what a referee does: it checks. Centaurus’s “800 verified logical qubits” is 520 under the schema, once idle-memory numbers and post-selection are stripped out. Tianshu’s assessed 500 is, on the best inference from procurement, nearer 300. The Geneva track stalls, not from bad faith but from arithmetic: nobody is as close as their numbers said.
2030. The C-480’s successor slips twice. Magic-state factory yield, not qubit count, is the wall, and it is a wall for everyone. NIST’s deprecation date arrives with 40% of critical systems migrated and no machine. The attestation regime bites anyway: boards sign, insurers price, the CRO’s capital model does the work the physics did not. By the end of 2031 migration stands at 58%, the credible Q-Day estimate has moved back out to 2033 or 2034, and for the first time since 2027 the arithmetic reads margin, not exposure.
2032. The danger in this ending is not a machine. It is a sentence: “it did not come”. Budgets are cut in the year the estate is 63% migrated. Two of the four open-source projects lose their funding again. The harvest archives, meanwhile, keep every byte. A secret encrypted in 2022 with a twelve-year shelf life is still a secret worth opening in 2034.
2033 from here. The band is crossed in 2033 or 2034, in a facility that may or may not be monitored, on an estate that stopped at about 70% because the deadline moved. Whether that lands as a late Transition or a delayed Q-Day is decided by whether the referee was kept funded through the years nothing happened. This is the ending a forecast has to take seriously: the threshold may not be crossed by 2030 at all, and a good decision under that uncertainty looks exactly like the one made in 2029.
Key metrics and the five forecasts
The numbers behind the narrative, the reference classes behind the numbers, and what would change our minds.
| Metric | Sep 2026 (real) | 2027 | 2028 | 2029 | 2030 · T | 2030 · Q | 2031 · C |
|---|---|---|---|---|---|---|---|
| Best logical qubits, public | 48 | 120 | 190 to 300 | 480 to 800 | 1,500, disclosed | 1,000+, classified | 720, checked |
| P(CRQC by end-2031) | 5% | 9 to 13% | 22 to 30% | 44 to 62% | crossed Oct 2030 | crossed Aug 2030 | missed |
| Critical FS systems on PQC | 4% | 9% | 13 to 18% | 26 to 38% | 74% | 35% | 58% |
| Independent verification | none | drafts | schemas agreed | first facility (UK) | treaty-grade regime | gutted by carve-outs | working, under-funded |
| Credible Q-Day estimate | 2035 | 2032 to 34 | 2031 | late 2030 | crossed | crossed | 2033 to 34 |
S1 · Hardware trajectory
Vendor roadmaps (Starling 200 logical qubits in 2029; Apollo “hundreds” in 2029 to 30), historical slippage (median twelve months, near zero for the leaders 2023 to 26), and one unplanned coding-efficiency gain every three years. Output: a 50% interval of 600 to 2,400 logical qubits at end-2030, modal 1,500. The narrative tracks the mode; the long middle tracks the lower half.
S2 · Cryptanalysis resource curve
Requirements for RSA-2048 fell a thousandfold in thirteen years (10⁹ physical qubits in 2012, 2×10⁷ in 2019, under 10⁶ in 2025) with no hardware contribution. We assume one further two-to-fourfold gain by 2030, conservative against trend. Elliptic curves fall before RSA, the under-reported fact the Q-Day ending exploits.
S3 · Migration friction
Base rates: SHA-1 deprecation twelve years; TLS 1.0 retirement ten; Y2K, the only deadline-forced success, three years of funded panic with a fixed date. PQC is harder than all three. Our seven-year tier-one estimate assumes Y2K-grade funding under attestation pressure; without it, ten to fourteen years.
S4 · Standards and verification capacity
FIPS 203, 204 and 205 took eight years from proposal to publication. Crisis compresses standards threefold (Basel III; SOX in eleven months). Hence schemas by 2028, but a statutory facility needs a scandal to force it. We supply the scandal in mid-2029; reality may be kinder, or later.
S5 · Strategic behaviour
Base rates from nuclear (four-year monopoly, then permanent parity), space, and AI chips (export controls within three years of strategic recognition). Quantum’s recognition year, on our reading, is 2027. The lean toward Q-Day over Transition, 35 against 30, reflects that every prior case chose racing first and coordinated only after a scare. The long middle gets the remaining 35 because roadmaps slip more often than they are beaten.
What would change our minds
Faster: sub-100:1 physical-to-logical before 2027; T-gate throughput growing more than tenfold a year; any state pre-announcing CRQC intent. Slower: qLDPC decoders failing at scale; correlated-error surprises in large patches; flat capital markets after 2026. Irrelevant: nothing. Even a 2040 CRQC leaves Mosca’s inequality binding for long-lived data today.
The argument, in one paragraph. Quantum computing’s decisive question is not whether the machines arrive, engineering consensus has quietly converged on “yes, roughly on roadmap”, but whether the trust infrastructure arrives first: checked claims, audited benchmarks, attested migration, managed disclosure. Every catastrophic path runs through a trust failure, not a physics failure. Whether the decade ends in a handover, a heist, or a long middle that gets forgotten is decided by the boring infrastructure built in the next thirty months, and kept funded through the years when nothing happens.
Eight terms, in plain words
| Q-Day | The day a quantum computer can break the public-key cryptography in wide use (RSA and elliptic curves). In this scenario it is deduced from evidence, never announced. |
| CRQC | A cryptographically relevant quantum computer: a machine able to run Shor’s algorithm at the scale needed to break an RSA-2048 or elliptic-curve key. “P(CRQC by end-2031)” in the register is the scenario’s consensus probability that one exists by then. |
| Logical qubit | An error-corrected qubit built from many physical qubits. The only count that matters; a headline figure that does not say “logical, with error rate” is marketing. |
| Magic states | The resource an error-corrected machine consumes to be fully programmable. The throughput of the “factories” that make them, not the qubit count, sets how fast a machine can run Shor’s algorithm. |
| PQC | Post-quantum cryptography: the NIST standards (FIPS 203, 204 and 205) designed to resist quantum attack. “On PQC” in the register is the share of critical financial systems migrated to them. |
| Harvest now, decrypt later | Recording encrypted traffic today to open it once a CRQC exists. For long-lived secrets the breach precedes the machine. |
| Mosca’s inequality | If the years your data must stay secret (Y) plus the years your migration takes (X) exceed the years until a CRQC (Z), you are already exposed. The register’s window is the gap between migration complete and the Q-Day estimate; the hollow marker shows how long 2026 data stays sensitive. |
| Official planning horizon | The year official guidance tells organisations to finish migrating by: 2035 in the UK. In the register it moves only when officials move it, which is why it can read “2035, still” while the credible estimate reads 2030. |
The most useful response to a scenario is a better one.
Every number above has a source or a stated assumption. If you can move one, we want the argument.
- NIST IR 8547 (initial public draft, Nov 2024), Transition to Post-Quantum Cryptography Standards: RSA and ECC deprecated after 2030, disallowed after 2035. csrc.nist.gov/pubs/ir/8547/ipd
- UK NCSC, Timelines for migration to post-quantum cryptography, 20 Mar 2025: discovery and plan by 2028, high-priority migration by 2031, complete by 2035. www.ncsc.gov.uk/news/pqc-migration-roadmap-unveiled
- G7 Cyber Expert Group, roadmap for the financial sector’s transition to post-quantum cryptography, 15 Jan 2026: critical systems 2030 to 2032, completion 2035. home.treasury.gov/system/files/136/G7-CEG-Quantum-Roadmap.pdf
- Bank of England, The Bank of England’s approach to innovation in artificial intelligence, distributed ledger technology, and quantum computing, 15 Oct 2025. www.bankofengland.co.uk/report/2025/the-boes-approach-to-innovation-in-ai-dlt-quantum-computing
- Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, May 2025: 1,537 logical qubits, about 898,000 physical qubits, under a week, at a 0.1% gate error rate. arxiv.org/abs/2505.15917
- Google Quantum AI, Quantum error correction below the surface code threshold, Nature, Dec 2024 (Willow). www.nature.com/articles/s41586-024-08449-y
- Quantinuum, commercial launch of Helios, 5 Nov 2025: 98 physical qubits; 48 error-corrected logical qubits with better-than-physical performance. www.quantinuum.com/press-releases/quantinuum-announces-commercial-launch-of-new-helios-quantum-computer-that-offers-unprecedented-accuracy-to-enable-generative-quantum-ai-genqai
- IBM, roadmap to large-scale fault-tolerant quantum computing (Kookaburra 2026, Cockatoo 2027, Starling 2029); two modular cryogenic units joined and cooled below 15 mK, Aug 2026. www.ibm.com/quantum/blog/large-scale-ftqc
- Quantinuum, accelerated roadmap to universal fault-tolerant quantum computing (Apollo) by 2029 to 2030, Sep 2024 and later updates. www.quantinuum.com/press-releases/quantinuum-unveils-accelerated-roadmap-to-achieve-universal-fault-tolerant-quantum-computing-by-2030
- USTC, Zuchongzhi 3.2: below-threshold surface-code error correction (distance 7, Λ = 1.40) on a 107-qubit processor, Physical Review Letters, 22 Dec 2025. quantumcomputingreport.com/ustcs-zuchongzhi-3-2-achieves-below-threshold-qec-milestone/
- Quantinuum IPO, Nasdaq: QNT, 4 Jun 2026, $1.68 billion raised at $60 a share, valuation about $14 billion. www.quantinuum.com/press-releases/quantinuum-announces-pricing-of-upsized-initial-public-offering
- Global Risk Institute and evolutionQ, Quantum Threat Timeline Report 2025 (26 experts; optimistic ten-year estimate 49%, from 34% in 2024). globalriskinstitute.org/publication/quantum-threat-timeline-report-2025b/
- DARPA, Quantum Benchmarking Initiative, Stage B selection, 6 Nov 2025: eleven companies; goal of verifying utility-scale operation by 2033. www.darpa.mil/research/programs/quantum-benchmarking-initiative/stage-b-selection
- NSA, Commercial National Security Algorithm Suite 2.0: quantum-resistant algorithms preferred from 2027, classical algorithms treated as legacy by 2030. media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF
- Mosca, M., Cybersecurity in an era with quantum computers: will we be ready?, IEEE Security & Privacy, 2018 (the inequality). ieeexplore.ieee.org/document/8490169
- UK Finance and IBM, Minimising the risks: quantum technology and financial services, Nov 2023 (the seven firm actions and why migration takes years). www.ukfinance.org.uk/policy-and-guidance/reports-and-publications/minimising-risks-quantum-technology-and-financial