Why quantum computing risk has become a board-level issue

Boards and C-suites have long treated quantum computing as a future issue, but over the past year have shifted their focus. Quantum risk now comes with government deadlines, published engineering roadmaps and procurement requirements that strengthen the case for acting now, even though no machine capable of breaking today’s encryption exists. Yet.

Security experts call the point at which a quantum computer can break today’s public-key encryption “Q-Day.” Public-key encryption protects much of today’s online commerce and communications, including access to and sharing of stored data. Information stolen today can be stored and decrypted later.

In July, we covered how quantum computing and AI raise interdependent governance questions. Since then, the conversation has shifted to how organizations can reduce risk and capture quantum computing’s opportunities.

What changed recently

Several developments have shortened the planning horizon:

• Breaking encryption is getting easier. In May 2025, Google’s Craig Gidney estimated that a quantum computer could crack RSA, one of the most widely used forms of encryption, with fewer than one million qubits, down from roughly 20 million in a 2019 estimate. The gains came from improved methods, not larger machines. More recently, in March, Google researchers estimated that an even smaller quantum computer could break a different form of encryption widely used to verify digital signatures, including those for cryptocurrency transactions.
• Hardware is improving. In October, Google reported a roughly 40-fold reduction in a key type of error on its Willow chip. Both IBM and Quantinuum aim to build reliable, large-scale machines by 2029. Separately, in July, during conversations with WTW, six major manufacturers all projected machines capable of breaking RSA by 2029 or 2030, though such targets have often slipped.
• AI and quantum are reinforcing each other. As Global Transform CEO Dax Grant wrote in September, AI is helping make quantum hardware usable, while quantum computing may enable the next major advances in AI. Nvidia’s NVQLink, for example, is designed to link quantum machines to AI supercomputers to detect and correct errors in real time. This space previously covered how an AI harness, the controls around an AI model, shapes what AI can safely do. Those controls increasingly apply to quantum work.
• Governments set dates. A June 2026 U.S. executive order requires federal agencies to move elements of their most important systems to quantum-safe encryption by 2030 to 2031. It also calls for a rule extending requirements to federal contractors. The U.K. targets full migration by 2035. The EU wants member states to start by the end of 2026, and France will stop certifying security products that aren’t quantum-safe in 2027.
• Capital followed. McKinsey reports that quantum investment reached $12.6 billion in 2025, about six times more than 2024.

Timelines remain uncertain. Quantum computers are fragile. Many leading designs must be kept colder than deep space and shielded from vibration and interference. Their qubits hold information only briefly and run slowly compared with conventional computers. Google’s Willow chip has 105 qubits, far fewer than the hundreds of thousands estimated to be needed to break encryption.

Quantum debt

Writing recently in Forbes, Anri Amir described quantum debt as the gap between quantum technology’s potential impact and an organization’s preparedness. Quantum debt includes insecure cryptography, data leakage, skill gaps, vendor hype and strategies that treat quantum as a distant concern. New systems built on vulnerable cryptography, vendor contracts without migration commitments and sensitive records transmitted under today’s standards all increase that debt.

In harvest-now, decrypt-later scenarios, stolen information that remains sensitive for years, such as government identification numbers, health records, intellectual property, AI models, deal files, benefits data and long-dated contracts, could be decrypted years after it was taken.

Most organizations have yet to measure or mitigate this debt. Bain & Company research found that fewer than 40% of large enterprises thoroughly inventoried their cryptography, and only 9% of technology leaders report a defined roadmap. As WTW’s Sonal Madhok and Dr. Anat Lior have noted in discussing AI, technology losses often fall across a patchwork of insurance policies. A breach discovered years after data was harvested raises numerous questions about policy coverage and liability.

The opportunity of quantum

McKinsey estimates quantum computing could create $1.3 trillion to $2.7 trillion in value by 2035. Early applications include chemistry and materials, optimization, logistics, and financial and risk modeling. WTW has explored quantum approaches to risk modeling since a 2019 collaboration with Microsoft.

Many organizations are starting small, testing a few high-value opportunities and building enough expertise to recognize when quantum offers a meaningful advantage.

How leading organizations address quantum risk

• A cryptographic inventory: They map where encryption is used across applications, devices, vendors and data flows. The U.S. order’s call for cryptographic bills of materials suggests suppliers will increasingly be asked to provide inventories of their cryptography
• Data ranked by shelf life: They identify information that must remain confidential for a decade or more and sequence migration accordingly
• Applications and platforms upgraded: For vendor-supplied systems, they press vendors for post-quantum-ready releases. For software built in-house, they budget for internal teams to do the upgrades
• Crypto-agility by design: New systems are built so algorithms can be replaced without redesigning the systems as standards change
• Quantum provisions in third-party contracts: Procurement teams request vendor migration timelines and build post-quantum requirements into renewals
• Risk transfer reviewed for delayed losses: Risk and insurance teams assess how insurance coverages such as cyber, technology errors and omissions, and directors’ and officers’ insurance would respond if data stolen today were decrypted years later
• Named ownership and regular reporting: A named executive owns the program, and a board committee tracks quantum debt through a few measures such as inventory coverage, priority systems migrated and vendor readiness. NACD’s 2026 cyber-risk oversight toolkit includes a quantum discussion guide for directors

For a fuller roadmap, a paper by WTW’s Mark Beardall for the U.K. National Preparedness Commission outlines practical steps and links to official U.K. and U.S. guidance.

Questions boards are asking

• How large is our quantum debt, and is it growing or shrinking?
• Which of our data must remain secure for the next decade, where does it reside and will vendors or internal teams upgrade those platforms?
• Which customers, regulators and partners will expect post-quantum readiness from us first?
• Where could quantum create advantage for us, or for our competitors?

A risk worth addressing early

Q-Day has no fixed date, but the deadlines around it do. As with AI, outcomes depend less on the technology than on how leaders govern it, set safeguards, pace their response and steadily reduce quantum debt while preparing to capture the upside.

A version of this article originally appeared on Forbes on October 30, 2026.