Q-Day comes early?

For technologists, tech-lawyers and cybersecurity experts the prospect of Q-Day (the day on which the so-called “quantum threat” of quantum computers being able to crack most modern cryptography actually happens) is one that seems both far off but also a very real prospect. So much so that bodies such as the G7 and the UK’s Financial Conduct Authority and National Cybersecurity Centre have been recommending that organisations take steps to ensure that their systems are “hardened” against the threat posed by quantum computing breaking existing cryptographic technology for some time while in the US the National Institute of Standards and Technology published its first guidance as long ago as 2024.

This process is ongoing but for most organisations, the key question is what can they do now? As noted below, there is lots to do now both in terms of raising awareness of the risk and protecting against it. 

Meanwhile, as the Financial Times reported on 28 October 2026, the academic and tech-nerd discourse about Q-Day (and protecting against it), may, depending on your point of view, suddenly become moot or very timely. As everyone knows, AI models are solving complex mathematical problems at an astonishing rate. The algorithms on which modern cryptography depends are, in essence, complex mathematical problems.

“Advances in AI threaten to crack cryptographic tools used to shield digital data, triggering a scramble to ensure mainstream existing methods and planned next-generation safeguards are secure.”

Financial Times

As the FT reports, it is surely only a matter of time before an AI Lab (or a bad actor deploying AI technology) develops a way to achieve a quantum threat level of breakthrough while relying on classical computing technology.

What to do now?

In light of the double threat of Q-Day and AI tooling expediting a Q-Day like threat, and as recommended by the FT, it makes sense for organisations to expedite their Q-Day planning and look to harden their systems against very powerful AI agents. Failure to do so will not only expose organisations to cybersecurity breaches but also to regulatory investigations, particularly if they have failed to consider and adapt to the risks posed by not only the potentially far off quantum threat but also the more immediate threat posed by AI tools. 

Data minimisation is the cheapest form of defence. It has the advantage, where the data is also ‘personal data’ of aligning with one of the key GDPR principles, namely, that personal data you have securely deleted cannot be harvested, so shorter retention timelines directly reduce exposure.

This approach could be applied to encrypted data (that organisations might feel is safe now, before Q Day) as well as less protected datasets.

Other defences to start addressing now, as the NCSC guidance suggests, relate to discovery and planning. The current guidance is that by 2028 organisations should have, completed a full discovery exercise of their potentially exposed assets and build an initial plan to address identified vulnerabilities.

In light of the pace of AI models’ ability to solve mathematical problems, it would seem sensible to expedite that discovery process.