Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four quantum risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence.

5 min read0 figures1 table21 notesNR-XTECH-QUANTUM-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Quantum is infrastructure and a cryptographic deadline
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Long-lived data exposure while migration is slow
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. InferredEQL 4RSK-XT02-CRY-001

    Cryptographic transition lag

    Driver
    falling resource estimates and slow migration13
    Exposure
    long-lived sensitive data; signatures on long-life devices
    Vulnerability
    inventory gaps; embedded and legacy systems
    Capacity
    standards, roadmaps and migration guidance3636
    Cascade
    DAT → FIN, HLT, INF
    Horizon
    1 to 10 years

  2. InferredEQL 3RSK-XT02-HEL-002

    Helium and helium-3 supply chokepoint

    Driver
    market disruption and scarce helium-31013
    Exposure
    dilution-refrigerator hardware; research labs
    Vulnerability
    few suppliers; no large reserves
    Capacity
    recycling; alternative cryocoolers; reserves13
    Cascade
    MIN → INF
    Horizon
    1 to 5 years

  3. Expert inputEQL 2RSK-XT02-INF-003

    Hardware progress faster than planned

    Driver
    rapid improvement in error correction and estimates1239
    Exposure
    planning assumptions of operators and regulators
    Vulnerability
    fixed migration schedules
    Capacity
    cryptographic agility; monitoring of milestones
    Cascade
    INF → DAT → FIN
    Horizon
    1 to 5 years

  4. InferredEQL 3RSK-XT02-GOV-004

    Fragmented controls and capability concentration

    Driver
    export controls, national strategies and concentrated fabrication217
    Exposure
    research collaboration; supply chains
    Vulnerability
    uneven access to hardware, skills and materials
    Capacity
    strategies, roadmaps and standards718
    Cascade
    GOV → INF, FIN
    Horizon
    1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence for quantum at the global level.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSpost-quantum standards and migration guidance published336
Monitoring and observationLISTEDno common tracker of hardware claims or migration progress
Early warningLISTEDmilestone watching by agencies is not consolidated
Preparedness and planningEXISTSEU roadmap and US directives56
Redundancy and reservesLISTEDhelium and helium-3 reserves are not documented13
ResponseLISTEDno tested response to a sudden capability change
Continuity of critical servicesLISTEDmigration of critical systems not yet reported
RecoveryLISTEDnot applicable at baseline; no event to recover from
AdaptationEXISTScryptographic agility is part of the NIST guidance35
Social protectionLISTEDnot applicable at baseline
Finance and insuranceEXISTSprivate investment large; public finance share small in 202511
Institutional coordinationEXISTSstandards bodies and national strategies7182223
Technical infrastructureEXISTScryogenic and fabrication base growing833
WorkforceLISTEDskills gaps reported; no figure bound
Research capacityADEQUATEstrong peer-reviewed base2254041
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 1Gidney, C., How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917, submitted 21 May 2025. arXiv, Ithaca. Observation year 2025. Accessed 2026-11-03.back
  2. 3NIST (ed.), NIST releases first 3 finalised post-quantum encryption standards (news release, 13 August 2024; FIPS 203, 204, 205). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  3. 6European Commission (ed.), Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (library page; roadmap published 23 June 2025; page updated 3 September 2026; the roadmap milestones were not on the page). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2025. Accessed 2026-11-03.back
  4. 36UNVERIFIED, not opened: CISA, NSA and NIST (eds.), Quantum-Readiness: Migration to Post-Quantum Cryptography (factsheet), August 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
  5. 10IEA (ed.), Global Critical Minerals Outlook 2026 (revised version, July 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
  6. 13UNVERIFIED, not opened: War on the Rocks (ed.), The supply chain chokepoints in quantum (October 2025), and CNAS (ed.), report on helium-3 recovery and reserves (March 2026), taken from search-result summaries. Observation year 2026. Accessed 2026-11-03.back
  7. 2Google Quantum AI and collaborators, Quantum error correction below the surface code threshold, Nature 638, 920 to 926, 2025 (preprint arXiv:2408.13687, August 2024). Springer Nature, London. Observation year 2024. Accessed 2026-11-03.back
  8. 39UNVERIFIED, not opened: Bravyi, S. et al., High-threshold and low-overhead fault-tolerant quantum memory, Nature 627, 778 to 782, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
  9. 21UNVERIFIED, not opened: US Department of Commerce Bureau of Industry and Security (ed.), interim final rule on export controls for quantum computing items, September 2024, cited from memory. BIS, Washington. Observation year 2024. Accessed 2026-11-03.back
  10. 7European Commission (ed.), Quantum policy page (Quantum Europe Strategy adopted July 2025; Quantum Act planned for 2026; Quantum Technologies Flagship EUR 1 billion from 2018; EuroHPC quantum computers EUR 100 million, October 2022). Directorate-General for Communications Networks, Content and Technology, Brussels. Observation year 2026. Accessed 2026-11-03.back
  11. 18UNVERIFIED, not opened: ISO and IEC (eds.), Joint Technical Committee ISO/IEC JTC 3, Quantum technologies, committee established 2024, cited from memory. International Organization for Standardization, Geneva. Observation year 2024. Accessed 2026-11-03.back
  12. 5POST-CLOSE, context only: NIST (ed.), Transition to Post-Quantum Cryptography Standards, NIST IR 8547, final (publication page; document history 27 October 2026, after the 30 September evidence close; abstract refers to Executive Order 14412 and OMB Memorandum M-26-15). National Institute of Standards and Technology, Gaithersburg. Observation year 2026. Accessed 2026-11-03.back
  13. 35UNVERIFIED, not opened: NIST National Cybersecurity Center of Excellence (ed.), Migration to Post-Quantum Cryptography, NIST SP 1800-38, cited from memory. NIST, Gaithersburg. Observation year 2023. Accessed 2026-11-03.back
  14. 11UNVERIFIED, not opened: McKinsey and Company (ed.), Quantum Technology Monitor 2026 (startup investment USD 12.6 billion in 2025, 6.3 times 2024; company revenues above USD 1 billion; about 97% private funding), taken from search-result summaries; the chart page returned a service error. McKinsey and Company, New York. Observation year 2025. Accessed 2026-11-03.back
  15. 22UNVERIFIED, not opened: Government of Canada (ed.), National Quantum Strategy, January 2023, cited from memory. Innovation, Science and Economic Development Canada, Ottawa. Observation year 2023. Accessed 2026-11-03.back
  16. 23UNVERIFIED, not opened: UK Government (ed.), National Quantum Strategy, March 2023, cited from memory. Department for Science, Innovation and Technology, London. Observation year 2023. Accessed 2026-11-03.back
  17. 8IBM (ed.), IBM Quantum technology and roadmap page (Nighthawk 120 qubits; Starling planned for 2029 with 200 logical qubits and 100 million gates; statement on advantage in 2026). IBM, Armonk. Observation year 2026. Accessed 2026-11-03.back
  18. 33UNVERIFIED, not opened: Krinner, S. et al., Engineering cryogenic setups for 100-qubit scale superconducting circuit systems, EPJ Quantum Technology 6, 2, 2019, cited from memory. Observation year 2019. Accessed 2026-11-03.back
  19. 25UNVERIFIED, not opened: Preskill, J., Quantum computing in the NISQ era and beyond, Quantum 2, 79, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back
  20. 40UNVERIFIED, not opened: Campbell, E.T., Terhal, B.M. and Vuillot, C., Roads towards fault-tolerant universal quantum computation, Nature 549, 172 to 179, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03.back
  21. 41UNVERIFIED, not opened: Ladd, T.D. et al., Quantum computers, Nature 464, 45 to 53, 2010, cited from memory. Observation year 2010. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Exponential Technology Report 2026: Quantum Technologies (Baseline Edition 2026, Report No. NR-XTECH-QUANTUM-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Quantum Technologies.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices