The race to prepare our digital systems for the quantum era has already begun, and Quantum Australia is bringing the sector together while there is still time to act.
But what if we had more deadlines to meet than we first thought?
Tech-savvy readers may be familiar with the concept of “Q-Day”, or “quantum day”.
This is the moment a sufficiently powerful quantum computer is able to break much of the public-key cryptography that underpins today’s digital infrastructure — think online communications, financial transactions, digital identities, and more.
At that point, attackers could unlock encrypted information, impersonate trusted systems, and undermine the security of much of the internet as we know it. Many of the world’s largest companies are already building defences.
Google has set 2029 as its internal deadline for migrating away from vulnerable encryption, citing progress in quantum hardware and error correction. Microsoft aims to enable early adoption of quantum-safe capabilities by 2029 and complete its transition by 2033, and Amazon Web Services has published a migration plan.
On home soil, Quantum Australia, the national centre for quantum growth is helping to bring together the researchers, industry, and government that are working towards ensuring the country is ready in time.
Part of this involves convening events like the Quantum Australia Conference in Adelaide earlier this year, which drew 18 international delegations and over 800 attendees across financial services, mining, health and life sciences, defence, energy, and advanced manufacturing.
On a financial services panel discussing Q-Day at this event, HSBC’s Global Head of Quantum Technologies, Dr Philip Intallura, warned that “the time to build defences is now, we cannot take any chances”, demonstrating just how seriously many organisations are taking it.
Q-Day dominates the conversation. But there are actually two other quantum “days” that sit on the calendar well before Q-Day, requiring boards to act sooner rather than later.
R-Day: the transition timeline for quantum-safe systems
“R-Day”, or Regulation Day, is a useful shorthand for the points at which government and financial regulators set requirements or expectations for organisations to report on or achieve quantum-safe cryptographic readiness.
This day comes well ahead of Q-Day, though the name is slightly misleading: R-Day is not just one single date, but a rolling schedule of regulatory and industry-specific requirements and transition timelines that vary by country and sector.
In Australia, the Australian Signals Directorate recently incorporated post-quantum transition requirements into its Information Security Manual, which governs the protection of Australian Government systems and information.
Overseas, the US National Institute of Standards and Technology (NIST) has proposed a transition plan that deprecates quantum-vulnerable cryptographic schemes after 2030 and disallows them under NIST standards after 2035. The UK’s National Cyber Security Centre has asked organisations to complete high-priority upgrades by 2031 and finish migration by 2035.
Australia’s recommended transition timeline targets completion by the end of 2030, five years ahead of the 2035 transition endpoints proposed by NIST and set out by the UK’s NCSC.
R-Day will also land differently across sectors.
In financial services, prudential expectations will shape how banks and super funds address the issue, and APRA’s operational risk standard, CPS 230, already requires boards to oversee the effective management of operational risk.
In health, the sensitivity and longevity of patient records makes quantum-readiness particularly important. Manufacturers and mining operators will also need to consider quantum readiness in their industrial control systems and supply chain platforms.
Quantum Australia works across these same industries, developing priority use cases with the researchers and companies inside each of them.
What is consistent for all companies and boards, however, will be to begin by assessing and triaging the gaps, then building and implementing a transition plan. Australia’s post-quantum guidance recommends identifying the systems, data and cryptographic dependencies that need to transition, with priority given to critical systems and long-lived sensitive data.
But there is yet another day to consider even before Regulation Day.
H-Day: harvesting of encrypted data is happening now
H-Day or “harvest day” is shorthand for a threat that is already upon us: parties intercepting and storing encrypted data now, in the expectation that a future quantum computer may be able to decrypt it later.
In this “harvest now, decrypt later” approach, any sensitive data with a long shelf life is a target, such as intellectual property, health records, court proceedings, long-term commercial contracts, financial data held for regulatory reasons, and more.
Australia’s transition guidance names this pattern directly as a reason to act ahead of Q-Day. Q-Day is a future capability threshold. H-Day is a present-day exposure.
The seriousness of this potential breach reinforces the value of a coordinated national approach to help different regulators and sectors work from a shared understanding of the risk.
Because whether it is preparing for H-Day, R-Day, Q-Day, or anything that comes beyond these, there is one clear message underlying our nation’s response.
Organisations that treat quantum-readiness as a program of work today will be the ones prepared as the quantum timeline progresses.
Quantum Australia’s role is to help build those connections, from use-case development to connecting companies with the research base.
That conversation continues at the Quantum Australia Conference in Sydney on 16–17 February 2027, bringing together leaders from across critical industries to explore the opportunities and challenges of the quantum era.
This article was produced in partnership with Quantum Australia.
Do you know more? Contact James Riley via Email.