Quantum Risk Assessment | EDHEC Quantum Institute

Why it matters

Public-key cryptography secures a large part of today’s sensitive data. This includes financial transactions, but also personal data such as medical records. It protects the connections, digital signatures and key exchanges that banks, insurers, hospitals and public services rely on every day.

A sufficiently powerful quantum computer could break the public-key algorithms most widely used today, such as RSA and elliptic-curve cryptography. No existing machine can do this, and estimates of when one might be built vary widely. The risk nonetheless applies to data exchanged today: encrypted information can be intercepted and stored now, then decrypted once such a machine exists. This scenario, known as “harvest now, decrypt later”, mostly concerns information that must remain confidential for many years, such as health records, contracts or strategic data.

The response is post-quantum cryptography: new classical algorithms, designed to resist quantum attacks, that run on today’s computers. The US National Institute of Standards and Technology (NIST) published the first standards in August 2024. In Europe, a roadmap published in 2025 by the NIS Cooperation Group, which brings together EU Member States, recommends starting the transition by the end of 2026 and migrating high-risk systems by the end of 2030.

More than a technical migration

Quantum risk is often treated as a technical migration issue, but it is more than a technical challenge. The threat has many implications for organisations: which assets are exposed, what a compromise would cost, how the migration competes with other priorities, and what regulators will expect.

Boards, as well as management and risk committees, need to assess quantum risk in their own terms in order to build and implement the right migration plan.

The Institute’s approach

The EDHEC Quantum Institute works at the interface between quantum technology and business decision-making. It is currently developing new resources for executives, aligned with emerging standards and regulation, to help organisations prepare for the quantum threat.

Beyond technical checklists and recommendations, the aim is to provide decision-makers with a practical assessment tool that makes quantum risk quantifiable.

A white paper in preparation

A white paper presenting this approach is in preparation, with publication planned for early 2027.

Get in touch

The Institute welcomes exchanges with risk and cybersecurity practitioners, regulators and researchers working on the post-quantum transition. Contact the Institute.