Germany's BSI expects a cryptographically relevant quantum computer around 2040
1 DECEMBER 2025, BONN
Germany's Federal Office for Information Security, the BSI, estimated in December 2025 that a cryptographically relevant quantum computer could arrive around 2040. Such a machine could break the public-key cryptography that secures most systems today. The BSI describes a roughly 15-year path and notes it could compress to about 10 years if progress accelerates.
A 2040 estimate does not mean organizations can wait until then. The harvest-now-decrypt-later risk means an adversary can record encrypted data today and decrypt it once the machine exists, so any data that must stay confidential past 2040 is already exposed. The possibility that the timeline compresses to around 2035 narrows that safe window further.
The BSI's central estimate sits later than some peers. The Dutch AIVD, for instance, has said Q-Day could come by 2030. That spread across agencies reflects genuine uncertainty about the pace of quantum hardware, and it is precisely why national guidance tends to stress starting migration now rather than timing it to any single forecast.
Why it matters. The BSI's 2040 estimate, with a possible compression to 2035 or so, sets a planning horizon for German organizations without licensing delay. Because harvest-now-decrypt-later already threatens long-lived data, the relevant question is how long an organization's data must stay secret, not when a quantum computer arrives. Teams protecting data with a long confidentiality life should treat the estimate as a reason to act now.