Ask any board in the region what technology they are most concerned about, and the answer is the same: AI. While this concern is understandable, it is important to note that quantum computing has quietly transitioned from research papers into procurement cycles. Organisations that ignore its significance, viewing it as a problem for the 2030s, risk making a mistake that may not be recognised until it is too late to address cost-effectively.
The instinct to wait is understandable. A quantum computer capable of breaking today’s encryption probably doesn’t exist yet, and estimates for when one will vary wildly. However, this perspective overlooks two crucial points, both of which are particularly significant in this region.
The time is now
The first point is that the attack has already begun. An adversary doesn’t need a working quantum computer to steal your data today. They just need to intercept it, store it and wait. Security teams call this ‘harvest now, decrypt later’, and it is not theoretical. Now consider what the Gulf runs on: national energy infrastructure, sovereign wealth, citizen identity platforms and government communications. Much of that data remains sensitive for decades. A contract or health record captured in encrypted form this year could still do real damage when it’s finally readable in 2036.
The second point is that our region has stopped waiting, which changes the calculus for all operators there. In May, Aramco and Pasqal activated Saudi Arabia’s first quantum computer, a 200-qubit system in Dhahran, along with the Middle East’s first commercial quantum-computing-as-a-service offering. Abu Dhabi’s Technology Innovation Institute now allows researchers to access its quantum processors via the cloud, a regional first, and is collaborating with Space42 on a space-to-ground quantum communication network for the UAE. In Qatar, Al Rabban Capital has established a joint venture with Quantinuum valued at up to a billion dollars to help boost quantum computing adoption in the region. When governments invest at this scale, regulation tends to follow. GCC regulators are expected to set post-quantum migration deadlines well before the technology becomes mainstream, and firms that have not yet begun will find those timelines challenging to meet.
Preparation is key
So, what should an enterprise actually do? Nothing exotic, and certainly not buy a quantum computer. The honest starting point is a question most organisations can’t answer: where across our entire estate do we use which encryption, protect which data and for how long? For a large enterprise, building that picture typically takes a year to 18 months. That is exactly why it can’t wait.
From there, five practical steps for this quarter:
- Build a cryptographic inventory covering algorithms, certificates, keys and protocols, including third parties. You can’t migrate what you can’t see.
- Classify data by shelf life. Anything that must stay confidential beyond 2030 goes to the front of the queue, because that’s where harvest-now-decrypt-later hurts most.
- Ask every major supplier for their post-quantum roadmap, and start writing crypto-agility requirements into contracts and RFPs.
- Pilot the NIST standards, finalised back in August 2024, with clear advice to start integrating immediately. Test ML-KEM and ML-DSA in a non-critical environment and learn integration lessons while they’re still cheap.
- Give the problem an owner. Quantum readiness fails when it’s left to everyone; designate an accountable executive and report progress to the board, as with any other material risk.
The thread running through all of this is crypto-agility: building systems so that an encryption algorithm can be swapped out without re-engineering everything built on top of it. Get that right, and the quantum transition becomes a programme you manage. Get it wrong, and it becomes a crisis you react to.
Consider a typical regional bank. Decades of core banking systems, thousands of certificates, hardware security modules, payment integrations and obligations to SAMA or CBUAE on top. Migrating that estate to quantum-safe cryptography will take years, no matter what. The only real choice is whether the bank does it on its own schedule or under regulatory pressure, at a premium.
Nobody can tell you when a cryptographically relevant quantum computer will exist. But the preparation timeline is knowable, and it is long. In a region moving this quickly, the bigger risk was never acting too early. It’s finding out that a decade of your most sensitive data was harvested while you waited to be certain.
