When will a quantum computer break RSA?
Nobody knows, and anyone who names a year is guessing. A machine large and stable enough to run Shor's algorithm against today's key sizes needs advances in qubit quality, error correction and scale that have not been demonstrated yet. Expert surveys and vendor roadmaps give ranges, not dates, and the ranges move. Your planning does not depend on that date, though. Regulators have set their own timelines: the EU's coordinated roadmap of 23 June 2025 asks for high-risk use cases to be moved by the end of 2030, and NIST's transition guidance (NIST IR 8547, a draft in November 2024, final in October 2026) deprecates quantum-vulnerable public-key methods such as RSA and elliptic-curve cryptography after 2030 and disallows them under NIST standards after 2035. Customers, auditors and tenders will ask about those dates long before any quantum computer exists. For data that must stay secret for a decade or more, Mosca's inequality shows why waiting for the date is the wrong strategy.