Forecasting the arrival of useful quantum computers

When will quantum computing have its ChatGPT moment? By this, I mean the point at which a quantum computer solves a practically relevant problem that no classical computer can solve efficiently, with results significant enough to attract attention beyond the quantum computing community. This should not be a benchmark designed to be hard for classical supercomputers like random circuit sampling, but a calculation that has some practical utility, such as the behaviour of a molecule a chemist cares about, biomolecular interactions, the properties of a new material, or, less happily, the private key behind an encrypted message.

For answering this question, we need to get a rough idea of the quantum resources required for solving practically interesting problems, and the current trajectory of quantum hardware advances. I use three complementary methods to arrive at a plausible timeline, while accounting for the uncertainties inherent in each approach. The first takes the companies at their word, but discounts each roadmap by how well that company has kept its past promises. The second works out how many physical qubits each application needs and extrapolates the historical growth in qubit counts. The third looks at each hardware platform and asks what technical problems stand between it and a useful machine. Although the three methods are not entirely independent, together they provide a reasonable estimate of the likely timeline.

The short version: I expect the first useful fault-tolerant science around 2031 to 2033, the first machine that can break today’s public-key cryptography, slowly, in the early-to-mid 2030s, and machines that change an industry in the mid-2030s. The rest of this post is how I got there and how far to trust it.

The computational cost of a quantum algorithm can be roughly characterized by the product of the number of qubits and the depth of the quantum circuit:

Here, circuit depth refers to the number of sequential layers of quantum gates required to execute the algorithm. For a given application, I estimate Q by multiplying the number of logical qubits required by the circuit’s logical depth, which I approximate using its Toffoli gate count. To execute a computation of size Q with a reasonable probability of success, the effective error rate per logical qubit per circuit layer must be on the order of 1/Q. For example, a computation with Q = 10¹¹ requires error rates of roughly one in a hundred billion. In contrast, physical two-qubit gate error rates in many existing quantum computers are around one in a thousand. This enormous gap between the error rates required for practical applications and those achievable by current hardware is one of the main reasons why large-scale quantum computations remain out of reach.

Current hardware

Current quantum computers can reliably execute circuits with roughly 10³ to 10⁴ qubit-layers. In 2026, IBM demonstrated circuits containing 7,500 gates on its 120-qubit Nighthawk processor, reaching a milestone originally targeted for the end of the year^[1,5]. This represents an improvement over its earlier Heron processors, which could execute approximately 5,000 operations in 2025^[3]. Meanwhile, Quantinuum’s 98-qubit Helios processor has achieved an average two-qubit gate fidelity of 99.921% across all qubit pairs^[4].

Increasing the number of physical qubits is no longer the only major challenge. IBM demonstrated a 1,121-qubit processor in 2023, while neutral-atom platforms have scaled to arrays containing 6,100 atoms at Caltech^[27] and approximately 11,000 atoms at Tsinghua University^[26]. However, scaling the number of qubits alone does not necessarily increase the size of computations that can be performed reliably. The more fundamental limitation is the accumulation of errors during computation. The lowest reported two-qubit gate error rates are approximately 10^-4 for trapped-ion systems^[21,22], 7×10^-4 for superconducting qubits^[24], and 1.6×10^-3 for neutral-atom systems^[26]. These figures typically represent the best individual gate performances rather than the average performance across an entire processor. At the system level, Quantinuum’s Helios achieves an average error rate of approximately 8×10^-4 across all qubit pairs^[4], Google’s Willow reports approximately 3×10^-3 for simultaneous two-qubit gates^[23], and neutral-atom systems have demonstrated parallel gate error rates of approximately 5×10^-3 across 60 atoms^[25]. At error rates of around one in a thousand, the probability of completing a circuit without an error decreases rapidly as the number of gate operations increases. Consequently, executing substantially larger computations requires improving gate fidelities or introducing quantum error correction.

Quantum error correction offers a way to overcome this limitation by encoding each logical qubit across multiple physical qubits. Provided the physical error rates remain below a certain threshold, increasing the number of physical qubits used for encoding can suppress logical errors, allowing substantially longer computations. Recent experimental progress in this direction has been substantial. In late 2025, Quantinuum demonstrated 48 logical qubits on its Helios processor. IBM and the University of Chicago reported 70 logical qubits in July 2026^[7], while QuEra demonstrated 96 logical qubits using 448 physical neutral atoms^[6]. However, these experiments were limited to relatively short computations, with effective circuit sizes Q still around 10³. Although these results demonstrate important progress toward fault-tolerant quantum computing, they remain far from the computational scale required for practical applications.

The pre-fault-tolerant era

Before large-scale quantum error correction becomes practical, an alternative approach is to extract as much computational power as possible from existing physical qubits. I refer to this as the pre-fault-tolerant era, where quantum computations are performed without full error correction, but techniques such as error mitigation and hybrid quantum-classical algorithms are used to overcome some of the limitations of noisy hardware. Error mitigation techniques attempt to reduce the effects of noise, for example, by executing circuits at different noise levels and extrapolating the results to the zero-noise limit. Hybrid algorithms, on the other hand, divide the computation between quantum and classical processors. One example is IBM’s sample-based quantum diagonalization, where a quantum processor identifies the most important electronic configurations, while a classical supercomputer solves the problem within the resulting subspace^[9]. Another promising approach is analog quantum simulation, where the natural evolution of a controllable quantum system is used to simulate the Hamiltonian of a physical system, avoiding the need to decompose the dynamics into quantum gates.

However, these approaches have fundamental limitations. For instance, in probabilistic error cancellation, the number of circuit repetitions required to compensate for noise grows approximately as e^4pG, where p is the error probability per gate and G is the total number of gates. Even if we allow a computational overhead of 10,000 times more circuit repetitions, the maximum number of gates is only approximately 2/p. This corresponds to a few thousand gates at a fidelity of 99.9%, increasing to around 200,000 gates at 99.999% fidelity. Improving gate fidelities can therefore substantially extend the reach of pre-fault-tolerant quantum computing, but the exponential overhead of error mitigation makes scaling to much larger computations increasingly expensive. Under these assumptions, the accessible computational scale remains around Q=10⁵, still several orders of magnitude below what is expected to be required for the first practical fault-tolerant applications.

Despite these limitations, recent experiments have demonstrated exciting progress in applying noisy quantum computers to scientifically interesting problems. Google’s Quantum Echoes experiment measured out-of-time-order correlators using 103 qubits on its Willow processor, with Google estimating that the computation would take approximately 13,000 times longer on a classical supercomputer^[8]. In quantum chemistry, IBM and RIKEN investigated iron-sulfur clusters using 72 qubits and 3,560 two-qubit gates on IBM’s Heron processor^[9]. Quantinuum has also studied superconducting pairing correlations in three variants of the Fermi–Hubbard model using its Helios processor, with experiments involving up to 90 qubits and lattices as large as 6×6^[10,11]. Andrew Potter has argued that some of these calculations are beginning to surpass the capabilities of leading classical methods^[12].

Neutral-atom platforms have been particularly successful in simulating quantum many-body systems. A collaboration between Harvard, QuEra, and MIT investigated the non-Abelian phase of the Kitaev honeycomb model using 104 atoms^[13]. Researchers from Innsbruck, Harvard, and QuEra observed string breaking in a two-dimensional lattice gauge theory^[14], while another QuEra collaboration studied a frustrated Shastry–Sutherland magnet using more than 110 atoms^[15]. A recent review provides a broader overview of these developments^[16]. Although these experiments demonstrate that current quantum computers are becoming increasingly capable of addressing meaningful scientific questions, most still operate within a relatively limited computational regime, roughly corresponding to Q=10³ to 10⁴. In other words, researchers are finding increasingly sophisticated ways to use the available quantum resources, but the underlying computational scale has not increased nearly as rapidly.

The fault-tolerant era

To move beyond the limitations of pre-fault-tolerant quantum computing, we need quantum error correction. The key advantage of error correction is that physical gate fidelities no longer need to improve indefinitely. Instead, physical error rates only need to remain sufficiently below a certain threshold, beyond which logical errors can be suppressed by encoding information across more physical qubits. For the surface code, the logical error rate approximately follows

where p is the physical error rate per operation, p_th ≈ 1% is the error-correction threshold, and d is the code distance. A logical qubit with code distance d requires approximately 2d² physical qubits. This means that, as long as the physical error rate remains below the threshold, we can achieve arbitrarily low logical error rates by increasing the code distance. However, the number of physical qubits required to achieve a given logical error rate depends strongly on the underlying physical gate fidelity, as illustrated in Figure 1.

The encouraging news is that all three major quantum computing platforms have already demonstrated two-qubit gate error rates below the approximate 1% surface-code threshold. However, the overhead of quantum error correction varies substantially depending on the physical gate fidelity. For example, achieving a logical error rate of 10^-13 would require approximately 1,700 physical qubits per logical qubit at a physical error rate of 1.6×10^-3, compared with only around 240 physical qubits at 10^-4, under the simplified surface-code model. Improving gate fidelity from 99% to 99.9% can therefore dramatically reduce the resources required for fault-tolerant computation. Beyond 99.99% fidelity, however, further improvements generally provide diminishing returns in terms of physical qubit overhead.

Nevertheless, achieving high gate fidelities is only one part of the challenge. Building a large-scale fault-tolerant quantum computer also requires addressing several other sources of errors that are not fully captured by average gate fidelity measurements. These include correlated errors affecting multiple qubits simultaneously, such as those caused by cosmic-ray impacts in superconducting processors, as well as leakage errors and atom loss, which require additional error-correction mechanisms. Another important challenge is real-time error decoding, where classical hardware must continuously process error syndromes and identify corrections fast enough to keep up with the quantum processor. Overcoming these challenges will be essential for scaling quantum error correction beyond small experimental demonstrations.

Another important factor is the speed at which quantum error correction can be performed. Different hardware platforms operate at substantially different timescales, which can have a major impact on the runtime of fault-tolerant algorithms. For example, Gidney’s resource estimate for breaking RSA-2048 assumes an error-correction cycle time of approximately 1 µs, resulting in a total runtime of less than a week^[18]. Superconducting quantum processors operate at timescales close to this assumption, whereas trapped-ion and neutral-atom platforms can require substantially longer cycles, potentially approaching a millisecond once gate operations, measurements, and qubit movement are taken into account. A thousandfold increase in cycle time would turn a week-long computation into one lasting nearly twenty years, while a ten-minute computation would extend to approximately one week. This illustrates an important point: achieving the highest gate fidelity does not necessarily mean that a hardware platform will be the first to perform practically useful quantum computations.

Current resource estimates suggest that many practically important quantum computing applications require roughly 1,000 to 2,000 logical qubits and anywhere from tens of millions to billions of quantum gate operations. Table 1 summarizes the estimated resources for several representative applications, including quantum simulation, cryptography, and industrial chemistry. Based on these estimates, I identify three major milestones in the development of useful quantum computers, which I use throughout the following sections to estimate when practical quantum computing might become a reality.

Milestone 1 is the first demonstration of a fault-tolerant quantum computer solving a scientifically meaningful problem that is beyond the capabilities of classical computers. One promising application is simulating the dynamics of quantum many-body systems, such as lattice models, which are already being investigated experimentally on existing quantum hardware at smaller scales.

Milestone 2 is the development of a quantum computer capable of breaking 256-bit elliptic curve cryptography (ECC-256), which is widely used to secure digital communications and cryptocurrencies such as Bitcoin. Unlike the first milestone, this represents an application with immediate practical consequences. A quantum computer capable of breaking ECC-256 within days could compromise exposed public keys and certain encrypted communications, even if it remains too slow for attacks that require near-real-time computation.

Milestone 3 represents the point at which quantum computers become capable of solving computational problems with major industrial or economic implications. Examples include breaking RSA-2048 encryption or simulating complex molecular systems relevant to industrial chemistry. One particularly important example is FeMoco, the iron-molybdenum cofactor in the nitrogenase enzyme responsible for biological nitrogen fixation. Accurately simulating such systems could improve our understanding of catalytic processes and potentially contribute to the development of more efficient industrial chemical processes.

To understand how far current quantum computers are from achieving these milestones, it is useful to compare the computational resources required by these applications with the capabilities of existing hardware. Figure 2 illustrates this comparison by plotting the number of qubits against circuit depth, revealing the substantial gap between what current quantum computers can achieve and what practical applications require.

Moving targets

Predicting when useful quantum computers will become available is further complicated by the fact that the computational resources required for practical applications are constantly changing. This is particularly evident in quantum cryptanalysis, where improvements in quantum algorithms and fault-tolerant architectures have substantially reduced resource estimates over the past decade. Interestingly, three papers published in the spring of 2026 introduced further improvements to these estimates, potentially changing the timeline for cryptographically relevant quantum computers (Table 2).

Under comparable planar surface-code assumptions, the estimated number of physical qubits required to break RSA-2048 decreased from approximately one billion in 2012 to fewer than one million in 2025^[80]. Fitting an exponential trend to these estimates suggests that the required number of physical qubits has decreased by approximately a factor of 1.7 per year. Remarkably, this is almost identical to the rate at which the largest quantum processors have been growing, approximately a factor of 1.8 per year (Figure 3). Taken together, these trends suggest that the gap between available hardware and the resources required for cryptographically relevant computations has been closing by roughly a factor of three per year. However, there is an important caveat to this extrapolation. The hardware trend is largely driven by neutral-atom arrays, which currently operate at relatively slow timescales and have not demonstrated universal gate operations across their entire arrays. In contrast, the resource estimates assume superconducting architectures with error-correction cycle times of approximately 1 µs. Consequently, the point at which these trends intersect effectively assumes a quantum computer with the qubit count of a neutral-atom platform and the operating speed of a superconducting processor. Accounting for an additional two years to develop gate-capable neutral-atom arrays shifts the projected timeline to approximately 2033 (Method 2), while the slower operating speed could increase the runtime of the computation from days to months.

The resource estimates published in 2026 suggest that progress may be even faster than these historical trends indicate. Google researchers, including Ryan Babbush and Craig Gidney, along with collaborators from the Ethereum Foundation and Stanford, presented an algorithm capable of breaking 256-bit elliptic curve cryptography using fewer than 500,000 superconducting qubits, with an estimated runtime of minutes^[17]. Rather than releasing the complete attack circuits, the researchers published a zero-knowledge proof intended to allow independent verification of the resource estimates without revealing the full implementation. Another paper from Iceberg Quantum introduced the Pinnacle architecture, which reduces the estimated physical qubit requirements for breaking RSA-2048 to fewer than 100,000 by replacing conventional surface codes with quantum low-density parity-check (qLDPC) codes^[81]. Meanwhile, Oratomic, a Caltech spin-out whose researchers include Dolev Bluvstein, Manuel Endres, and John Preskill, proposed a neutral-atom architecture capable of breaking ECC-256 using approximately 10,000 to 26,000 physical qubits, with estimated runtimes of several days^[82,84]. These newer architectures suggest that the physical qubit requirements could be one to two orders of magnitude smaller than what historical extrapolations would predict.

However, these improvements come with important architectural trade-offs. Quantum LDPC codes can encode logical information much more efficiently than conventional surface codes, with some proposed architectures achieving encoding rates of approximately 30%, compared with roughly 4% for surface codes. The main challenge is that these codes typically require interactions between physically distant qubits. Neutral-atom platforms are particularly promising in this regard because atoms can be rearranged to enable non-local interactions, whereas superconducting architectures would require additional connectivity mechanisms, such as long-range couplers. Furthermore, reducing the number of physical qubits does not necessarily reduce the total computational cost. One useful measure is the number of qubit-days, defined as the product of the number of physical qubits and the total runtime in days. For RSA-2048, this quantity decreased from approximately 1.1 billion qubit-days in 2012 to around 6 million in 2019^[79]. Interestingly, subsequent improvements have been much smaller, with Gidney’s 2025 estimate requiring approximately 5 million qubit-days and Oratomic’s fastest design requiring around 10 million. Although Oratomic’s architecture achieves a substantial reduction in the number of error-correction cycles, its assumed cycle time of 1 ms is approximately a thousand times slower than the 1 microsecond cycle assumed for superconducting processors, offsetting much of the improvement in total runtime. Craig Gidney has also suggested that another order-of-magnitude reduction may be difficult to achieve within his existing model without changing the underlying assumptions^[85]. The recent improvements therefore highlight the importance of architectural innovation rather than algorithmic optimization alone.

These developments suggest that estimating the resources required for practical quantum computing involves more than simply counting qubits. We also need to account for the connectivity of the processor, its error-correction architecture, and the speed at which operations can be performed. Google’s recent cryptanalysis estimates illustrate this distinction particularly well. Fast-clock architectures, such as superconducting or potentially photonic quantum computers, could theoretically break an elliptic curve private key within minutes, making attacks on cryptocurrency transactions before confirmation a possibility. Slower architectures, such as neutral atoms and trapped ions, may require days or months for the same computation, making them more suitable for attacking cryptographic keys that remain exposed for extended periods^[17]. Nevertheless, even a quantum computer requiring several months to complete such an attack would have significant security implications. In particular, encrypted communications recorded today could potentially be decrypted in the future once sufficiently capable quantum computers become available, provided the underlying cryptographic scheme is vulnerable to quantum attacks.

It is also important to recognize that these resource estimates depend on hardware capabilities that have not yet been experimentally demonstrated. For example, Oratomic’s proposed architecture assumes physical error rates of approximately 0.1% across more than 10,000 individually controlled neutral atoms. In contrast, fault-tolerant operations have so far been demonstrated on substantially smaller arrays, containing at most a few hundred atoms. The architecture also assumes error-correction cycle times of approximately 1 ms, whereas existing experimental systems require several milliseconds even for much smaller arrays. Furthermore, some of the proposed logical operations have only been validated through numerical simulations of smaller error-correcting codes^[82,83]. As of October 2026, these papers have not completed peer review. Although the results are promising, I therefore treat them as optimistic estimates of the minimum resources that might be required for cryptographically relevant quantum computing, rather than as predictions of the architectures most likely to be realized.

Another important factor that could accelerate the development of useful quantum computers is artificial intelligence. Recent advances in AI are beginning to automate several tasks that have traditionally required substantial effort from quantum computing researchers, including optimizing quantum circuits, discovering new quantum error-correcting codes, and decoding errors during computation. These developments could potentially accelerate the historical decline in quantum resource requirements, which has averaged approximately a factor of 1.7 per year. I examine three areas where AI could have the greatest impact.

Shorter circuits

One of the most direct applications of AI is reducing the number of quantum gates required to execute an algorithm. In 2025, researchers from Google DeepMind, Quantinuum, and the University of Amsterdam introduced AlphaTensor-Quantum, a reinforcement-learning system designed to optimize quantum circuits by minimizing the number of T gates, with their results published in Nature Machine Intelligence^[86]. For certain circuits, the system reduced the T-count by approximately 50% compared with existing optimization methods. Interestingly, it also independently rediscovered a Karatsuba-style multiplication algorithm for finite-field arithmetic used in Shor’s algorithm and reduced the T-count of circuits used to simulate FeMoco. More recently, in May 2026, Google DeepMind reported that AlphaEvolve discovered quantum circuits with error rates up to ten times lower than conventionally optimized circuits for molecular simulations on Google’s Willow processor^[87]. NVIDIA has also developed an open-source evolutionary optimization framework using CUDA-Q to discover more efficient Trotterization schemes and Hamiltonian simulation circuits^[88]. Meanwhile, general-purpose language models equipped with circuit optimization rules have demonstrated the ability to generate cryptographic circuits comparable to those developed by human experts^[89].

Although these results are promising, the improvements achieved by AI-based circuit optimization have so far been relatively modest compared with the reductions obtained through new quantum algorithms. Most demonstrations have achieved improvements of up to approximately a factor of two in gate count for a fixed algorithm. In contrast, the substantial reductions in cryptographic resource estimates discussed earlier (Table 2) resulted primarily from researchers developing new algorithms and fault-tolerant architectures, rather than simply optimizing existing circuits. Furthermore, AlphaTensor-Quantum can require several hours to optimize a single circuit and does not yet directly optimize circuit depth. Reducing the gate count by a factor of two is certainly useful, but its effect on the physical resources required for fault-tolerant quantum computing can be limited. For example, halving the number of gates approximately doubles the tolerable logical error rate, which generally produces only a modest reduction in the required surface-code distance. A potentially much larger opportunity lies in improving quantum error-correcting codes themselves.

Better codes

One of the most promising applications of AI is discovering more efficient quantum error-correcting codes. As discussed earlier, conventional surface codes require hundreds of physical qubits to encode a single logical qubit at the error rates relevant to practical applications. For example, a distance-12 surface code requires approximately 290 physical qubits per logical qubit. In contrast, IBM’s manually designed Gross code, denoted by [[144,12,12]], encodes 12 logical qubits using only 144 physical data qubits, making it approximately an order of magnitude more efficient in terms of data-qubit overhead at the same code distance.

Recent advances suggest that AI could substantially accelerate the discovery of such codes. In June 2026, IBM reported using an LLM-guided evolutionary search to discover 465 new quantum error-correcting codes belonging to the bivariate bicycle code family^[90]. One of the discovered codes, [[288,50,8]], encodes 50 logical qubits using 288 physical data qubits, substantially improving upon the previous record of 16 logical qubits within the same family, although at a lower code distance. Other discovered codes, including [[288,16,12]] and [[360,12,≤ 24]], are predicted to achieve noise tolerance comparable to IBM’s Gross code. In July 2026, researchers introduced OmniQEC, an LLM-based agent capable of proposing quantum error-correcting codes, constructing their syndrome measurement circuits, and evaluating their performance using a decoder^[91]. The system discovered qLDPC codes that outperformed IBM’s [[72,12,6]] and [[144,12,12]] codes under physical-qubit budgets of 98 and 240, respectively. Some of the high-rate codes used in Oratomic’s proposed 10,000-qubit architecture were also discovered using LLM-assisted search^[83]. Reinforcement learning has additionally been used to discover new bosonic error-correcting codes for hardware architectures with built-in error-correction capabilities^[92].

However, these results have important limitations. The newly discovered codes have not yet been demonstrated experimentally, and many high-rate quantum LDPC codes require interactions between distant physical qubits, making them difficult to implement on architectures with limited connectivity. Nevertheless, quantum error-correcting code design is particularly well suited to AI-based optimization because it involves searching through a large discrete space of possible codes, where candidate solutions can be evaluated using mathematical constraints and numerical simulations. This makes it a promising area where AI could accelerate progress beyond what traditional code-design approaches have achieved.

Faster decoders

Another promising application of AI is improving the speed and accuracy of quantum error decoding. In a fault-tolerant quantum computer, error-correction measurements continuously produce information about possible errors affecting the physical qubits. A classical decoder must process this information and determine the most likely errors, allowing the quantum computation to proceed reliably. As quantum processors become larger and faster, the computational cost of decoding becomes an increasingly important bottleneck.

In 2024, Google DeepMind introduced AlphaQubit, a transformer-based neural network trained to decode quantum error-correction syndromes, with the results published in Nature^[93]. When evaluated on experimental data from Google’s Sycamore processor, AlphaQubit achieved approximately 6% fewer decoding errors than tensor-network decoding and 30% fewer than correlated matching. However, its computational requirements made it too slow for real-time error correction. More recently, its successor, AlphaQubit 2, demonstrated the ability to decode surface codes with distances up to 11 in less than a microsecond per error-correction cycle using commercial accelerators^[94]. This is particularly encouraging because it approaches the timescales required for superconducting quantum processors.

Improving decoder performance can also reduce the physical resources required for fault-tolerant computation. A more accurate decoder can achieve a lower logical error rate for the same physical error rate and code distance, allowing a given target logical error rate to be reached using fewer physical qubits. In this sense, better decoding can provide benefits similar to improving physical gate fidelities. The importance of this problem is also highlighted by Oratomic’s recent resource estimates, where the authors identify decoder performance as one of the limitations of their proposed architecture^[82].

What it does to the forecast

The developments discussed above suggest that AI could accelerate progress toward useful quantum computers by reducing quantum circuit complexity, improving error-correcting codes, and enabling faster and more accurate decoding. However, translating these advances into a concrete prediction of when useful quantum computers will become available is more complicated.

To estimate the potential impact, I consider how the timeline would change if AI accelerated the historical reduction in quantum resource requirements. As discussed earlier, the estimated physical qubit requirements for cryptographically relevant quantum computations have historically decreased by approximately a factor of 1.7 per year. If AI increased this rate to a factor of 2.5 per year starting in 2026, the extrapolated resource requirements and hardware capabilities would intersect around 2029–2030, at approximately 37,000 physical qubits, compared with around 2031 and 74,000 qubits under the historical trend (Figure 4). Under an even more optimistic scenario, where resource requirements decrease by a factor of 3.5 annually, the intersection would occur around 2029.

However, these estimates inherit the same limitations discussed earlier. In particular, the hardware trajectory is largely driven by the increasing size of neutral-atom arrays, whereas the resource estimates often assume the much faster operating speeds of superconducting processors, as illustrated in Figure 3. Consequently, these intersections should not be interpreted as precise predictions of when cryptographically relevant quantum computers will become operational. They are better understood as indicators of how improvements in algorithms and hardware could change the timeline.

Interestingly, even substantial AI-driven improvements in quantum resource requirements shift the predicted timeline by only one or two years under these assumptions. This is partly because quantum hardware has already been improving rapidly, while recent advances in qLDPC codes have captured some of the largest potential reductions in physical qubit overhead. I therefore expect the most important contribution of AI to be accelerating the development of practically implementable fault-tolerant architectures, rather than simply reducing theoretical resource estimates. In particular, discovering high-rate error-correcting codes compatible with realistic hardware connectivity and developing decoders capable of operating at the required speeds could help turn today’s optimistic architectural proposals into working quantum computers. This is one of the reasons why I lean toward the earlier end of the predicted timelines in the conclusion.

What the companies say

One way to estimate when useful quantum computers will become available is to examine the development roadmaps published by quantum computing companies. These roadmaps provide concrete targets for the number of physical and logical qubits, error rates, and computational capabilities expected over the next several years. Interestingly, many companies anticipate reaching hundreds or even thousands of logical qubits by the end of this decade, although their proposed timelines and underlying architectures differ substantially (Figures 5 and 6).

IBM plans to introduce Starling in 2029, with 200 logical qubits capable of executing approximately 10⁸ operations, followed by Blue Jay in 2033 or later, with 2,000 logical qubits and 10⁹ operations^[2,3]. Quantinuum’s Apollo roadmap similarly targets hundreds of logical qubits by the end of the decade, with logical error rates below 10^-6[30]. Among neutral-atom companies, Pasqal targets 100 logical qubits in 2029 and 200 in 2030^[32], while Infleqtion aims to exceed 1,000 logical qubits by 2030^[33]. Google’s ambition to build a useful error-corrected quantum computer by 2029 implies a machine with perhaps a million physical qubits^[34], and PsiQuantum is developing a million-qubit photonic architecture^[35]. Oratomic, which raised $300 million in July 2026, has also expressed an ambition to build a useful machine around 2030, although it has not published a detailed technical roadmap^[84].

Other companies have published similarly ambitious targets. Xanadu, now publicly listed, aims to reach up to 200 logical qubits in 2029, 500 in 2030, and more than 1,000 in 2031, alongside plans for a quantum data centre around 2029–2030^[68]. Rigetti has not specified comparable logical-qubit milestones, but it is targeting approximately 1,000 physical qubits with 99.9% two-qubit gate fidelity within roughly three years^[62]. IonQ has announced perhaps the most aggressive roadmap, increasing from 12 logical qubits in 2026 to 8,000 in 2029 and 80,000 in 2030, with projected logical error rates below 10^-12 beginning in 2029^[29]. These projections are encouraging, but their differences also make an important point: a roadmap specifying qubit counts does not, by itself, establish that the resulting machine can run the deep circuits required for practical applications.

How the companies have done before

Company roadmaps provide a useful starting point, but they are predictions rather than demonstrated capabilities. To evaluate how much confidence to place in them, I compared public commitments made between 2017 and 2025 with what each company ultimately delivered. I focus on promises with sufficiently specific targets and deadlines to make the comparison meaningful, including both successful demonstrations and missed milestones (Figure 7 and Table 3). This is not a statistically representative sample. In particular, highly publicized failures may be easier to identify than smaller achievements that arrived on schedule, so the results should be interpreted as a rough assessment of roadmap reliability rather than a precise measure of it.

Some of the earliest predictions illustrate why these distinctions matter. In 2017, Google expected to demonstrate quantum supremacy using 49 qubits by the end of the year^[45]. The demonstration eventually occurred in 2019 using 53 qubits, approximately two years later. That same year, a Google research team suggested in Nature that early quantum computers could find commercial applications within five years^[46]. Yet in 2025, Google’s head of quantum AI again described commercial applications as being about five years away^[47]. Microsoft anticipated a working topological qubit by the end of 2018^[48], while IonQ told its stockholders in 2023 to expect a “ChatGPT-like moment” within approximately two years^[54]. The latter prediction is especially relevant because it is essentially the question I am trying to answer in this article. In the historical sample, promises involving an entirely new capability or broad commercial usefulness have generally been much less reliable than predictions about incremental hardware improvements.

The contrast becomes clearer when we examine specific hardware roadmaps. IBM’s 2020 roadmap specified the Eagle, Osprey, and Condor processors, with 127, 433, and 1,121 physical qubits, respectively, and all three were delivered on schedule^[28,36,37]. Companies have also been successful at meeting some of their own performance benchmarks. Examples include Quantinuum’s quantum-volume targets^[71], IonQ’s algorithmic-qubit milestones^[72], and QuEra’s demonstration of 96 logical qubits against a target of approximately 100 by 2026^[6,31]. These achievements suggest that near-term improvements within an established architecture can often be forecast with reasonable accuracy.

The record becomes considerably weaker when a roadmap requires a major increase in scale or a new form of hardware integration. Rigetti announced plans for a 128-qubit system within twelve months in 2018^[40], but its largest publicly described processor in this comparison reached 108 qubits only in 2026^[61]. In 2020, Xanadu anticipated roughly doubling the number of qubits available through its cloud platform every six months^[63]; extrapolating that claim would imply more than 10,000 qubits by 2025, whereas its networked gate-based Aurora system demonstrated 12 qubits^[65]. PsiQuantum’s million-qubit timeline shifted from the middle of the decade^[73], to the end of 2027^[35], and subsequently toward 2030^[74]. In all three cases, the main difficulty was not simply improving an existing component but integrating a much larger system.

Even IBM, which has one of the stronger records for delivering successive processor generations, has struggled with these transitions. Its earlier quantum-volume target of 1,024 was not achieved as planned^[49,50]. The Flamingo design, which required chip-to-chip quantum links, was demonstrated only as a proof of concept in 2024 before disappearing from the roadmap^[51]. The planned 4,158-qubit Kookaburra processor for 2025^[38] was replaced by the smaller Nighthawk architecture. I think that change may have been sensible from an engineering perspective, but it was nevertheless a departure from the original target.

There are also important differences between companies’ scientific achievements and their ability to scale those achievements into useful computers. Rigetti has delivered a succession of physical processors and commercial systems, including Novera, a 36-qubit installation at the UK’s National Quantum Computing Centre, and the 108-qubit Cepheus processor^[62]. Its near-term systems have often appeared within months of their targets, even as more ambitious qubit-count promises were missed. Xanadu has demonstrated important results with Borealis^[64], the networked Aurora processor^[65], and integrated Gottesman–Kitaev–Preskill states^[66], but its planned fault-tolerant data-centre timeline has shifted from 2029 toward 2029–2030^[67,68]. Similarly, Microsoft’s approach to topological qubits remains scientifically uncertain following the retraction of earlier work in 2021 and subsequent disputed claims^[75,76]. Taken together, these examples suggest that the most important distinction is not between companies that succeed and those that fail, but between incremental milestones and those requiring fundamentally new capabilities.

Adjusting the roadmaps

To translate this historical record into a forecast, I classify the roadmap promises in Table 3 according to the type of technical progress they require. The claims that have already reached their deadlines fall into three broad categories: incremental improvements within an existing processor family, large-scale integration or architectural changes, and the first demonstration of a new capability. The resulting comparison is summarized below. Although the sample is small, the difference between these categories is large.

The simplest approach is to accept near-term incremental targets approximately at face value and apply a delay to milestones involving major architectural changes. IBM’s Starling and Quantinuum’s Apollo are particularly interesting because they occupy both categories. Each is a continuation of a relatively successful hardware programme, but Starling requires chip-to-chip links and Apollo requires scaling from 98 trapped ions toward much larger integrated systems. These are precisely the kinds of transitions that have produced delays in earlier roadmaps. I therefore add at least two years to these two milestones, reflecting their companies’ comparatively strong delivery records while acknowledging the new engineering challenges.

For other large scale-up claims, I apply a more conservative delay of at least five years. This is motivated by the historical examples of PsiQuantum and Rigetti, where ambitious scaling targets have slipped by several years. Importantly, many of these promises have not yet been fulfilled, so the observed delays provide lower bounds rather than reliable estimates of the eventual completion dates. Where a company’s published roadmap does not extend far enough to reach a particular application, I extrapolate its stated rate of progress. Table 4 shows the resulting dates. This procedure is deliberately simple and should not be mistaken for a statistical model, but it provides a transparent way to discount optimistic industry announcements using past evidence.

Because each milestone only requires one company to succeed, I take the earliest adjusted date across the relevant roadmaps. The resulting estimates are best understood as lower bounds. For the first useful fault-tolerant scientific computation, IBM and Quantinuum both suggest a date no earlier than approximately 2031. Given their relatively strong records, I expect this milestone may follow within a few years of that date. For cryptographically relevant quantum computing, the earliest adjusted roadmaps point to approximately 2033, while the corresponding estimate for RSA-2048 or industrial chemistry is no earlier than roughly 2034. The uncertainty is substantially greater for these later milestones because every proposed route requires a large increase in scale.

A useful comparison comes from extending IBM’s more conservative roadmap beyond Blue Jay. If computational capability continues increasing by a factor of ten every four years, the resources required to break ECC-256 would not become available until approximately 2043. The contrast between this extrapolation and the early-to-mid-2030s targets illustrates how sensitive roadmap forecasts are to assumptions about scaling. My conclusion from Method 1 is therefore limited but informative: the earliest credible timelines begin after 2030, with relatively strong evidence for the first fault-tolerant scientific applications arriving earlier than the much more demanding cryptographic and industrial workloads.

The second method takes a different approach. Rather than relying on future company announcements, I use the historical growth in the number of physical qubits to estimate when machines might reach the sizes required for practical applications. Table 1 provides two sets of resource estimates for the three milestones: conventional surface-code implementations and the more optimistic 2026 qLDPC architectures, which require additional connectivity. I compare these requirements with the largest physical-qubit systems demonstrated each year.

I fit a straight line to the logarithm of the largest device size, using data ranging from 51 atoms in 2017 to approximately 11,000 atoms in 2026. This produces an estimated growth rate of about 1.8× per year, with a slope uncertainty of approximately ± 0.03 decades per year (Figure 8). The statistical uncertainty of the fitted slope is only a small part of the problem. The observations come from different hardware platforms, and the largest neutral-atom arrays are not necessarily universal quantum computers capable of executing gates across the entire array. The extrapolation also assumes that growth continues at a comparable pace for another decade. For these reasons, I assign an additional uncertainty of at least two to three years to the predicted crossing dates.

Under this extrapolation, the approximately 70,000 physical qubits required for the first milestone become available around 2031. The more optimistic 26,000-atom qLDPC design for breaking ECC-256 crosses the hardware trend around 2029, compared with approximately 2034 for a 500,000-qubit surface-code implementation. For RSA-2048, the corresponding crossing dates are around 2031 for 100,000 qubits and 2035 for one million qubits. A four-million-qubit FeMoco calculation would reach the same threshold around 2038. These are estimates for the number of physical qubits alone, before accounting for whether the hardware can perform the required computation.

The distinction between large arrays and gate-capable quantum computers is particularly important here. Atom Computing demonstrated more than 1,000 trapped atoms in 2023^[28], but high-fidelity parallel gates have been demonstrated on much smaller systems^[25], and fault-tolerant operations have not yet reached the scale of the largest arrays^[83]. I therefore introduce an additional two-year delay between reaching a given physical-qubit count and being able to use that many qubits for a fault-tolerant computation. This is a judgement rather than an experimentally measured scaling law. If the delay turns out to be longer, all of the resulting dates would shift accordingly.

After applying this correction, Method 2 predicts the first useful fault-tolerant scientific applications around 2033. For ECC-256, the estimate ranges from approximately 2031 under the optimistic qLDPC assumptions to 2036 using surface codes. For RSA-2048, the corresponding range is approximately 2033 to 2037, while a surface-code FeMoco calculation reaches the required scale around 2040. I use approximately 2033 as the central estimate for ECC-256 and 2035 for the third milestone, with an additional uncertainty of roughly two years from the growth-rate extrapolation.

This method is useful because it does not depend directly on the credibility of company roadmaps, but it also has limitations. In particular, it assumes that the resources required by practical applications remain fixed, even though cryptographic resource estimates have historically improved by approximately 1.7× per year. If this improvement continues, the requirement and hardware trends intersect around 2031 (Figure 3), subject to the architectural caveats discussed in the moving-targets section. Better physical gate fidelities could also reduce the error-correction overhead and move the dates earlier. On the other hand, physical-qubit growth alone tells us little about gate fidelity, connectivity, real-time decoding, or the time required to complete the computation. These limitations motivate the third method.

The third method examines the technical challenges facing each hardware platform rather than extrapolating a single growth curve. Although the different architectures share the same long-term goal, they have different strengths and bottlenecks. Some can perform operations very quickly but are difficult to scale, while others can control thousands of qubits but require much longer gate and error-correction cycles. I therefore assess when each platform might achieve the three milestones by considering its current capabilities, the engineering problems that remain, and the amount of progress required to overcome them.

Taking the earliest plausible result across the platforms, Method 3 suggests approximately 2030 for the first useful fault-tolerant scientific computation, 2032 for a machine capable of breaking ECC-256, and 2036 for RSA-2048 or industrially relevant molecular simulation. These dates reflect my assessment of the remaining engineering challenges, rather than a fit to historical data, and should therefore be interpreted with appropriately broad uncertainty.

The three forecasting methods provide complementary perspectives, but each fixes many assumptions that could change over time. To make these assumptions more transparent, I also developed an interactive quantitative model that combines hardware growth, improvements in gate fidelity, error-correction overhead, algorithmic efficiency, and operating speed. The model is published alongside this article so that readers can adjust the parameters and examine how sensitive the predicted timelines are to different technological developments.

I start by assuming that the number of gate-capable physical qubits grows by a factor g each year, while the growth rate itself can gradually slow by a fraction s annually as engineering constraints become more difficult. With N₀ physical qubits at the starting point, the resulting model for the available hardware size is

I then model improvements in physical gate fidelity through a time-dependent physical error rate,

where r is the annual improvement measured in decimal orders of magnitude and p_floor is a minimum achievable error rate. For an algorithm requiring L logical qubits and logical circuit depth T, I use a target logical error rate of p_L=0.1/(LT), corresponding to an approximately 90% success probability under a simplified independent-error model. I also allow algorithmic improvements, including AI-assisted circuit optimization, to reduce T by a factor a each year.

Given the physical and target logical error rates, the surface-code scaling relation introduced earlier determines the required code distance d. To account for more efficient codes, I divide the surface-code physical-qubit cost of approximately 2d² by a time-dependent efficiency factor F(t)=min(F_max,F₀c^t), where c describes the rate of improvement in code efficiency. Magic-state factories, routing, and other implementation costs contribute an additional overhead o. Finally, I approximate the runtime of the logical circuit by Tdτ, where τ is the physical error-correction cycle time. If this exceeds an acceptable runtime R_max, the model allocates additional physical qubits to parallelize the computation. Under these assumptions, the estimated hardware requirement is

The predicted arrival year is the first year in which the number of available gate-capable physical qubits exceeds the number required for the application, provided the physical error rate remains below the assumed threshold. To represent uncertainty, the model simulates 600 possible technological trajectories, varying the initial qubit count, hardware growth rate, gate-error improvements, code efficiency, code-design progress, and algorithmic improvements. The variations include a shared component, so progress in one area is partially correlated with progress in others. I also allow hardware growth to stall in one out of ten simulated futures. The output is a median arrival year, an 80% uncertainty range, and the probability of reaching each milestone by a selected date. These are model-dependent probabilities rather than experimentally calibrated forecasts.

At the default settings, I assume approximately 1,000 gate-capable physical qubits in 2026, growing at 1.8× per year. Physical gate fidelity starts at approximately 99.9% and improves by 0.1 decimal orders of magnitude annually, while error-correcting codes begin at about three times the efficiency of comparable surface codes and improve by 10% each year. I also assume a 10% annual reduction in algorithmic gate requirements and a maximum acceptable runtime of 30 days. Table 5 summarizes the central predictions for several hardware presets. The differences highlight the importance of clock speed: neutral atoms become competitive for ECC-256 under optimistic qLDPC assumptions, but their longer error-correction cycles can make RSA-2048 and FeMoco significantly more demanding under the same runtime constraint.

A useful feature of this model is that it makes the logarithmic dependence of the timeline on hardware growth explicit. If the required qubit count is fixed, the approximate time needed to close the gap between the available hardware and the target is

For example, if breaking ECC-256 requires approximately 635,000 physical qubits and the starting machine has 1,000, the gap is a factor of 635. At 1.8× annual growth, closing that gap would take approximately eleven years without further resource improvements. Raising the hardware growth rate to 3× per year shortens the interval, but the arrival date remains sensitive to the size of the initial gap. Reaching the same target before 2030 with all other assumptions fixed would require a much faster growth rate than the historical trend. Improvements in gate fidelity, error-correcting codes, and algorithm design can therefore be just as important as increasing raw physical-qubit counts. The interactive model allows these effects to be examined individually.

The model’s default predictions are broadly consistent with the three forecasting methods, generally differing by only a year or two. This agreement is useful as a consistency check, but it does not constitute independent validation because the model uses many of the same resource estimates and hardware assumptions. Its main value is to show which uncertainties matter most. In particular, the growth of gate-capable machines and improvements in error-correcting-code efficiency can shift the predicted arrival dates substantially. Gate fidelity matters greatly when physical errors remain relatively high, but its marginal benefit declines as the error rate becomes sufficiently small. The acceptable runtime also has a major effect on whether slower architectures can compete for deep cryptographic and chemistry applications. The model remains simplified: it does not fully represent correlated errors, realistic connectivity constraints, decoder latency, manufacturing yield, or the economic cost of constructing a large machine.

I now combine the results of the three approaches. Method 1 evaluates company roadmaps in light of their historical reliability, Method 2 extrapolates physical-qubit growth, and Method 3 considers the engineering challenges specific to each hardware platform. Table 6 and Figure 9 compare their predicted arrival dates for the three milestones.

Taken together, the estimates suggest that the first useful fault-tolerant scientific computation could arrive around 2031–2033, followed by a cryptographically relevant quantum computer around 2032–2035 and more demanding industrial applications in the mid-2030s. The overlap between these estimates is encouraging, but it should not be interpreted as three independent confirmations. Methods 2 and 3 use similar application resource estimates, Method 3 incorporates my judgement after examining the other evidence, and the interactive model was calibrated using the same assumptions. Method 1 also provides lower bounds rather than conventional point predictions, so agreement with a later forecast is not particularly strong evidence by itself.

Nevertheless, the three approaches expose different sources of uncertainty. Company roadmaps can fail because major engineering milestones take longer than expected. Extrapolations of physical-qubit growth can fail if scaling slows down, accelerates, or becomes less relevant than improvements in logical-qubit efficiency. Platform-level assessments can fail because unexpected technical breakthroughs remove bottlenecks, or because new obstacles emerge during system integration. The differences between the methods are therefore at least as informative as their overlap. In particular, the regression produces relatively late dates when it assumes fixed computational requirements, while the platform analysis highlights the possibility that slower neutral-atom machines could become cryptographically relevant before faster superconducting systems reach the same qubit scale.

So when will quantum computing have its ChatGPT moment? If the criterion is a fault-tolerant quantum computer performing scientifically useful calculations beyond the reach of classical methods, my estimate is around 2031–2033, potentially on machines following the IBM Starling or Quantinuum Apollo roadmaps. If the criterion is the ability to break widely deployed public-key cryptography, even with a computation lasting days or months, the early-to-mid 2030s appear plausible. If it means quantum computing transforming an industry through applications such as large-scale molecular simulation, I expect the timeline to extend further into the mid-2030s. Of these possibilities, I think a cryptographically relevant quantum computer may attract the greatest public attention, since its implications would reach far beyond the quantum computing community.

The interactive model provides a way to make these expectations more concrete. Under its default assumptions, it assigns approximately a 15% probability to the first useful fault-tolerant scientific computation occurring by 2030 and more than a 90% probability by 2035. For ECC-256, the corresponding probabilities are approximately 55% by 2035 and 95% by 2040. These values depend strongly on the assumptions built into the model and should not be mistaken for objectively measured probabilities. Nevertheless, they provide quantitative predictions against which this analysis can be evaluated as quantum hardware develops over the coming decade. The potential contribution of AI to circuit optimization, error-correcting codes, and decoding is one reason I lean toward the earlier end of the estimated ranges.

For cryptography, the practical consequences do not depend on which forecasting method proves most accurate. Even a relatively slow fault-tolerant quantum computer could threaten long-exposed private keys or encrypted communications recorded today for later decryption. Google has described a 2029 target for migrating its own systems toward post-quantum cryptography, while NIST has proposed timelines for deprecating and eventually disallowing quantum-vulnerable public-key algorithms^[85]. Organizations responsible for information that must remain confidential for many years should therefore consider the transition to post-quantum cryptography well before large-scale fault-tolerant quantum computers become available.

Finally, these estimates rest on several substantial approximations. I use Toffoli gate counts as a proxy for logical circuit depth, effectively assuming limited parallelization, and I ignore some constant-factor differences between total gate counts and qubit-layers. The resources assigned to the first scientific milestone are order-of-magnitude estimates rather than a single established benchmark. Several of the more optimistic qLDPC architectures have not been experimentally demonstrated at their proposed scale, and the roadmap adjustments in Method 1 are based on a small sample of public claims rather than a representative statistical analysis. The platform forecasts in Method 3 are explicitly my own judgement. Another important uncertainty is that the classical computational frontier continues to advance, potentially changing which quantum calculations are genuinely beyond classical reach, as illustrated by the ongoing evaluation of IBM’s recent advantage claims^[53]. I therefore view these dates as plausible ranges conditioned on current evidence, rather than precise predictions. The most useful test will be whether the assumptions underlying each forecast continue to hold as experimental progress accumulates.