Q-Day and the international legal order: international law implications of quantum cybersecurity disruption

Q-Day refers to the point at which a sufficiently powerful quantum computer can break widely used encryption methods, exposing diplomatic, military, financial and personal data to decryption at scale. This article asks whether existing international legal frameworks are adequate for such disruption and argues that they are insufficient. It shows that current regimes, including the Budapest Convention, the Wassenaar Arrangement, the Tallinn Manual 2.0 and international human rights law, provide only partial and indirect coverage of quantum-enabled cyber risks. The article also compares the United States, China and the European Union to show that post-quantum cryptography (PQC) is developing through fragmented national and regional strategies, creating a cybersecurity weakest-link problem in an interconnected digital environment. It argues that the emerging risk of ‘PQC sovereignty’ may deepen fragmentation unless states coordinate standards and legal responses. Preserving cybersecurity and legal stability in the quantum era therefore requires a coordinated international response combining rapid migration to PQC, interoperable standards, and new legal instruments or agreed norms to address quantum-specific vulnerabilities.