The threat could arrive before quantum computers are commercially useful, and member states have until the end of 2026 to plan for it.