◇FIELDNOTES / QUANTUM
Technology · institutions · public interest

Governing the quantum transition

A research-based guide to the policy choices, technical evidence, safeguards, and public responsibilities shaping quantum technologies.

Why now

Quantum is not one technology or one policy problem. Computing, sensing, and communications have different maturity levels and routes to impact. Governance should match those differences, stay proportionate to evidence, and include people who may be affected. An international policy baseline is emerging: the OECD Council adopted its Recommendation on Quantum Technologies on 28 May 2026.

The governance problem

Four decisions need different tools

“Quantum” is not a single regulatory category. The practical task is to select the right instrument for each use and make someone accountable for the result.

01 / INNOVATION

What public problem merits support?

Prioritize research and procurement by demonstrated need, plausible benefit, and a credible path from laboratory results to real-world use.

02 / RIGHTS & SAFETY

Who is observed or affected?

Quantum imaging, sensing, and timing can change what is measurable. Apply privacy, safety, data, and sector rules to the actual deployment.

03 / SECURITY

Which threat is being addressed?

Separate today’s post-quantum cryptography migration from longer-term quantum computing risks and specialized QKD networks.

04 / STRATEGIC CONTROL

What needs protection or cooperation?

Screen sensitive acquisitions and suppliers where required; preserve standards work, research exchange, workforce access, and international interoperability.

Current international baseline: the OECD Council adopted a Recommendation on Quantum Technologies on 28 May 2026. Its policy principles cover rights and public benefit, secure access, collaboration, and accountability. Read the Recommendation ↗
Public governance agenda · OECD/LEGAL/0508

Five jobs for quantum policy

The OECD Council’s 2026 Recommendation turns shared principles into five national policy tracks. Here is a practical way to read them: what public institutions can do, and what citizens can ask them to show.

01 / ANTICIPATE

Assess opportunities and risks against evidence

Commission forward-looking assessments that distinguish demonstrated capabilities from forecasts. Set baselines and measurable indicators suited to each technology’s maturity. Include public benefit, privacy, security, safety, misuse, and national-security implications; state assumptions and revisit dates.

Public test Can people see what was tested, what remains speculative, who bears the risk, and what evidence would change the decision?

02 / ENABLE

Build an ecosystem with public purpose

Support research, shared infrastructure, translation, and commercialization with transparent goals. Map public and private actors, dependencies, and needs. Bring industry, researchers, standards bodies, public buyers, and affected communities into decisions about standards, interoperability, competition, and safeguards.

Public test Are public investments tied to stated benefits, evaluation criteria, and a route to interoperability?

03 / BUILD SKILLS

Grow a broad, multidisciplinary workforce

Plan for researchers, engineers, technicians, security and privacy specialists, product teams, procurement staff, and regulators. Develop education, hands-on training, retraining, and pathways that include people from varied backgrounds; make technical expertise available to public decision-makers.

Public test Are skills gaps, training routes, regulator capability, and participation being tracked as the field changes?

04 / SECURE

Strengthen supply chains and research security

Identify critical components, concentrated capabilities, single points of failure, and supplier dependencies. Build resilience through diversification and trusted partnerships. Apply proportionate research-security and technology-protection measures to specific risks, with named owners and review points.

Public test Can institutions explain which dependencies matter, what safeguard addresses each risk, and when restrictions will be reviewed?

05 / COOPERATE

Keep international collaboration workable

Develop common standards and benchmarks, exchange information on mutually agreed terms, coordinate research on shared challenges, and build capacity with international partners. Keep cooperation transparent and consistent with rights, security, and the other principles in the Recommendation.

Public test Which standards and partnerships help people share benefits safely across borders?

How to read this section: OECD/LEGAL/0508 sets four principles for governments and other actors, plus five policy tracks directed to adhering governments. Governments implement those tracks through their own legal and institutional systems. These public tests are this guide’s practical translation; they are not official OECD indicators or a single global quantum law. Read the full OECD Recommendation ↗

Research context: OECD Quantum Technologies Policy Primer (2025) · OECD review of national quantum strategies (2025).

International policy · comparative view

Quantum governance has several layers

Countries use strategies, executive direction, sector regulation, investment programmes, and technical standards for different jobs. These instruments do not carry the same legal force or govern the same risks.

SHARED POLICY GUIDANCE / OECD

Agree on principles, leave room for national implementation

The OECD Council’s 2026 Recommendation sets four principles for governments and other actors, then five national policy tracks for adhering governments. It creates a common reference for rights, security, collaboration, accountability, foresight, workforce, and supply chains; it is not a uniform product-approval regime.

Governance question How will each government turn shared commitments into funded, assigned, and reviewable domestic work?

OECD/LEGAL/0508 ↗
INDUSTRIAL COORDINATION / EUROPEAN UNION

Build shared infrastructure and reduce fragmentation

The EU Quantum Europe Strategy, adopted in July 2025, groups action around research, infrastructure, ecosystem and supply chains, dual-use capabilities, and skills. The Commission describes a Quantum Act as forthcoming; on 30 October 2026 its implementation tracker still classified the Act as planned, so the strategy and future legislation must be treated as different instruments.

Governance question Will common infrastructure and funding reduce fragmentation while preserving transparent access, public-interest safeguards, and clear legal duties?

EU Quantum policy page ↗ · Commission implementation tracker ↗
APPLICATION-LED OVERSIGHT / UNITED KINGDOM

Prepare sector regulators before use cases mature

The UK government accepted a regulation-by-application approach led by sector regulators. Its response emphasizes coordination, horizon scanning, training, standards, and regulatory involvement in testbeds, then calls for proportionate measures when a concrete application exposes a genuine gap.

Governance question Which regulator owns the use case, and what evidence would show that existing rules do not cover it?

UK government response ↗
WHOLE-OF-GOVERNMENT MOBILIZATION / UNITED STATES

Connect deployment, supply chains, workforce, and security

Executive Order 14413, issued 22 June 2026, directs U.S. agencies to accelerate quantum computing, sensing, and networking, including plans for sensor deployment, supply-chain analysis, standards uptake, workforce development, and international engagement. It directs the federal executive; it is not a universal product code for every quantum operator.

Governance question Are agency deadlines, procurement choices, security restrictions, and public benefits reported and reviewed together?

Executive Order 14413 ↗
TECHNICAL COORDINATION / ISO & IEC

Make performance and interfaces comparable

IEC/ISO JTC 3 coordinates technical standardization across quantum computing and simulation, metrology, sources and detectors, and communications. Shared terminology, test methods, and interfaces can support comparison and interoperability. A technical standard does not by itself authorize a deployment; legal duties attach through applicable law, regulation, procurement, or contract.

Governance question Who helped define the benchmark, which conditions does it cover, and can an independent lab reproduce the result?

IEC/ISO JTC 3 scope and work groups ↗
Comparative evidence: the OECD’s December 2025 review counted formal strategies in 18 OECD Member countries plus the EU as of November 2025, while finding major differences in governance structures and performance indicators. It reported an estimated USD 55.7 billion in government commitments since 2013, but warned that announcement-based totals may include expected programme budgets, earlier allocations, and non-government funding. Treat that figure as an estimate of announced commitments, not audited quantum-only spending. Read the OECD comparative review ↗
Hard choices · make the trade-off visible

Four tensions need explicit decisions

These choices affect who benefits, who carries risk, and whether public claims can be checked.

01 / PERFORMANCE VS. PUBLIC VALUE

Count qubits, or measure outcomes?

Hardware counts can describe a component, but not usefulness, error correction, uptime, field accuracy, affordability, or social benefit. Track technology readiness alongside validated task performance, adoption, skills, and outcomes for the public purpose being funded.

Ask for a named use case, a classical baseline, test conditions, independent results, and outcome measures.

02 / OPEN RESEARCH VS. SECURITY

Protect specific risks without closing ordinary science

Some components, data, or know-how may have security implications. Broad or vague restrictions can also weaken collaboration, talent exchange, and scientific scrutiny. State the sensitive asset, threat pathway, control, responsible authority, and review date.

Ask for a risk-specific rationale, appeal or review route, and a record of what remains openly shareable.

Control-design caution: the OECD’s 2025 review reports export restrictions using a 34-qubit cutoff, while noting that experts questioned whether this threshold maps to a meaningful security risk. A control should explain the capability and threat it addresses, then be reviewed as evidence changes. OECD discussion ↗

03 / RESILIENCE VS. INTERDEPENDENCE

Reduce critical dependence without building needless silos

Quantum systems rely on specialized components, materials, fabrication, software, and skilled suppliers. Diversifying a real single point of failure can improve resilience; duplicating every capability nationally can raise cost and fragment standards.

Ask for a dependency map, realistic alternative suppliers, interoperability plans, and the cost of proposed localization.

04 / STRATEGY VS. ENFORCEABLE DUTY

Know when a policy promise becomes a legal obligation

A strategy sets direction; a recommendation records shared policy guidance; a standard defines technical practice; a regulation or statute can impose legal duties. Their force depends on the instrument and jurisdiction. A pilot or government strategy is not, by itself, permission to deploy in a regulated sector.

Ask for the exact legal basis, applicable regulator, affected parties, enforcement route, and next review date.

First, distinguish the technologies

One field, different governance questions

Computing, sensing, communications, and cryptographic migration have different maturity, operators, and public risks. Governance should attach to the use case and system boundary.

A / COMPUTING

Special-purpose computation

Quantum computers may eventually solve some tasks that are difficult for classical machines. Near-term governance centers on realistic claims, research integrity, dual use, access, and preparing cryptography for a future capable machine.

B / SENSING & METROLOGY

More precise measurement

Quantum sensors can improve measurement of time, fields, acceleration, or other physical quantities. Consider safety-critical reliability, sensitive location or activity data, surveillance, and who controls the resulting measurements.

C / COMMUNICATIONS

New ways to distribute information

Quantum communication research includes quantum key distribution and future network components. Evaluate end-to-end system security, implementation flaws, cost, standards, and interoperability; quantum links do not automatically secure endpoints or applications.

Important distinction: post-quantum cryptography (PQC) is a set of cryptographic methods designed to resist attacks from future quantum computers. It runs on conventional computers. It is a defensive migration, not itself a quantum technology.
Use-case dossiers

Regulate the application, test the claim

The UK Regulatory Horizons Council found quantum products span sectors and readiness levels. It recommended application-specific oversight, using existing sector regulators and frameworks where they fit, while building regulatory capability early.

UK government response to the Regulatory Horizons Council ↗
01 · GRAVITY SENSING

Underground asset mapping

What is being proposed: measure small gravitational variations to infer underground structures, supporting infrastructure surveys or environmental monitoring. The UK review describes underground geophysical survey and methane leak detection as possible applications.

Governance gate: require independent field validation against conventional survey methods across soil, depth, weather, and site conditions. Record error rates and false positives; set human review and escalation procedures before outputs affect excavation, utilities, or safety decisions. The review flags that efficacy and user confidence are barriers to market uptake and points to independent testing by the National Physical Laboratory.

02 · QUANTUM IMAGING

Imaging through obscurants

What is being proposed: image in difficult conditions such as fog, smoke, or darkness. The UK review identifies security and surveillance as a possible use and explicitly raises privacy concerns.

Governance gate: treat the output as sensitive observation data. Before a pilot, document the legal purpose, field of view, locations and people exposed, retention period, access controls, and deletion process. A capability demonstration is not authorization for routine surveillance.

03 · TIMING & NAVIGATION

Resilience when satellite signals fail

What is being proposed: quantum clocks or inertial sensors may support position, navigation, and timing when GNSS is degraded or unavailable. That matters to aviation and critical infrastructure.

Governance gate: test drift over time, calibration, vibration and temperature sensitivity, integration with existing systems, and failover behavior. Define required holdover time and acceptable error for the actual sector; do not equate “satellite independent” with “failure proof.” The UK review calls for standards, benchmarks, and validation to support uptake.

04 · QUANTUM COMPUTING

Research access and commercial claims

What is being proposed: acceleration of specific simulations or optimization tasks, not a general replacement for classical computing. Near-term buyers may encounter cloud access, vendor roadmaps, and claims of advantage.

Governance gate: require a named workload, a strong classical baseline, end-to-end runtime including data loading and error correction, reproducible results, and cost/energy estimates. Separate demonstrated results from future fault-tolerant projections in procurement and public funding decisions.

Use-case evidence: Regulatory Horizons Council, Regulating Quantum Technology Applications (2024), with sensing, timing, imaging, and computing chapters.

Why this is specific: the UK government accepted a regulation-by-application approach because quantum products enter different markets and raise different risks. It calls for regulators to assess gaps as applications mature, rather than imposing one cross-cutting quantum rule now. This is a UK policy position, not a universal legal rule.
Technical governance · cryptography

PQC migration is an inventory and engineering programme

Quantum computing creates a specific future risk to widely used public-key cryptography. The practical governance problem today is finding every dependency and moving safely before systems, vendors, and data lifetimes make the change urgent.

The standards baseline

NIST’s 2024 finalized standards cover two functions: ML-KEM (FIPS 203) establishes shared keys; ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) provide digital signatures. PQC uses conventional computers. It is separate from quantum key distribution.

NIST PQC standards and project status ↗
STEP 1 / FIND CRYPTO

Inventory by function and dependency

Map where public-key cryptography protects key establishment and signatures: TLS, VPNs, identity and certificates, code signing, email, device firmware, cloud services, backups, and supplier products. Include embedded and end-of-life equipment.

STEP 2 / PRIORITIZE EXPOSURE

Use data lifetime and migration time

Prioritize information whose confidentiality must last for years, systems that are hard to update, broad trust infrastructure such as PKI and code signing, and critical services with long procurement or recertification cycles. “Harvest now, decrypt later” applies to sensitive encrypted data collected now.

STEP 3 / TEST THE CHANGE

Measure interoperability and operations

Test certificate and signature size, handshake latency, bandwidth, memory, hardware limits, protocol negotiation, validation requirements, and vendor support. A mathematically sound algorithm can still fail operationally when systems cannot exchange or verify the new artifacts.

STEP 4 / DESIGN FOR CHANGE

Build crypto agility

NIST defines crypto agility as replacing algorithms across protocols, apps, software, hardware, firmware, and infrastructure while preserving security and operations. Make algorithms configurable, track ownership and expiry, and rehearse a rollback or next migration.

Do not turn federal dates into a global deadline: NIST IR 8547 supports U.S. federal migration milestones, including accelerated 2030 key-establishment and 2031 digital-signature targets for specified high-value systems and a broader 2035 target. Organizations elsewhere should follow applicable local rules and plan against their own confidentiality lifetimes, system lifetimes, and vendor timelines. NIST discusses hybrid classical/PQC deployment as an option, with additional resource costs; it needs protocol-level testing rather than blanket adoption.

Sources: NIST IR 8547 (October 2026) · NIST crypto-agility guidance (updated June 2026) · NIST migration explanation

Technical governance · quantum communications

QKD distributes keys; it does not secure the whole system

Quantum key distribution (QKD) and post-quantum cryptography address different parts of the security problem. Procurement should name the exact threat and security boundary.

What QKD can provide

QKD uses quantum states to establish shared key material and can reveal certain interception attempts under the protocol’s assumptions. It still requires authenticated classical communication—often using conventional public-key cryptography or pre-shared keys—plus secure devices, trusted key management, and conventional encryption to protect the message. So QKD does not remove every dependency that PQC migration addresses.

What it cannot promise alone

It does not fix compromised endpoints, weak authentication, insider access, poor implementation, or unsafe network operations. Network architectures may extend service through trusted nodes that relay key material; those nodes become security-critical assets. ITU-T X.1713 provides explicit security requirements for QKD nodes, including threats, protected assets, and controls.

A

Ask for the security model

Which links and endpoints are protected? Who authenticates the parties? Where are keys generated, stored, relayed, and destroyed?

B

Require implementation assurance

Specify device evaluation, tamper controls, key-management interfaces, operational monitoring, and incident response. ETSI has a Common Criteria protection profile for QKD modules and a 2026 interoperable key-management API specification.

C

Compare with PQC on total cost

Assess fiber or optical infrastructure, distance, availability, integration, maintenance, and the sensitivity of the use case. QKD may be a specialized layer; it is not a substitute for broad PQC migration. The U.S. NSA takes a stricter position for U.S. National Security Systems: it does not recommend QKD there unless limitations around authentication, dedicated hardware, trusted relays, validation, and denial-of-service are overcome. That is a system-specific security position, not a universal rule.

Sources: NSA QKD position for National Security Systems · ITU-T X.1713 security requirements for QKD nodes · ETSI QKD standards, including 2026 key-management API

Regulatory architecture

Prepare the regulator before regulating the label

The UK Regulatory Horizons Council and government response offer a detailed case study in how to govern an emerging platform whose products reach many sectors.

UK model · government response, 8 October 2024Application-led · sector-regulated · readiness-aware

The government accepted that a single quantum-specific regulatory regime was premature for the field’s then-current maturity. It supported regulation by application, led by the sector regulator, while building regulatory expertise, convening a cross-regulator forum, using standards and guidance, and reassessing gaps as technologies mature.

This is a sequencing choice: do capability-building and horizon scanning now; introduce proportionate controls when a use case, evidence base, and regulatory gap justify them.

Read the full government response ↗
WHEN MATURITY IS LOW

Build the regulator’s ability to see

Train sector regulators, run horizon scanning, involve standards bodies in pilots, and create testbeds with evaluation questions defined before the trial. Use flexible responsible-innovation expectations for high-potential early research.

WHEN A USE CASE IS INCREMENTAL

Start with the closest existing regime

Map the quantum feature to the current product category and sector rule. For example, healthcare sensing may touch medical-device evaluation and health-data rules; infrastructure sensing may touch safety, procurement, and critical-infrastructure controls.

WHEN THE USE IS DISRUPTIVE

Test for a real regulatory gap

For later-stage or transformative applications, assess whether existing duties cover the new capability. If not, select a domain-specific measure—standard, guidance, certification, procurement condition, or regulation—and review it as evidence changes.

UK ACQUISITION CONTROL

A concrete dual-use instrument

Under the UK National Security and Investment Act guidance, an acquisition of a qualifying entity that develops or produces specified quantum technologies can trigger mandatory notification. The listed scope includes computing, communications, imaging/sensing/timing/navigation, connectivity, and quantum-resistant cryptography. This is an acquisition-screening rule for a specific jurisdiction, not a general permit requirement for quantum research or deployment.

Read the UK NSI Act quantum guidance ↗
Measurement and procurement

Buy evidence, not a qubit count

The UK review notes that market uptake can be held back by difficulty demonstrating efficacy and building confidence. Its proposed response includes standards, benchmarks, measurement protocols, and independent testing for sensing, timing, and imaging.

01 / CLAIM

Define the performance target

Specify the quantity measured, operating range, precision, stability, latency, uptime, and conditions in which performance must hold. Ask what baseline and test method support the vendor claim.

02 / FIELD VALIDATION

Test outside the showcase

Use an independent test site or accredited lab where possible. Report calibration, environmental sensitivity, drift, repeatability, false positives, uncertainty bounds, and failure behavior.

03 / DEPLOYMENT VALUE

Compare total system cost

Include installation, supporting infrastructure, specialist skills, maintenance, data processing, integration, and fallback systems. Procure against service outcomes rather than a technology label.

Source: Regulatory Horizons Council report on quantum technology applications

Adoption evidence · OECD 2026

Readiness is a learning stage, not a deployment claim

An OECD study drawing on public and private organisations in 10 countries describes four recurring barriers to business readiness. These matter for governance because they shape who can participate, what public support can realistically deliver, and how buyers should interpret a pilot.

BARRIER 01 / TECHNOLOGY MATURITY

Hardware and software remain unsettled

The OECD reports high error rates, multiple hardware approaches, and no settled dominant platform. That makes platform-specific investment and production promises risky.

Governance response Fund testable capability-building and shared facilities; require vendors to state system limits and avoid implying that a research result is a production service.

BARRIER 02 / BUSINESS CASE

Interest is not a validated use case

Many organizations cannot yet identify a task where quantum computing beats a comparable classical approach in useful cost, time, or quality.

Governance response Start with the problem and baseline. Allow a well-supported finding of “no advantage” to count as a successful pilot outcome.

BARRIER 03 / ACCESS AND COST

Cloud access still needs people and integration

Hardware access alone does not pay for skilled staff, training, software work, data preparation, integration, or sustained experimentation. SMEs may be least able to absorb those costs.

Governance response Make testbeds, advisory services, collaborative platforms, and grants accessible to smaller firms; publish eligibility and selection rules.

BARRIER 04 / TALENT

Useful teams span physics and industry

Organizations need people who can connect quantum methods with domain problems, software stacks, operations, security, and business constraints—not only quantum specialists.

Governance response Fund interdisciplinary training and technology-extension support, then measure whether capability reaches end users beyond a small group of early movers.

What readiness policy can do

The OECD identifies collaboration networks, business advisory and technology-extension services, grants, and stakeholder consultation as support mechanisms. A public programme should say whether it is buying research, building workforce capability, testing a specific use case, or procuring a service. These are different outcomes and should use different success measures.

Practical implication: report learning, access, cost, and validated results—including decisions not to proceed—alongside any deployment or revenue claims.

OECD, Building Business Readiness for Quantum Computing (2026) ↗
International baseline

Four OECD principles, made operational

The OECD Council adopted a Recommendation on Quantum Technologies on 28 May 2026. It is the first intergovernmental standard focused on responsible development and use of trusted quantum technologies. The Recommendation is policy guidance for governments and other actors, not a global product code.

Read OECD/LEGAL/0508 ↗
1

Innovation aligned with rights

Define a public-interest purpose and check consequences for democratic values, human rights, safety, and fundamental freedoms across the lifecycle.

2

Secure access to benefits

Expand access to infrastructure, skills, and applications while protecting privacy, security, and critical dependencies. Ask who can participate and who is left out.

3

Collaboration with safeguards

Build cross-border and cross-sector cooperation, common standards, and workforce capacity; apply due diligence to sensitive research and supply chains.

4

Accountability and trust

Disclose capability limits, risk assessments, owners, and mitigation. Give affected stakeholders meaningful ways to participate and challenge decisions.

Accountability map

Give each decision a named owner

The Regulatory Horizons Council approach depends on coordination. A forum can spot regulatory gaps, but the relevant sector authority and system operator still need clear responsibility.

PUBLIC COORDINATOR

Maintain the application register

Track pilots, intended sectors, readiness, regulator contacts, evidence needs, and review dates. Escalate cross-sector issues to a standing quantum regulator forum.

SECTOR REGULATOR

Map current duties and gaps

Identify which existing safety, privacy, medical-device, telecoms, transport, or critical-infrastructure rules apply. State what evidence would trigger new guidance or controls.

STANDARDS & TESTING BODIES

Make performance comparable

Define test protocols, reference conditions, uncertainty reporting, interoperability criteria, and conformity assessment for sensing, timing, imaging, and communications.

VENDOR & SYSTEM OPERATOR

Own the evidence and operations

Document system limits, security architecture, suppliers, update paths, failure modes, data handling, operator training, and incident escalation.

90-day implementation plan

Move from policy to evidence

Use this sequence to prepare a regulator, public buyer, or operator for a real quantum use case.

DAYS 1–30 / DEFINE

Write the system boundary

Name the use, users, data, connected infrastructure, vendor, legal owner, sector regulator, and conventional baseline. For crypto, include protocols, certificates, hardware, cloud services, and suppliers in the inventory.

DAYS 31–60 / TEST

Agree on evidence before the demo

Set acceptance thresholds, test conditions, uncertainty reporting, security assurance, privacy controls, cost assumptions, and stop criteria. Include the regulator and independent test body in the pilot design.

DAYS 61–90 / DECIDE

Record the scale, pause, or exit call

Compare field results with the baseline. Publish an evidence summary, assign remediation owners, set the next review date, and document whether existing regulation covers the use or a gap remains.

For cryptography teams: NIST IR 8547 sets U.S. federal transition dates, not global deadlines. Rank migration by data confidentiality lifetime, time to update, operational criticality, cryptographic supply-chain dependencies, and exposure from long-lived keys or signatures. NIST’s separate crypto-agility guidance treats algorithm replacement as a whole-system capability, not just a library upgrade.
Evaluation design · public scorecard

Measure more than hardware progress

The OECD finds that national indicators range from technical performance and readiness to workforce, adoption, start-ups, investment, supply-chain autonomy, and international collaboration. Definitions and methods still vary. A useful scorecard keeps separate things separate instead of compressing them into a single “quantum readiness” number.

01 / CAPABILITY

Can an independent party reproduce the claim?

Track workload-specific performance, error and uncertainty, environmental conditions, system availability, and maturity. Compare against the best relevant classical method, including data loading, error correction, integration, and total runtime where applicable.

02 / TRANSLATION

Can users test and adopt it?

Track access to testbeds, independent validation, public pilots that reach a procurement decision, integration costs, workforce training, and participation by SMEs and end users. Distinguish learning pilots from operational deployment.

03 / PUBLIC VALUE

Did the funded use improve the service?

For each mission, define an outcome tied to the actual public problem: earlier diagnosis, more reliable infrastructure measurements, better timing resilience, or another specified service goal. Record who benefits, who may be exposed to harm, and the conventional alternative.

04 / TRUST AND RESILIENCE

Are safeguards and dependencies improving?

Track privacy and safety incidents, unresolved audit findings, tested recovery paths, supplier concentration, alternative sources, standards participation, and post-quantum cryptography migration for systems with long-lived data or critical dependencies.

Metric record for every target: publish its definition, baseline, denominator, data source, responsible owner, time horizon, update frequency, and known limitations. Where relevant and safe, disaggregate who receives access or benefits. Report failed targets and changed assumptions. The OECD notes that even detailed national metrics are still being defined, so transparent methods matter as much as headline numbers. OECD review of national strategies and indicators ↗
From lab to society

Govern the whole lifecycle

Choose a stage to see a useful governance question and an action to take.

Research · What is demonstrated, and what is forecast?

Record the target application, technology readiness, evidence, alternatives, and possible dual-use pathways. Avoid turning a speculative future capability into a present factual claim.

  • Publish benchmark methods and uncertainty; distinguish lab results from field performance.
  • For sensitive work, document partner due diligence and who reviews access decisions.
Practical starting point: write a one-page use-case brief with the baseline, evidence threshold, relevant regulator, affected people, system dependencies, safeguards, and a date for the scale/pause/exit decision.
Optional add-on · 5-minute primer

Quantum physics in plain language

Open this short primer if the science behind the governance questions would be useful. The main guide works without it.

Open the primer
Start here · no physics background needed

Core ideas behind the technology

Quantum mechanics is the tested framework physicists use to predict how matter and light behave at very small scales. Its rules are unfamiliar, but they are precise. Here are the ideas that power modern quantum technologies.

01 / QUANTIZED

Nature has allowed energy levels

Atoms do not absorb or release just any amount of energy. They move between particular energy levels. The word “quantum” refers to these discrete amounts in many physical systems.

02 / WAVES & INTERFERENCE

Quantum possibilities can combine

Electrons and photons can produce interference patterns, like waves. In a two-slit experiment, the pattern changes when the experiment reveals which path the particle took. A “particle” and a “wave” are models for different observed behavior, not tiny billiard balls switching costumes.

03 / STATE & SUPERPOSITION

A qubit is more than a hidden coin

A classical bit is 0 or 1. A qubit can be encoded in a photon’s polarization, an atom’s energy levels, or another physical system. Its quantum state can combine the possibilities 0 and 1 with different amplitudes and phases. Before measurement it is not merely a classical coin whose face we have not looked at; the amplitudes can later interfere.

04 / MEASUREMENT

One trial gives one result

Measure a qubit in the 0/1 basis and you get one result: 0 or 1. Quantum mechanics predicts the probabilities. Repeat the same preparation many times and the pattern of results reveals those probabilities. “Observer” means a physical interaction or measuring device, not a conscious person.

05 / UNCERTAINTY

Some spreads are built into the state

For pairs such as position and momentum, quantum mechanics limits how narrow both distributions can be at once. This is not simply poor equipment or a person disturbing a particle; it is a property of the state. NIST’s example of squeezed light shows how reducing uncertainty in one quantity increases it in a paired quantity. See the sensing example ↗

06 / ENTANGLEMENT

Some pairs have one shared state

Entangled particles cannot be fully described as two independent objects. Bell tests show correlations that violate Bell inequalities, ruling out local-hidden-variable explanations under the experiments’ assumptions. Individual outcomes remain unpredictable, so entanglement cannot send a controllable message faster than light.

07 / DECOHERENCE

The environment scrambles delicate patterns

Heat, stray light, vibration, and other interactions can leak information about a quantum system into its surroundings. This destroys the phase relationships needed for interference. Keeping systems coherent is a central engineering challenge in quantum computing and communication.

One step deeper · a worked example

Amplitudes, probabilities, and the measurement basis

A qubit state can be written |ψ⟩ = α|0⟩ + β|1⟩. The Born rule says the probability of measuring 0 is |α|², and of measuring 1 is |β|²; the probabilities add to 1. The amplitudes can be positive, negative, or complex, and their relative phase matters when alternatives later interfere.

EXAMPLE A / SAME BASIS

One state, two possible outcomes

|+⟩ = (|0⟩ + |1⟩)/√2. In the 0/1 measurement basis, the squared amplitudes give 50% for each result. A single run gives one result; repeated, identically prepared runs approach the predicted distribution.

EXAMPLE B / PHASE

Same probabilities, different state

|−⟩ = (|0⟩ − |1⟩)/√2 also gives 50/50 in the 0/1 basis. But its relative minus sign changes interference: applying H sends |+⟩ to |0⟩ and |−⟩ to |1⟩. A classical 50/50 mixture cannot reproduce that distinction.

EXAMPLE C / BASIS

A measurement asks a specific question

The 0/1 basis is called the Z basis; the +/− basis is the X basis. State |+⟩ is random in Z but certain in X. Saying “the qubit is in a superposition” is incomplete unless we say “of which outcomes, relative to which measurement?”

Double-slit in one sentence: when no apparatus or environment stores which-path information, the probability pattern comes from adding path amplitudes and then squaring; if which-path information becomes available, the interference pattern is lost. This is the same amplitude logic used in the qubit examples. NIST research on double-slit decoherence ↗
Try a simple qubit model

Superposition, measurement, and interference

Prepare |+⟩ and compare measurements: in the 0/1 basis you get a random 0 or 1; in the +/− basis you always get +. Then prepare |−⟩: it has the same 0/1 probabilities, but an X operation reveals its opposite phase. The buttons model these basis changes and measurements. This makes the relative phase visible without advanced math.

This is an ideal one-qubit model with real amplitudes. Real qubits also have complex phases; hardware has noise and imperfect operations.

Ready: qubit is in state |0⟩.

State: |0⟩
0
100%
1
0%
Repeated preparations help estimate probabilities.
Do not picture parallel answers: a quantum computer can place many possible states in a superposition, but measuring it returns limited information. Algorithms use interference to amplify useful outcomes and cancel others; they do not simply read out every answer at once. NIST explains the limits of “quantum parallelism” ↗
PHYSICS → COMPUTING

Control the amplitudes

Quantum gates rotate and combine a state. A useful algorithm arranges interference so a measurement is more likely to reveal a desired feature of a problem. This can help with some tasks; it is not a speed boost for every program.

PHYSICS → SENSING

Let phase register a physical change

In an atom interferometer, lasers split and later recombine an atomic wave. Gravity or acceleration changes the relative phase; the final interference pattern lets researchers estimate the physical quantity. NIST atom-interferometer explainer ↗

PHYSICS → COMMUNICATION

Correlations and key distribution

Entanglement and measurement can support protocols that distribute keys or verify correlations. They do not replace ordinary network security, authenticated identities, secure endpoints, or careful device engineering.

What experiments establish · what remains debatedKeep the physics separate from its interpretation

Established: quantum mechanics predicts measurement statistics with extraordinary accuracy; interference, quantized spectra, and Bell-inequality violations have been measured. Still debated: what the mathematical state says about reality and exactly how one observed outcome should be understood. Copenhagen-style, many-worlds, Bohmian, and objective-collapse approaches answer those interpretive questions differently.

Decoherence is a physical process: the system becomes entangled with its environment, making interference between alternatives practically inaccessible. It explains why quantum effects are hard to preserve at large scales, but the technical literature distinguishes that from the separate question of why a measurement yields one experienced outcome. None of this requires a conscious observer.

Sources: Schlosshauer, Reviews of Modern Physics: Decoherence, the measurement problem, and interpretations · Nobel Prize 2022 popular science background on Bell tests

Learning sources: NIST: five concepts without the math · NIST: quantum computing explained · NIST: entanglement and why it cannot send messages faster than light · APS review: decoherence and the measurement problem · Nobel Prize: Bell inequalities in plain language · NIST: decoherence illustration

Research library

Primary sources and public learning

Policy, regulation, and standards

Public physics reading

This guide distinguishes sourced policy positions, legal examples, and operational design implications. Legal obligations depend on jurisdiction, sector, and facts; check the current primary rule and regulator guidance before acting.