What public problem merits support?
Prioritize research and procurement by demonstrated need, plausible benefit, and a credible path from laboratory results to real-world use.
A research-based guide to the policy choices, technical evidence, safeguards, and public responsibilities shaping quantum technologies.
Quantum is not one technology or one policy problem. Computing, sensing, and communications have different maturity levels and routes to impact. Governance should match those differences, stay proportionate to evidence, and include people who may be affected. An international policy baseline is emerging: the OECD Council adopted its Recommendation on Quantum Technologies on 28 May 2026.
“Quantum” is not a single regulatory category. The practical task is to select the right instrument for each use and make someone accountable for the result.
Prioritize research and procurement by demonstrated need, plausible benefit, and a credible path from laboratory results to real-world use.
Quantum imaging, sensing, and timing can change what is measurable. Apply privacy, safety, data, and sector rules to the actual deployment.
Separate today’s post-quantum cryptography migration from longer-term quantum computing risks and specialized QKD networks.
Screen sensitive acquisitions and suppliers where required; preserve standards work, research exchange, workforce access, and international interoperability.
The OECD Council’s 2026 Recommendation turns shared principles into five national policy tracks. Here is a practical way to read them: what public institutions can do, and what citizens can ask them to show.
Commission forward-looking assessments that distinguish demonstrated capabilities from forecasts. Set baselines and measurable indicators suited to each technology’s maturity. Include public benefit, privacy, security, safety, misuse, and national-security implications; state assumptions and revisit dates.
Public test Can people see what was tested, what remains speculative, who bears the risk, and what evidence would change the decision?
Support research, shared infrastructure, translation, and commercialization with transparent goals. Map public and private actors, dependencies, and needs. Bring industry, researchers, standards bodies, public buyers, and affected communities into decisions about standards, interoperability, competition, and safeguards.
Public test Are public investments tied to stated benefits, evaluation criteria, and a route to interoperability?
Plan for researchers, engineers, technicians, security and privacy specialists, product teams, procurement staff, and regulators. Develop education, hands-on training, retraining, and pathways that include people from varied backgrounds; make technical expertise available to public decision-makers.
Public test Are skills gaps, training routes, regulator capability, and participation being tracked as the field changes?
Identify critical components, concentrated capabilities, single points of failure, and supplier dependencies. Build resilience through diversification and trusted partnerships. Apply proportionate research-security and technology-protection measures to specific risks, with named owners and review points.
Public test Can institutions explain which dependencies matter, what safeguard addresses each risk, and when restrictions will be reviewed?
Develop common standards and benchmarks, exchange information on mutually agreed terms, coordinate research on shared challenges, and build capacity with international partners. Keep cooperation transparent and consistent with rights, security, and the other principles in the Recommendation.
Public test Which standards and partnerships help people share benefits safely across borders?
Research context: OECD Quantum Technologies Policy Primer (2025) · OECD review of national quantum strategies (2025).
Countries use strategies, executive direction, sector regulation, investment programmes, and technical standards for different jobs. These instruments do not carry the same legal force or govern the same risks.
The OECD Council’s 2026 Recommendation sets four principles for governments and other actors, then five national policy tracks for adhering governments. It creates a common reference for rights, security, collaboration, accountability, foresight, workforce, and supply chains; it is not a uniform product-approval regime.
Governance question How will each government turn shared commitments into funded, assigned, and reviewable domestic work?
OECD/LEGAL/0508 ↗The EU Quantum Europe Strategy, adopted in July 2025, groups action around research, infrastructure, ecosystem and supply chains, dual-use capabilities, and skills. The Commission describes a Quantum Act as forthcoming; on 30 October 2026 its implementation tracker still classified the Act as planned, so the strategy and future legislation must be treated as different instruments.
Governance question Will common infrastructure and funding reduce fragmentation while preserving transparent access, public-interest safeguards, and clear legal duties?
EU Quantum policy page ↗ · Commission implementation tracker ↗The UK government accepted a regulation-by-application approach led by sector regulators. Its response emphasizes coordination, horizon scanning, training, standards, and regulatory involvement in testbeds, then calls for proportionate measures when a concrete application exposes a genuine gap.
Governance question Which regulator owns the use case, and what evidence would show that existing rules do not cover it?
UK government response ↗Executive Order 14413, issued 22 June 2026, directs U.S. agencies to accelerate quantum computing, sensing, and networking, including plans for sensor deployment, supply-chain analysis, standards uptake, workforce development, and international engagement. It directs the federal executive; it is not a universal product code for every quantum operator.
Governance question Are agency deadlines, procurement choices, security restrictions, and public benefits reported and reviewed together?
Executive Order 14413 ↗IEC/ISO JTC 3 coordinates technical standardization across quantum computing and simulation, metrology, sources and detectors, and communications. Shared terminology, test methods, and interfaces can support comparison and interoperability. A technical standard does not by itself authorize a deployment; legal duties attach through applicable law, regulation, procurement, or contract.
Governance question Who helped define the benchmark, which conditions does it cover, and can an independent lab reproduce the result?
IEC/ISO JTC 3 scope and work groups ↗These choices affect who benefits, who carries risk, and whether public claims can be checked.
Hardware counts can describe a component, but not usefulness, error correction, uptime, field accuracy, affordability, or social benefit. Track technology readiness alongside validated task performance, adoption, skills, and outcomes for the public purpose being funded.
Ask for a named use case, a classical baseline, test conditions, independent results, and outcome measures.
Some components, data, or know-how may have security implications. Broad or vague restrictions can also weaken collaboration, talent exchange, and scientific scrutiny. State the sensitive asset, threat pathway, control, responsible authority, and review date.
Ask for a risk-specific rationale, appeal or review route, and a record of what remains openly shareable.
Control-design caution: the OECD’s 2025 review reports export restrictions using a 34-qubit cutoff, while noting that experts questioned whether this threshold maps to a meaningful security risk. A control should explain the capability and threat it addresses, then be reviewed as evidence changes. OECD discussion ↗
Quantum systems rely on specialized components, materials, fabrication, software, and skilled suppliers. Diversifying a real single point of failure can improve resilience; duplicating every capability nationally can raise cost and fragment standards.
Ask for a dependency map, realistic alternative suppliers, interoperability plans, and the cost of proposed localization.
A strategy sets direction; a recommendation records shared policy guidance; a standard defines technical practice; a regulation or statute can impose legal duties. Their force depends on the instrument and jurisdiction. A pilot or government strategy is not, by itself, permission to deploy in a regulated sector.
Ask for the exact legal basis, applicable regulator, affected parties, enforcement route, and next review date.
Computing, sensing, communications, and cryptographic migration have different maturity, operators, and public risks. Governance should attach to the use case and system boundary.
Quantum computers may eventually solve some tasks that are difficult for classical machines. Near-term governance centers on realistic claims, research integrity, dual use, access, and preparing cryptography for a future capable machine.
Quantum sensors can improve measurement of time, fields, acceleration, or other physical quantities. Consider safety-critical reliability, sensitive location or activity data, surveillance, and who controls the resulting measurements.
Quantum communication research includes quantum key distribution and future network components. Evaluate end-to-end system security, implementation flaws, cost, standards, and interoperability; quantum links do not automatically secure endpoints or applications.
The UK Regulatory Horizons Council found quantum products span sectors and readiness levels. It recommended application-specific oversight, using existing sector regulators and frameworks where they fit, while building regulatory capability early.
UK government response to the Regulatory Horizons Council ↗What is being proposed: measure small gravitational variations to infer underground structures, supporting infrastructure surveys or environmental monitoring. The UK review describes underground geophysical survey and methane leak detection as possible applications.
Governance gate: require independent field validation against conventional survey methods across soil, depth, weather, and site conditions. Record error rates and false positives; set human review and escalation procedures before outputs affect excavation, utilities, or safety decisions. The review flags that efficacy and user confidence are barriers to market uptake and points to independent testing by the National Physical Laboratory.
What is being proposed: image in difficult conditions such as fog, smoke, or darkness. The UK review identifies security and surveillance as a possible use and explicitly raises privacy concerns.
Governance gate: treat the output as sensitive observation data. Before a pilot, document the legal purpose, field of view, locations and people exposed, retention period, access controls, and deletion process. A capability demonstration is not authorization for routine surveillance.
What is being proposed: quantum clocks or inertial sensors may support position, navigation, and timing when GNSS is degraded or unavailable. That matters to aviation and critical infrastructure.
Governance gate: test drift over time, calibration, vibration and temperature sensitivity, integration with existing systems, and failover behavior. Define required holdover time and acceptable error for the actual sector; do not equate “satellite independent” with “failure proof.” The UK review calls for standards, benchmarks, and validation to support uptake.
What is being proposed: acceleration of specific simulations or optimization tasks, not a general replacement for classical computing. Near-term buyers may encounter cloud access, vendor roadmaps, and claims of advantage.
Governance gate: require a named workload, a strong classical baseline, end-to-end runtime including data loading and error correction, reproducible results, and cost/energy estimates. Separate demonstrated results from future fault-tolerant projections in procurement and public funding decisions.
Use-case evidence: Regulatory Horizons Council, Regulating Quantum Technology Applications (2024), with sensing, timing, imaging, and computing chapters.
Quantum computing creates a specific future risk to widely used public-key cryptography. The practical governance problem today is finding every dependency and moving safely before systems, vendors, and data lifetimes make the change urgent.
NIST’s 2024 finalized standards cover two functions: ML-KEM (FIPS 203) establishes shared keys; ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) provide digital signatures. PQC uses conventional computers. It is separate from quantum key distribution.
NIST PQC standards and project status ↗Map where public-key cryptography protects key establishment and signatures: TLS, VPNs, identity and certificates, code signing, email, device firmware, cloud services, backups, and supplier products. Include embedded and end-of-life equipment.
Prioritize information whose confidentiality must last for years, systems that are hard to update, broad trust infrastructure such as PKI and code signing, and critical services with long procurement or recertification cycles. “Harvest now, decrypt later” applies to sensitive encrypted data collected now.
Test certificate and signature size, handshake latency, bandwidth, memory, hardware limits, protocol negotiation, validation requirements, and vendor support. A mathematically sound algorithm can still fail operationally when systems cannot exchange or verify the new artifacts.
NIST defines crypto agility as replacing algorithms across protocols, apps, software, hardware, firmware, and infrastructure while preserving security and operations. Make algorithms configurable, track ownership and expiry, and rehearse a rollback or next migration.
Sources: NIST IR 8547 (October 2026) · NIST crypto-agility guidance (updated June 2026) · NIST migration explanation
Quantum key distribution (QKD) and post-quantum cryptography address different parts of the security problem. Procurement should name the exact threat and security boundary.
QKD uses quantum states to establish shared key material and can reveal certain interception attempts under the protocol’s assumptions. It still requires authenticated classical communication—often using conventional public-key cryptography or pre-shared keys—plus secure devices, trusted key management, and conventional encryption to protect the message. So QKD does not remove every dependency that PQC migration addresses.
It does not fix compromised endpoints, weak authentication, insider access, poor implementation, or unsafe network operations. Network architectures may extend service through trusted nodes that relay key material; those nodes become security-critical assets. ITU-T X.1713 provides explicit security requirements for QKD nodes, including threats, protected assets, and controls.
Which links and endpoints are protected? Who authenticates the parties? Where are keys generated, stored, relayed, and destroyed?
Specify device evaluation, tamper controls, key-management interfaces, operational monitoring, and incident response. ETSI has a Common Criteria protection profile for QKD modules and a 2026 interoperable key-management API specification.
Assess fiber or optical infrastructure, distance, availability, integration, maintenance, and the sensitivity of the use case. QKD may be a specialized layer; it is not a substitute for broad PQC migration. The U.S. NSA takes a stricter position for U.S. National Security Systems: it does not recommend QKD there unless limitations around authentication, dedicated hardware, trusted relays, validation, and denial-of-service are overcome. That is a system-specific security position, not a universal rule.
Sources: NSA QKD position for National Security Systems · ITU-T X.1713 security requirements for QKD nodes · ETSI QKD standards, including 2026 key-management API
The UK Regulatory Horizons Council and government response offer a detailed case study in how to govern an emerging platform whose products reach many sectors.
The government accepted that a single quantum-specific regulatory regime was premature for the field’s then-current maturity. It supported regulation by application, led by the sector regulator, while building regulatory expertise, convening a cross-regulator forum, using standards and guidance, and reassessing gaps as technologies mature.
This is a sequencing choice: do capability-building and horizon scanning now; introduce proportionate controls when a use case, evidence base, and regulatory gap justify them.
Read the full government response ↗Train sector regulators, run horizon scanning, involve standards bodies in pilots, and create testbeds with evaluation questions defined before the trial. Use flexible responsible-innovation expectations for high-potential early research.
Map the quantum feature to the current product category and sector rule. For example, healthcare sensing may touch medical-device evaluation and health-data rules; infrastructure sensing may touch safety, procurement, and critical-infrastructure controls.
For later-stage or transformative applications, assess whether existing duties cover the new capability. If not, select a domain-specific measure—standard, guidance, certification, procurement condition, or regulation—and review it as evidence changes.
Under the UK National Security and Investment Act guidance, an acquisition of a qualifying entity that develops or produces specified quantum technologies can trigger mandatory notification. The listed scope includes computing, communications, imaging/sensing/timing/navigation, connectivity, and quantum-resistant cryptography. This is an acquisition-screening rule for a specific jurisdiction, not a general permit requirement for quantum research or deployment.
Read the UK NSI Act quantum guidance ↗The UK review notes that market uptake can be held back by difficulty demonstrating efficacy and building confidence. Its proposed response includes standards, benchmarks, measurement protocols, and independent testing for sensing, timing, and imaging.
Specify the quantity measured, operating range, precision, stability, latency, uptime, and conditions in which performance must hold. Ask what baseline and test method support the vendor claim.
Use an independent test site or accredited lab where possible. Report calibration, environmental sensitivity, drift, repeatability, false positives, uncertainty bounds, and failure behavior.
Include installation, supporting infrastructure, specialist skills, maintenance, data processing, integration, and fallback systems. Procure against service outcomes rather than a technology label.
Source: Regulatory Horizons Council report on quantum technology applications
An OECD study drawing on public and private organisations in 10 countries describes four recurring barriers to business readiness. These matter for governance because they shape who can participate, what public support can realistically deliver, and how buyers should interpret a pilot.
The OECD reports high error rates, multiple hardware approaches, and no settled dominant platform. That makes platform-specific investment and production promises risky.
Governance response Fund testable capability-building and shared facilities; require vendors to state system limits and avoid implying that a research result is a production service.
Many organizations cannot yet identify a task where quantum computing beats a comparable classical approach in useful cost, time, or quality.
Governance response Start with the problem and baseline. Allow a well-supported finding of “no advantage” to count as a successful pilot outcome.
Hardware access alone does not pay for skilled staff, training, software work, data preparation, integration, or sustained experimentation. SMEs may be least able to absorb those costs.
Governance response Make testbeds, advisory services, collaborative platforms, and grants accessible to smaller firms; publish eligibility and selection rules.
Organizations need people who can connect quantum methods with domain problems, software stacks, operations, security, and business constraints—not only quantum specialists.
Governance response Fund interdisciplinary training and technology-extension support, then measure whether capability reaches end users beyond a small group of early movers.
The OECD identifies collaboration networks, business advisory and technology-extension services, grants, and stakeholder consultation as support mechanisms. A public programme should say whether it is buying research, building workforce capability, testing a specific use case, or procuring a service. These are different outcomes and should use different success measures.
Practical implication: report learning, access, cost, and validated results—including decisions not to proceed—alongside any deployment or revenue claims.
OECD, Building Business Readiness for Quantum Computing (2026) ↗The OECD Council adopted a Recommendation on Quantum Technologies on 28 May 2026. It is the first intergovernmental standard focused on responsible development and use of trusted quantum technologies. The Recommendation is policy guidance for governments and other actors, not a global product code.
Read OECD/LEGAL/0508 ↗Define a public-interest purpose and check consequences for democratic values, human rights, safety, and fundamental freedoms across the lifecycle.
Expand access to infrastructure, skills, and applications while protecting privacy, security, and critical dependencies. Ask who can participate and who is left out.
Build cross-border and cross-sector cooperation, common standards, and workforce capacity; apply due diligence to sensitive research and supply chains.
Disclose capability limits, risk assessments, owners, and mitigation. Give affected stakeholders meaningful ways to participate and challenge decisions.
The Regulatory Horizons Council approach depends on coordination. A forum can spot regulatory gaps, but the relevant sector authority and system operator still need clear responsibility.
Track pilots, intended sectors, readiness, regulator contacts, evidence needs, and review dates. Escalate cross-sector issues to a standing quantum regulator forum.
Identify which existing safety, privacy, medical-device, telecoms, transport, or critical-infrastructure rules apply. State what evidence would trigger new guidance or controls.
Define test protocols, reference conditions, uncertainty reporting, interoperability criteria, and conformity assessment for sensing, timing, imaging, and communications.
Document system limits, security architecture, suppliers, update paths, failure modes, data handling, operator training, and incident escalation.
Use this sequence to prepare a regulator, public buyer, or operator for a real quantum use case.
Name the use, users, data, connected infrastructure, vendor, legal owner, sector regulator, and conventional baseline. For crypto, include protocols, certificates, hardware, cloud services, and suppliers in the inventory.
Set acceptance thresholds, test conditions, uncertainty reporting, security assurance, privacy controls, cost assumptions, and stop criteria. Include the regulator and independent test body in the pilot design.
Compare field results with the baseline. Publish an evidence summary, assign remediation owners, set the next review date, and document whether existing regulation covers the use or a gap remains.
The OECD finds that national indicators range from technical performance and readiness to workforce, adoption, start-ups, investment, supply-chain autonomy, and international collaboration. Definitions and methods still vary. A useful scorecard keeps separate things separate instead of compressing them into a single “quantum readiness” number.
Track workload-specific performance, error and uncertainty, environmental conditions, system availability, and maturity. Compare against the best relevant classical method, including data loading, error correction, integration, and total runtime where applicable.
Track access to testbeds, independent validation, public pilots that reach a procurement decision, integration costs, workforce training, and participation by SMEs and end users. Distinguish learning pilots from operational deployment.
For each mission, define an outcome tied to the actual public problem: earlier diagnosis, more reliable infrastructure measurements, better timing resilience, or another specified service goal. Record who benefits, who may be exposed to harm, and the conventional alternative.
Track privacy and safety incidents, unresolved audit findings, tested recovery paths, supplier concentration, alternative sources, standards participation, and post-quantum cryptography migration for systems with long-lived data or critical dependencies.
Choose a stage to see a useful governance question and an action to take.
Record the target application, technology readiness, evidence, alternatives, and possible dual-use pathways. Avoid turning a speculative future capability into a present factual claim.
Open this short primer if the science behind the governance questions would be useful. The main guide works without it.
Open the primerQuantum mechanics is the tested framework physicists use to predict how matter and light behave at very small scales. Its rules are unfamiliar, but they are precise. Here are the ideas that power modern quantum technologies.
Atoms do not absorb or release just any amount of energy. They move between particular energy levels. The word “quantum” refers to these discrete amounts in many physical systems.
Electrons and photons can produce interference patterns, like waves. In a two-slit experiment, the pattern changes when the experiment reveals which path the particle took. A “particle” and a “wave” are models for different observed behavior, not tiny billiard balls switching costumes.
A classical bit is 0 or 1. A qubit can be encoded in a photon’s polarization, an atom’s energy levels, or another physical system. Its quantum state can combine the possibilities 0 and 1 with different amplitudes and phases. Before measurement it is not merely a classical coin whose face we have not looked at; the amplitudes can later interfere.
Measure a qubit in the 0/1 basis and you get one result: 0 or 1. Quantum mechanics predicts the probabilities. Repeat the same preparation many times and the pattern of results reveals those probabilities. “Observer” means a physical interaction or measuring device, not a conscious person.
For pairs such as position and momentum, quantum mechanics limits how narrow both distributions can be at once. This is not simply poor equipment or a person disturbing a particle; it is a property of the state. NIST’s example of squeezed light shows how reducing uncertainty in one quantity increases it in a paired quantity. See the sensing example ↗
Entangled particles cannot be fully described as two independent objects. Bell tests show correlations that violate Bell inequalities, ruling out local-hidden-variable explanations under the experiments’ assumptions. Individual outcomes remain unpredictable, so entanglement cannot send a controllable message faster than light.
Heat, stray light, vibration, and other interactions can leak information about a quantum system into its surroundings. This destroys the phase relationships needed for interference. Keeping systems coherent is a central engineering challenge in quantum computing and communication.
A qubit state can be written |ψ⟩ = α|0⟩ + β|1⟩. The Born rule says the probability of measuring 0 is |α|², and of measuring 1 is |β|²; the probabilities add to 1. The amplitudes can be positive, negative, or complex, and their relative phase matters when alternatives later interfere.
|+⟩ = (|0⟩ + |1⟩)/√2. In the 0/1 measurement basis, the squared amplitudes give 50% for each result. A single run gives one result; repeated, identically prepared runs approach the predicted distribution.
|−⟩ = (|0⟩ − |1⟩)/√2 also gives 50/50 in the 0/1 basis. But its relative minus sign changes interference: applying H sends |+⟩ to |0⟩ and |−⟩ to |1⟩. A classical 50/50 mixture cannot reproduce that distinction.
The 0/1 basis is called the Z basis; the +/− basis is the X basis. State |+⟩ is random in Z but certain in X. Saying “the qubit is in a superposition” is incomplete unless we say “of which outcomes, relative to which measurement?”
Prepare |+⟩ and compare measurements: in the 0/1 basis you get a random 0 or 1; in the +/− basis you always get +. Then prepare |−⟩: it has the same 0/1 probabilities, but an X operation reveals its opposite phase. The buttons model these basis changes and measurements. This makes the relative phase visible without advanced math.
This is an ideal one-qubit model with real amplitudes. Real qubits also have complex phases; hardware has noise and imperfect operations.
Ready: qubit is in state |0⟩.
Quantum gates rotate and combine a state. A useful algorithm arranges interference so a measurement is more likely to reveal a desired feature of a problem. This can help with some tasks; it is not a speed boost for every program.
In an atom interferometer, lasers split and later recombine an atomic wave. Gravity or acceleration changes the relative phase; the final interference pattern lets researchers estimate the physical quantity. NIST atom-interferometer explainer ↗
Entanglement and measurement can support protocols that distribute keys or verify correlations. They do not replace ordinary network security, authenticated identities, secure endpoints, or careful device engineering.
Established: quantum mechanics predicts measurement statistics with extraordinary accuracy; interference, quantized spectra, and Bell-inequality violations have been measured. Still debated: what the mathematical state says about reality and exactly how one observed outcome should be understood. Copenhagen-style, many-worlds, Bohmian, and objective-collapse approaches answer those interpretive questions differently.
Decoherence is a physical process: the system becomes entangled with its environment, making interference between alternatives practically inaccessible. It explains why quantum effects are hard to preserve at large scales, but the technical literature distinguishes that from the separate question of why a measurement yields one experienced outcome. None of this requires a conscious observer.
Sources: Schlosshauer, Reviews of Modern Physics: Decoherence, the measurement problem, and interpretations · Nobel Prize 2022 popular science background on Bell tests
Learning sources: NIST: five concepts without the math · NIST: quantum computing explained · NIST: entanglement and why it cannot send messages faster than light · APS review: decoherence and the measurement problem · Nobel Prize: Bell inequalities in plain language · NIST: decoherence illustration
This guide distinguishes sourced policy positions, legal examples, and operational design implications. Legal obligations depend on jurisdiction, sector, and facts; check the current primary rule and regulator guidance before acting.