Irrelevant carrots and non-existent sticks: trust, governance, and security in the transition to quantum-safe systems

TL;DR

The paper analyzes how national innovation systems govern the transition to quantum-safe cryptography in the face of the quantum threat. Using a qualitative, expert-workshop approach in the Netherlands, it maps twelve actor groups, their formal and interpretative roles, and the governance gaps that hinder timely migration. It highlights regulators as the strongest direct influence and standardisation bodies as key indirect actors, while identifying ownership ambiguities, trust considerations, and interoperability challenges as core obstacles. The study argues that proactive, cross-border, and co-ordinated governance—encompassing clear milestones, cryptanalytic funding, and robust open-source PQC governance—is essential to prevent fragmentation and accelerate the quantum-safe transition with societal benefit.

Abstract

Quantum computing poses an urgent and widely recognised threat to global cybersecurity, enabling encrypted government, financial, and healthcare data harvested today to be decrypted in the near future. Transitioning to quantum-safe cryptography is therefore essential, demanding coordinated action across a complex, multi-actor innovation system. Drawing on insights from an expert workshop in Amsterdam, this study develops a socially informed vision for a quantum-safe future and analyses the current innovation landscape to identify critical gaps and the actions needed to address them. We map twelve key actor groups involved in the migration process, finding that regulators exert the strongest direct influence, while standardisation bodies play a crucial indirect role. This research provides one of the first system-level mappings of actors, influence pathways and governance responsibilities shaping the quantum-safe transition, revealing several responsibilities with unclear ownership. Although centred on the Netherlands, our findings are applicable to other national contexts navigating quantum-safe transitions.

Figures (7)

• Figure 1: The first exercises of the workshop took place in plenary.
• Figure 2: Perceived expertise of workshop participants, shown from two angles. Interactive visualisation available at https://quantumimpact.shinyapps.io/expertise/.
• Figure 3: Experimental study design flowchart.
• Figure 4: Visualisation of the Dutch QSC innovation system. The figure maps the responsibilities identified in \ref{['tab:roles_responsibilities_from_transcripts']} onto the relevant actors, illustrating two parallel flows, technology development (dark grey) and standardisation (light grey). Solid lines denote QSC transition responsibilities that are currently well-functioning, while dashed lines indicate responsibilities that are intended but not yet fulfilled.
• Figure 5: The research team repositioned system actors guided by participants' instructions.