The third quarter of 2023 brought several developments that will shape the trajectory of quantum policy for years. NIST published draft post-quantum cryptography standards for public comment, giving the global cryptographic migration effort its most concrete set of specifications yet. President Biden signed an executive order creating a new outbound investment screening regime that places quantum technologies alongside semiconductors and AI as categories subject to prohibition or notification when U.S. capital flows toward China. NATO opened a dedicated quantum accelerator in Copenhagen, pairing the Alliance’s innovation architecture with Denmark’s expanding national quantum strategy. The European Chips Act entered into force with dedicated provisions for quantum chip pilot lines, and the first international standard for evaluating QKD security was published by ISO/IEC. Russia, meanwhile, approved a regulatory concept for its quantum communications industry that explicitly restricts foreign suppliers from public procurement.
United States: NIST Publishes Draft Post-Quantum Cryptography Standards
What happened. On August 24, 2023, NIST released initial public drafts of three Federal Information Processing Standards for post-quantum cryptography: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). The three drafts specify key encapsulation and digital signature algorithms derived from the CRYSTALS-KYBER, CRYSTALS-Dilithium, and SPHINCS+ submissions to NIST’s multi-year standardization process. The public comment period ran through November 22, 2023. A fourth draft standard based on the FALCON algorithm (FIPS 206) was planned for 2024.
Why it matters. The release of these drafts marked the point at which post-quantum cryptography moved from algorithm selection to formal standardization, the last major step before federal agencies, financial institutions, and technology vendors are expected to begin production-level migration. Because NIST’s cryptographic standards are adopted globally (by foreign governments, international standards organizations, and industry bodies alike), these three documents will function as the reference baseline for the worldwide transition away from quantum-vulnerable encryption. The comment period also served as a last opportunity for the cryptographic community to surface implementation concerns before finalization. For organizations that had been waiting for clear specifications before beginning migration planning, the drafts removed a key excuse for inaction.
What remains unclear. The timeline for finalization was not fixed; NIST indicated it aimed for 2024 but did not commit to a specific date. How quickly federal agencies would begin mandating PQC adoption after finalization, and whether OMB or CISA would issue binding transition deadlines, remained open. The scope of practical interoperability challenges (particularly for legacy systems in critical infrastructure) had not been fully tested.
Who should care. Federal IT and cybersecurity officials; CISOs at financial institutions, cloud providers, and telecommunications companies; foreign national cryptographic authorities (BSI, ANSSI, CCCS, NCSC) that reference NIST standards; and vendors of network equipment, VPNs, and identity management systems.
United States: Biden Executive Order Creates Outbound Investment Screening for Quantum Technologies
What happened. On August 9, 2023, President Biden signed Executive Order 14105, directing the Treasury Department to develop regulations that would prohibit or require notification of certain U.S. outbound investments in companies in “countries of concern” engaged in semiconductors, quantum information technologies, and AI. China (including Hong Kong and Macau) was designated as the sole country of concern. Treasury’s accompanying Advance Notice of Proposed Rulemaking contemplated prohibitions on investment in the development of quantum computers and critical components, as well as certain quantum sensing platforms, quantum networking, and quantum communication systems. Public comments were due September 28, 2023.
Why it matters. The executive order extended the perimeter of U.S. technology competition policy beyond export controls and inbound investment screening (CFIUS) into the regulation of outbound capital flows. For the quantum sector specifically, the order signals that the U.S. government views private equity, venture capital, and other active investment vehicles as channels through which intangible benefits (management expertise, talent networks, market access) can accelerate an adversary’s quantum capabilities. This adds a new compliance dimension for investors, fund managers, and multinational technology companies with exposure to Chinese quantum ventures. The structure, distinguishing between prohibited and notifiable transactions, attempts to calibrate restrictions by severity, but the final scope depends entirely on Treasury’s forthcoming regulations.
What remains unclear. The ANPRM posed more than 80 questions, suggesting that the boundaries of “quantum information technologies” subject to prohibition versus notification were not yet settled. Whether the regime would extend to passive index-fund holdings, limited partnership stakes, or university-affiliated spin-offs in China was unresolved. The timeline for final rules was not specified. Whether allied governments (EU, UK, Japan) would introduce comparable outbound screening regimes targeting quantum was an open question with strategic coordination implications.
Who should care. U.S.-based venture capital and private equity firms with portfolios or fundraising exposure to Chinese quantum companies; multinational corporations with quantum R&D operations in China; compliance officers at investment banks and fund administrators; allied governments evaluating parallel outbound investment controls.
Denmark and NATO: Quantum Strategy Part 2 and DIANA Lab Launch in Copenhagen
What happened. In the final days of September, Denmark released the second part of its National Strategy for Quantum Technology, allocating DKK 50 million annually from 2024 to 2027 for commercialization, security, and international cooperation. Flagship initiatives include “Quantum House Denmark” (a physical hub for companies, researchers, and investors near the University of Copenhagen), a national quantum test center in partnership with the Novo Nordisk Foundation, and a European quantum fund through the Export and Investment Fund of Denmark. One day later, NATO Secretary General Jens Stoltenberg opened the Deep Tech Lab, Quantum in Copenhagen as part of NATO’s DIANA accelerator network. Stoltenberg called for the creation of a transatlantic quantum community and identified leading Allied quantum nations.
Why it matters. Denmark’s strategy is notable for its specificity on both the commercial and security dimensions. The creation of a dedicated European quantum fund and a national test center signals an effort to address the “valley of death” between academic research and market-ready quantum products, a gap that many national strategies acknowledge but few fund directly. The co-location of Denmark’s civilian quantum infrastructure with a NATO innovation accelerator creates a distinctive dual-use corridor: startups moving through DIANA’s program can access both Alliance defense requirements and Denmark’s commercial ecosystem. For NATO, the Copenhagen opening represents the first dedicated quantum facility within its innovation architecture, a concrete step beyond the Alliance’s declaratory language on emerging technologies.
What remains unclear. The annual DKK 50 million allocation is modest relative to the commitments of larger European quantum programs (Germany, France, the Netherlands). Whether the European quantum fund will attract sufficient co-investment from private sources to be consequential is untested. How DIANA’s quantum accelerator will interact with the EU’s own quantum innovation ecosystem (EuroQCI, Quantum Flagship) has not been articulated. Whether Danish security measures, including the designation of PET as quantum security advisor, will produce binding requirements for critical infrastructure operators is unspecified.
Who should care. European quantum startups seeking both defense and commercial pathways; NATO member states evaluating DIANA participation; EU officials coordinating between Alliance and Union innovation programs; investors tracking European quantum fund vehicles.
European Union: Chips Act Enters Into Force With Quantum Pilot Line Provisions
What happened. The European Chips Act (Regulation (EU) 2023/1781) entered into force on September 21, 2023. The legislation includes, among its operational objectives, the acceleration of quantum chip development. The Chips for Europe Initiative supports design libraries, pilot lines, cleanrooms, foundries, and testing facilities for quantum chips, backed by €3.3 billion in EU funds expected to be matched by member states. Six complementary quantum pilot lines were planned, each focused on a distinct hardware platform: semiconductor spin qubits, photonic quantum technologies, ion traps, superconducting qubits, diamond quantum chips, and neutral-atom platforms.
Why it matters. The inclusion of quantum chips as one of three pilot line areas of strategic importance places quantum hardware manufacturing within the EU’s broader semiconductor sovereignty agenda. This is a structural decision: it means quantum chip fabrication will have access to the same industrial policy instruments (subsidies, procurement preferences, facility co-investment) as conventional semiconductor manufacturing. The six-platform approach reflects both Europe’s distributed research strengths and the current uncertainty about which qubit technology will ultimately dominate. However, spreading resources across six pilot lines carries the risk of sub-scale investment in each.
What remains unclear. How the €3.3 billion will be allocated among the six quantum pilot lines and conventional semiconductor priorities is not yet specified. Whether member state co-funding will materialize at the expected levels is uncertain, particularly given competing fiscal pressures. The governance relationship between these pilot lines and existing Quantum Flagship projects has not been detailed. Timelines for operational readiness of the quantum-specific facilities are undefined.
Who should care. European quantum hardware companies and foundries; quantum chip designers at universities and research institutes across the EU; member state governments allocating co-funding; non-EU quantum hardware firms evaluating European manufacturing partnerships.
ISO/IEC: First International QKD Security Evaluation Standard Published
What happened. On August 29, 2023, ISO and IEC published ISO/IEC 23837-1:2023, the first part of a two-part international standard specifying security requirements for quantum key distribution modules. The standard defines a baseline set of security functional requirements aligned with the Common Criteria (ISO/IEC 15408 series), covering conventional network components, quantum optical components, and QKD protocol implementation. A companion standard on test and evaluation methods (ISO/IEC 23837-2:2023) followed on September 25, 2023. Development began in April 2019 with six drafts reviewed before publication.
Why it matters. The absence of internationally recognized security evaluation standards for QKD has been a persistent obstacle to its credibility in markets where Common Criteria certification is expected. The new standards provide manufacturers with a design benchmark and evaluators with a testing framework, establishing a minimum bar for QKD product security claims. This matters particularly in government procurement contexts where certification against recognized standards is a prerequisite. The standards do not resolve the broader policy debate between QKD and PQC as competing or complementary approaches to quantum-safe security, but they remove one argument against QKD: that it lacks a formal evaluation framework.
What remains unclear. Whether national certification bodies will adopt the standard quickly enough to influence near-term procurement decisions is unknown. The extent to which the standard addresses side-channel attacks and implementation-specific vulnerabilities, which have been the primary security critique of deployed QKD systems, will only become clear as evaluators apply it in practice. How QKD vendors will respond to the cost and timeline of Common Criteria evaluation processes is uncertain.
Who should care. QKD equipment manufacturers; government procurement authorities (particularly in Europe and Asia-Pacific where QKD deployment is most advanced); national cybersecurity certification bodies; telecommunications operators evaluating quantum-safe network architectures.
Russia: Quantum Communications Regulation Concept and 16-Qubit Computer Demonstration
What happened. In July 2023, Russia took two parallel steps to advance its quantum technology program. On July 17, Prime Minister Mishustin approved the Concept of Regulation of the Quantum Communications Industry until 2030, which outlined state aid mechanisms (preferential loans, grants, venture fund equity) for domestic quantum companies and announced intentions to restrict foreign suppliers from public procurement of quantum goods and services. Days earlier, at the Future Technologies Forum in Moscow, Rosatom demonstrated a 16-qubit ion-based quantum computer to President Putin, who used the event to propose a new national data economy project with quantum technology roadmaps through 2030.
Why it matters. The regulatory concept is the most explicit statement to date of Russia’s intention to build a closed domestic quantum communications market. The combination of state subsidies for local manufacturers and procurement restrictions against foreign quantum equipment creates a self-reinforcing industrial policy that prioritizes sovereignty over interoperability. For Western quantum communications firms, this formally closes a market that was already largely inaccessible due to sanctions. For Russia’s own quantum sector, the question is whether a domestic-only supply chain can produce competitive technology without access to global component markets. The 16-qubit demonstration, while modest by international benchmarks, serves a political signaling function: it positions quantum computing as a visible element of Russia’s technology self-sufficiency narrative.
What remains unclear. Whether the quantum regulation concept will be backed by sufficient appropriations to fund the promised state aid mechanisms is unspecified. The concept’s goal of financing quantum adoption by small and medium enterprises implies a demand-side strategy, but the size and timeline of that program are not detailed. How Russia intends to source critical quantum hardware components (cryogenics, specialized lasers, detectors) under current sanctions constraints is an open question.
Who should care. Western intelligence analysts tracking Russian technology self-sufficiency; sanctions compliance officers at quantum component suppliers; researchers monitoring quantum communications network deployments in non-Western markets; policymakers assessing the fragmentation of global quantum standards.
Also in July–September 2023
Spain formally launched its Complementary Quantum Communications Plan with a €73 million budget shared across six autonomous communities, framed within the national Recovery Plan and aligned with the EuroQCI initiative.
Japan established the G-QuAT research center at AIST with ¥32 billion ($226 million) from METI, creating an industrial support center offering companies access to quantum computing platforms combined with high-performance computing.
New Zealand allocated NZ$12 million over five years for Quantum Technologies Aotearoa, a research program focused on international connectivity and domestic capability building in partnership with the UK, Japan, Singapore, the U.S., and Germany.
The Portuguese Navy hosted a QKD demonstration during the NATO REPMUS 2023 exercise, marking the first time quantum-secure communications were tested in an operational military scenario within a NATO exercise, using continuous-variable QKD to protect data between a command center and a docked frigate.
Taiwan’s Chelpis Quantum Tech opened the Quantum Safe Migration Center in Taipei, Asia’s first dedicated PQC migration institution, in partnership with Academia Sinica and the Institute for Information Industry.
Detailed analysis of each development covered in this briefing, with cross-jurisdictional comparisons, sector-specific impact assessments, and forward-looking indicators, is available to Quantum Policy Radar subscribers.