Europe Is Rewriting Its Quantum Roadmaps and Asking for Comments

In late July 2026, the European Quantum Flagship opened a public consultation on six draft technology roadmaps, with a questionnaire attached to each and comments open to anyone until August 16, 2026. The set runs to 192 pages and about 69,000 words: Quantum Computing and Simulation, Quantum Communication, Quantum Sensing and Metrology, Quantum Chips Industrialisation, Supply Chain and Enabling Technologies, and Standardisation. Together they are meant to become the technical spine of the updated Strategic Research and Industry Agenda, the reference document that guides how Europe coordinates its public quantum research, industrial policy, and procurement priorities through 2035.

The window is short and the conveyor belt behind it is visible, because the finished SRIA is due by November 2026. KPI tables and stage gates are the most portable parts of any strategy document; they have a way of returning as work-program language, grant conditions, and procurement criteria two years later. Whoever comments in the next two weeks is, in a small way, drafting the yardsticks for a decade of European public investment.

If you build, buy, secure, or regulate quantum technology in Europe, read at least the draft closest to your work and file comments while the text is still wet. I have spent two years arguing that regulators, insurers, and buyers set the quantum deadlines that matter; this consultation is one of the rare moments when you get to mark up the deadline-setters’ homework instead of merely receiving it.

My team at Applied Quantum has read all six drafts, every page, and we are preparing chapter-by-chapter submissions for each. The findings below run from a sovereignty doctrine worth defending to KPI cells still waiting for their numbers, and the most consequential gap sits in the standardization draft, which lists post-quantum cryptography first among its domains and then never gives it a dedicated workstream.

The Flagship behind the drafts

The Quantum Flagship launched in October 2018 as one of the EU’s large-scale, decade-long research initiatives, with a budget on the order of €1 billion and a mandate to move quantum science toward industry across computing, simulation, communication, and sensing. Its strategy document is the Strategic Research and Industry Agenda, or SRIA. The 2030 edition was delivered to the European Commission in digital form in December 2023, presented in Brussels in February 2024, and built on consultations that reached more than 300 experts. Its stated ambition was to make Europe the world’s first ‘Quantum Valley.’

Since then the policy machinery has accelerated. The Commission published the Quantum Europe Strategy in July 2025, six Chips Joint Undertaking pilot lines for quantum chips came into being, EuroHPC gained a quantum pillar, EuroQCI deployments spread across Member States, and a Quantum Act proposal is expected later this year. The SRIA has to catch up with all of it. In late 2025 the Flagship called for editors to draft new domain roadmaps, groups of eight to ten experts per document started work in January 2026, a round of community workshops reviewed first drafts in June and early July, and the written consultation on those drafts closes August 16. November is the hard stop.

Six roadmaps, one comment window

Each draft follows a common template: where Europe stands, the ambition for 2035, the challenges, objectives with KPIs, an implementation pathway with gate criteria, and synergies with space, defence, standardization, and supply chains. Coverage is deliberately split. Computing and simulation now sit in one document with a heavier emphasis on fault tolerance than earlier agendas. Communication spans QKD deployment through the long-horizon quantum internet. Sensing and metrology covers the modality zoo from atomic clocks to NV-center magnetometers. Chips industrialisation and the supply-chain document divide the industrial base between them, and standardization has a dedicated roadmap of its own.

Maturity varies wildly from document to document, and the drafters say so themselves. Chair’s notes ask for input on unfinished sections, several KPI tables are still empty, and summary tables await content. (I have sat on the client side of enough government consultations to know that most feedback arrives after the decisions are made. This one is early enough to matter.) The openness is the point: the editors are showing their working and asking to be corrected.

Anyone can respond. Every roadmap has its own questionnaire asking for a rating and free-text comments on each chapter, and partial responses are welcome; reviewing one chapter of one roadmap is a real contribution. The most useful format, based on what consultation editors actually use, is to paste the sentence you want changed and say what should replace it and why. If you only have an hour, spend it on the KPI tables and gate criteria, because those are the parts most likely to harden into procurement language. Comment while it is cheap.

Skin in the game

I should disclose my position before criticizing anyone else’s. My team at Applied Quantum and I are reviewing all six drafts and submitting structured feedback on each, chapter by chapter, in the format the questionnaires ask for. I am an EU citizen. My company is in the middle of relocating its headquarters from Singapore to the EU, a decision driven by where the demand is: EU and Middle East clients keep asking for help with quantum sovereignty, and advising on European sovereignty is more credible done from inside the tent. Hence the move.

So yes, we have a commercial interest in Europe’s quantum program succeeding. That is exactly why we read every page. Sovereignty, as I use the word, means sovereign optionality: Europe’s ability to design, procure, integrate, validate, operate, maintain, upgrade, and replace critical quantum systems under European legal and operational control, with no single supplier, architecture, cloud platform, or foreign jurisdiction in a position to stop the program. It does not mean making everything at home. Readers of my work on quantum hype and quantum denialism know the same two-front rule applies here: I will push back on inflated claims in these drafts and on defeatism about Europe’s chances with equal force. Now to the findings.

What repeats across all six

Five patterns show up across the whole set. Some are strengths to protect, some are gaps to close, and one is a contradiction the editors need to resolve before publication.

First, Europe finally has a written sovereignty doctrine worth defending, and it lives in the least glamorous document. The supply-chain and enabling-technologies draft frames the goal as open strategic autonomy built on control points: capabilities that are valuable, unique, and hard to substitute, held so that, in its words, “any future global quantum supply chain cannot be built without Europe.” The chips draft matches it, stating plainly that trusted capacity “does not require autarky across the full supply chain.” That is the correct doctrine, and it happens to be the argument of my Quantum Sovereignty book condensed into two sentences: sovereignty is preserved choice at the control points, not a customs wall around every component.

Second, one document breaks the doctrine. The sensing and metrology draft carries a 2035 KPI demanding a “100% EU-sourceable supply chain for major quantum sensing product classes,” a requirement that every major product class be fully buildable from EU sources, which the draft’s own supply-chain chapter contradicts by calling full onshoring unfeasible outside specialized niches. Full-sourceability KPIs are how sovereignty language loses credibility with the people who have to fund it. Replace the target with the chips formulation: a qualified EU or trusted-partner alternative for every critical component.

Third, capability metrics are promised and then withheld. The chips draft warns against arbitrary qubit-count targets, which is exactly right, and then presents a KPI table whose categories are defined while every baseline and target cell sits blank, including one that reads ‘≥ %’ with the number missing. The computing draft sets 2035 goals that cannot be compared across platforms: some get logical-qubit counts, circuit depth, and clock rate, one gets a floor-space figure, and one gets a single unquantified line. Every gate-based platform should report one shared minimum set: logical qubits at a stated logical error rate, logical clock rate, sustained runtime, and the resulting logical-operations budget, the quantities that decide when a cryptographically relevant quantum computer becomes plausible. Analogue simulators and annealers need a template of their own, built on programmability, verification, and throughput against the best classical alternative rather than on logical-qubit counts. The first template is the structure of my CRQC Quantum Capability Framework, and I will offer both in our submission.

Fourth, supply-chain resilience is everywhere while hardware assurance is uneven and ungoverned. The communication draft is the honorable exception, proposing accredited security-evaluation laboratories, standardized attack-injection platforms, and certification KPIs. Everywhere else, trusted suppliers and secure hardware appear without a shared assurance model behind the words: provenance and chain of custody, hardware and software bills of materials, firmware integrity and signed updates, tamper evidence, counterfeit screening, and vulnerability disclosure for components headed into EuroQCI nodes, defence systems, and critical infrastructure. EU-origin, EU-certified, and EU-controlled are three different claims, and the drafts use them as one. The supply-chain draft gives circular economy a full KPI objective and hardware assurance none. For a program that will certify ‘trusted’ suppliers into security-sensitive procurement, that ordering is backwards.

Fifth, the drafts contain the pieces of a systems-integration strategy without yet governing them as one. The chips draft names system integrators as a critical industrial category and proposes a European catalogue of interchangeable building blocks. The computing draft wants a sovereign hardware abstraction layer and shared intermediate representations, because today’s dominant toolchains are American. The standardization draft has published the layer model and abstraction-layer specifications those ambitions require, and the supply-chain draft calls for close coordination across the complementary roadmaps. What is missing is the connective program: reference architectures, implementable interfaces, conformance tests, procurement profiles, and accountable integrators tying the four together. Since no qubit modality has won, the transversal layers, meaning software abstractions, control electronics, packaging, metrology, and selected cryogenic and photonic subsystems, recur across platforms and are the investments most likely to pay off whichever architecture prevails, and the integrators who assemble them are what keeps Europe’s platform diversity affordable. I made this case at book length in Quantum Systems Integration; the final versions could make it official by connecting their own pieces. The pieces exist. The program does not.

The missing PQC workstream

The standardization roadmap opens by defining its scope as six domains, and post-quantum cryptography is listed first. Its sovereignty text is specific about what European PQC capability requires: EU implementation profiles, European cryptanalysis capacity, and certification of European-made cryptographic modules. PQC then keeps appearing throughout the prose, in the hybrid QKD discussion and in the dual-use analysis. What never appears is a dedicated workstream. QKD, quantum networks, quantum computing, and sensing with enabling technologies each receive their own objectives, KPI table, and implementation pathway, and PQC receives none. I read the document twice and ran a full-text search to make sure.

Would the Flagship really publish a standardization roadmap without a workstream for the one cryptographic transition Europe has already put on a coordinated timetable? On the current draft, yes, by omission. The EU’s coordinated PQC implementation roadmap, agreed by Member States through the NIS Cooperation Group in 2025, says national transition work should begin by the end of 2026, high-risk use cases should be migrated by the end of 2030, and the rest should follow by the end of 2035 where feasible. Those are coordinated policy milestones rather than statutory deadlines for every organization, and they are already shaping national planning and regulated-sector migration programs across the Union. PQC has the broadest near-term adoption path of anything in the quantum portfolio; QKD, for all its interest, touches a limited circle of infrastructure operators. The draft standardizes the complement and omits the baseline.

Our submission will propose the workstream in outline: EU implementation profiles for ML-KEM, ML-DSA, and SLH-DSA (the standardized forms of CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+); hybrid key-establishment and certificate-migration mechanisms, dual and composite where appropriate; crypto-agility requirements; data formats for cryptographic inventories and cryptographic bills of materials; Common Criteria protection profiles and EUCC certification pathways for PQC-capable modules and HSMs; alignment with eIDAS 2.0, NIS2, DORA, and the Cyber Resilience Act; and KPIs that measure adoption and independently validated implementations instead of documents published. A funded European cryptanalysis capability belongs in the KPI table too, because the harvest-now, decrypt-later clock and its signature-side twin, trust now, forge later, do not pause while committees deliberate. To my thinking, adding this workstream is the highest-value single edit available anywhere in the consultation. Standardize the baseline first.

Roadmap by roadmap

Cross-cutting themes only take you so far, so here are a few document-specific notes, in the order we reviewed them.

Quantum Chips Industrialisation

It contains the best industrial-policy writing of the six. The recognition of system integrators as a distinct category, the building-block catalogue, the refusal to lock the 2035 ambition to a single wafer size, and the warning that government research contracts should not automatically be counted as production demand are all positions we will endorse as written. The gaps: a KPI table with defined categories and blank cells, a summary table with headers and no content, gate criteria that define success but never define stopping, and a single mention of secure hardware roots where a full assurance pathway should be. Optionality includes the ability to wind an investment down; gates without exit criteria are ratchets.

Quantum Computing and Simulation

The strategic spine is right: quantum computing may stay a diverse field for years rather than a winner-take-all race, so Europe should keep several platforms alive and resist premature down-selection. The draft is also refreshingly honest about dependence on American software, naming OpenQASM, QIR, and the main resource estimators as US-origin tools with no comparable European offering, and the proposed remedy, a sovereign hardware abstraction layer plus shared intermediate representations maintained as pan-European infrastructure, is the cheapest sovereignty win in the whole consultation. Move it from the infrastructure annex to the headline ambitions.

Its rough edges are rougher than most: one 2035 target still carries the placeholder letter B where a logical error rate belongs, and a proposed annealing KPI is followed by the bracketed admission that “this value is made up, but something along this line?” The same passage suggests running the experiments on a D-Wave machine installed in Europe, which for a sovereignty roadmap is its own small finding, since the geography is European and the vendor is not. I have read a great many strategy documents over thirty years. Few are this candid, and the candor is why commenting now works. The draft also argues that recent US acquisitions signal strategic intent toward the European ion-trap supplier base the Chips Act is meant to protect; the supply-chain roadmap already names FDI screening as a key instrument, so our submission will push for the missing piece, common EU criteria and notification triggers for quantum supply-chain transactions.

Quantum Communication

This draft has the most mature security engineering in the set and the most complete KPI numbers of the six: accredited security-testing laboratories, standardized attack-injection platforms for implementation-level testing, and a maintained European repository of attacks and countermeasures. We will endorse all of it and ask for two additions, continuous red-team exercises against deployed pilot networks and a coordinated vulnerability-disclosure process for quantum communication equipment, neither of which the draft currently requires.

It nevertheless opens with the most dangerous sentence of the whole consultation, promising “information-theoretically secure encryption, resilient against any attack.” QKD is a key-establishment mechanism under stated protocol, device, and implementation assumptions; it does not perform encryption by itself, and no deployed system resists every attack. Authentication, endpoints, key management, random-number generation, and operations all stay inside the security boundary, which the draft’s own testing sections plainly understand. The opening claim should be rewritten to match them. The draft is honest elsewhere that European security agencies currently rank PQC ahead of QKD for the near term, and that honesty should be promoted from an aside into a stated principle: PQC migration is the baseline, and QKD is a defence-in-depth layer for selected infrastructures, never a substitute. One number needs a source or a deletion: a projected market of 11 billion to 15 billion USD per year by 2035 appears with no source of its own; the Draghi citation one sentence earlier covers the productivity-gap claim, and only that claim. And credit where due: the description of the June 2026 US executive orders on PQC migration and quantum computing checks out against the primary record, EO numbers and all.

Quantum Sensing and Metrology

Beyond the full-sourceability KPI discussed above, the draft’s visible problem is editing discipline: raw workshop comments are pasted mid-text, including one voice arguing that pilot lines are of little use for cold-atom sensors, with no adjudication from the editors. Dissent is valuable; publish it as attributed consultation input with the roadmap’s own verdict attached. On substance, we will push for GNSS-independent positioning and timing to become the flagship sovereignty use case, with named anchor buyers such as financial-market infrastructure, grid operators, and defence inertial systems, because that is the sensing market where regulation, resilience budgets, and procurement calendars already exist.

The deeper issue is that the draft treats security as an application benefit rather than a property of the sensing system itself. Fielded quantum sensors will face spoofing, saturation, optical and electromagnetic injection, calibration poisoning, compromised firmware, corrupted timing references, and manipulation of the magnetic and gravity reference maps they depend on. Those risks, along with the ownership and integrity of strategic sensor data, belong in the roadmap before software-defined sensing and agentic AI are added as deployment accelerators.

Supply Chain and Enabling Technologies

The reference document, as covered above, and the one whose implementation chapter every other draft should copy: three phases, measurable gate criteria, and a dependency-mapping exercise validated by at least ten European system developers before money scales. Its dual-track cryogenics plan, qualifying helium-3-free magnetic cooling alongside dilution refrigeration to create a deliberate dual-supplier and dual-technology base, is sovereign optionality executed in hardware. One factual fix is needed: the summary table lists a foreign monopoly in dilution refrigerators, but the concentration risk sits in pulse-tube cryocoolers, the pre-cooling stage, while dilution refrigeration itself is a European strength, as the body text correctly says. And one KPI is ambiguous enough to be unusable: a ‘5% increase in global market share’ that never says whether it means percentage points or relative growth.

Standardisation

Aside from the missing PQC workstream, this draft contains the single best governance proposal of the consultation: predefined export-control clearance pathways so that European experts can participate in standards bodies without case-by-case approval for every technical exchange, separating protected know-how from shareable inputs like terminology and test methods. The proposal has grown more urgent since it was conceived, because quantum computers and their cryogenic enabling components have sat on the EU dual-use control list since November 2025 under the new 4A506 entry, binding uniformly across all 27 Member States. The draft also contains the best security sentence, on QKD interfaces: “Security by obscurity is therefore not a sustainable approach.” Kerckhoffs would approve.

The oddities need attention too: a KPI that counts pages of standards published, with a 3,000-page target for 2035, and targets projecting zero participation by research and technology organizations (RTOs) and zero participation funding by 2035, on the theory that neither will be needed, while the same table keeps 15 national metrology institutes engaged. RTOs and metrology institutes are permanent quality infrastructure; measure adoption in procurement and certification instead of page counts. The drafters’ own analogy is the right one: Europe wrote the GSM rules and collected the advantage for two decades, and the layer of this stack most like GSM, the one every industry must adopt on a legal schedule, is PQC.

What the final versions need

Our submissions will keep returning to the same asks. Adopt the supply-chain draft’s control-points doctrine as the sovereignty definition for all six documents and audit every KPI against it. Define one geographic-trust vocabulary, because EU-located, EU-owned, EU-certified, and trusted-partner supplied are four different claims and the drafts use them interchangeably. Use one capability template per architecture class and keep physical and logical qubits separate everywhere. Add the PQC standardization workstream. Put hardware-assurance KPIs next to the resilience KPIs wherever the word trusted appears. Give every gate an exit condition as well as an entry condition. Replace consultancy market estimates and unsourced baselines with the program’s own audited data, which the supply-chain roadmap’s first phase is designed to produce. And add a synergy map from standardization deliverables to the gates they unblock in the other five roadmaps, so the Flagship’s documents stop describing the same stack in mutual isolation. Ambition is cheap; auditability is scarce.

The forms are open

None of the criticism above changes my overall verdict: this is a serious, self-aware consultation, run early enough that comments can still move text, and the two strongest documents, supply chain and communication, are stronger than many national quantum strategies I have reviewed.

So respond before August 16. Read the draft nearest your work, rate its chapters, paste the sentences you want changed, and say why. If you disagree with anything we found, the comment section below is open for that argument too, and I would rather be corrected before we file than after. We will submit our feedback for each of the six roadmaps, and I will share the substance of those submissions here as we go.

Europe asked its quantum community to mark up the plan for the next decade. We should all answer.