Europe’s Quantum Industry Association Asks the EU for Faster Export Licensing

October 15, 2026 – The European Quantum Industry Consortium (QuIC) asked the European Commission to make licensing under the EU’s quantum export controls faster and more consistent across the EU’s 27 member states. QuIC set out its requests in a position paper, Optimising Dual-Use Controls for European Quantum Technologies, which it published as input to the Commission’s evaluation of the EU Dual-Use Regulation on the day the Commission’s public consultation and call for evidence closed.

QuIC, a non-profit association founded in 2021 whose members include small and large companies, investors, research organizations and universities, said it supported targeted controls on sensitive quantum items and was not asking for new obligations on exporters. It said member states applied the rules inconsistently, and that exporters faced long and unpredictable lead times, duplicated classification work and legal uncertainty as a result. QuIC also said the regulation should be aligned with the EU Quantum Act, which it described as forthcoming.

QuIC gave no figures on how long licensing takes in any member state. In one of its recommendations, QuIC asked the Commission to publish exactly those figures, for each member state and each type of authorization, in the Commission’s annual report on the regulation.

Regulation (EU) 2021/821, the Dual-Use Regulation, governs exports of goods, software and technology that have both civilian and military uses. Article 26(4) requires the Commission to evaluate it from September 10, 2026, with a deadline of September 10, 2028, and to report its main findings to the European Parliament, the Council and the European Economic and Social Committee. The Commission opened its consultation on July 23 and ran a targeted survey of businesses and research institutes until September 11.

Quantum computers that meet the control list’s technical parameters have been controlled at EU level since November 15, 2025, when Commission Delegated Regulation (EU) 2025/2003 entered into force. The Commission said the update added quantum computers to Annex I, the EU’s list of controlled dual-use items, along with cryogenic cooling systems, parametric signal amplifiers, cryogenic wafer probers and electronic components designed to work at cryogenic temperatures. Several member states, the Netherlands among them, had already imposed national quantum export controls after Russia reportedly blocked consensus on adding such items to the list of the Wassenaar Arrangement, the multilateral regime whose list forms most of Annex I.

QuIC’s Requests on How Member States Process Licenses

QuIC asked the Commission and member states to:

• introduce digital, interoperable e-licensing with common data fields in every member state, pointing to the e-services of Finland’s Ministry for Foreign Affairs and to Austria’s PAWA portal;
• publish license processing times per member state and per type of authorization in the Commission’s annual report under Article 26, and agree indicative EU benchmarks for standard applications;
• notify approvals to other member states, as Article 16 already requires for denials;
• have each member state’s classification decisions recognized by the authorities of the others;
• give the Emerging Technology Expert Group, a body of member-state experts that the Commission announced in September 2021, the task of issuing non-binding technical classification opinions on quantum items within 30 days at most;
• offer advance assessments of whether a planned export could be authorized, which would not replace the authorization itself;
• align customs practice across member states.

In its annual report on the regulation, dated June 25 and covering 2024, the Commission counted 19 member states that used an e-licensing system.

The Emerging Technology Expert Group had begun risk assessments of quantum technologies by March 2023, according to a Council record of that month. For the advance assessments, QuIC pointed to Germany’s and Austria’s Voranfrage, France’s demande de classement and the Netherlands’ indelingsverzoeken.

EU001, South Korea and a General Authorization for QKD

Under EU001, the Union general export authorization for allied destinations, exporters in any member state can ship dual-use items listed in Annex I, apart from the exclusions in Annex II, to Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland including Liechtenstein, the UK and the US without an individual license, subject to the authorization’s conditions. QuIC asked the Commission to extend EU001 to further trusted partners, beginning with South Korea, and then to other economies with equivalent control regimes. It cited Finland’s national general authorization FI003, under which Finnish companies have been able to export eligible dual-use items to South Korea since May 2026 after notifying the Ministry for Foreign Affairs.

QuIC also asked for guidance confirming that the quantum items added to Annex I in 2025 can be exported under EU001. QuIC wants a single definition of trusted-partner destinations: the EU001 countries plus named additions such as South Korea.

For quantum communication, QuIC said EU008, the general authorization for encryption items, covers only selected entries and excludes quantum cryptography. Exporters of quantum key distribution (QKD) systems, key management systems and network software therefore need individual or national authorizations, QuIC said, even for destinations where comparable conventional encryption products can ship under EU008.

QuIC asked the Commission to extend EU008 or create a dedicated general export authorization for these items. It also asked the Commission to clarify how EU008’s exclusion of items approved to process classified information applies to products accredited for EuroQCI, the EU’s quantum communication infrastructure initiative, or for national government networks.

On partners’ license exceptions, QuIC asked the Commission to seek equal treatment for all member states, for example under the US License Exception Implemented Export Controls (IEC). It said only some member states benefit for certain items. As an example, it cited cryogenic items under US export control classification number (ECCN) 3A904, for which the US lists Germany, Italy, Finland, the Netherlands, Norway and the UK.

Remote Maintenance, Quantum Cloud Access and Classification Guidance

On intangible transfers of software and technology, QuIC asked for Commission guidance developed with industry instead of new controls, and it warned against regulating these transfers prematurely. It called for “a safe harbour for remote operation and maintenance,” under which remote monitoring, calibration, bug fixes and software or firmware updates for lawfully exported systems would not count as a new controlled transfer, provided no development or production technology subject to control is passed on.

QuIC wants the Commission to use that guidance to distinguish submitting jobs to a quantum computer and receiving the results from accessing controlled software, standalone quantum algorithms, source code or technical know-how, including for users who connect from outside the trusted-partner group. It also proposed model end-use clauses.

On classification, QuIC asked for guidance covering quantum computing, communication and sensing alike. It asked the Commission to clarify whether software that manages, stores or routes keys falls under the quantum cryptography entry or the general encryption entries in Category 5 Part 2, and how to classify hybrid products that combine QKD with post-quantum cryptography.

For future reviews of the control list, QuIC proposed treating fully operational systems separately from enabling components, and limiting any relief for the latter to passive sub-assemblies. It asked the Commission to guide licensing authorities on applying the existing catch-all provisions consistently. It also asked for compliance expectations that small companies and research spin-offs can meet.

Member Reports and the Paper’s Contributors

QuIC said some members reported having already lost customers because of shipment delays, and others found it increasingly hard to win commercial contracts. It said European quantum companies were losing revenue and paying very high legal fees under the current rules. Members also reported that customs officers often lacked the technical means to verify a classification and sent the file back to the exporter, which added weeks to a single shipment.

QuIC did not say how many members reported these problems or which member states and destinations were involved. It did not describe how it collected the input, though it offered follow-up interviews. The 30-day limit for classification opinions is the only time period in its recommendations.

QuIC listed 13 contributors, led by David Morcuende of QuIC and Ulrich Mans of QuantWare, a Dutch maker of superconducting quantum processors. The others work at QURECA, IDEADED, Pasqal, planqc, Indra Group, Qilimanjaro Quantum Tech, Qblox, Falqon Systems, IQM Quantum Computers, Bluefors and QuIC; the QuIC contributors include its executive director, Cécile Perrault. QuIC acknowledged funding from the EU’s Horizon Europe program under the QOMPASS grant agreement.

My Analysis

I agree with most of QuIC’s requests. QuIC supports them with member reports of lost customers, high legal fees and weeks lost at customs, but with no measured licensing time for any member state. QuIC’s members say they have lost business. They have not said how often, how long they waited or where in the process they lost the time.

Without processing times for each member state, QuIC cannot show whether European quantum exporters lose days or months to licensing, or which of its requests would recover most of that time. I would put the processing-time request first, because with those figures the Commission could rank the others.

Which of QuIC’s Requests Need New Legislation

On my reading of the regulation, the Commission and member states can deliver most of these requests without new legislation. Parliament and the Council would have to legislate for a QKD general authorization, and possibly for remote-maintenance relief beyond the existing notes in Annex I.

The Commission must finish the evaluation by September 10, 2028. It can add South Korea to EU001, issue guidance and add processing times to its annual report before then. For a QKD general authorization, the Commission would have to propose an amendment for Parliament and the Council to adopt, a longer route than a delegated act.

The Commission’s Annual Report Has No Licensing Times

Article 12(5) leaves the processing period for license applications to national law or practice, so no EU rule sets a maximum. Under Article 26(2), the Commission must report each year on authorizations by number and value, denials, administration, enforcement and authorizations for cyber-surveillance items. Processing times are not on that list.

In the June report, the Commission counted €77.6 billion of authorized dual-use exports in 2024, 3% of the EU’s goods exports outside the bloc, and 487 denials. It gave no processing times for any member state.

Some member states publish national figures. In its 2025 report to parliament, France gave an average of 30 calendar days for individual dual-use licenses in 2024, down from 32 in 2023, counted from the date its licensing office accepts an application as admissible and including the time exporters take to supply more information. Under French rules, five months without a decision counts as a refusal. France publishes one average for all dual-use licenses, with no separate figure for quantum items or for the slowest cases.

Member states already exchange licensing data at least once a year under Article 23, following guidelines drawn up by the Dual-Use Coordination Group, a body of member-state representatives chaired by the Commission. The regulation’s examples of that data are the value and type of each license, its destination and the number of users of general authorizations. Adding the application date and the decision date to the exchange would, on my reading, need the group’s agreement and no change to the regulation.

The UK, an EU001 destination, publishes licensing times every quarter. In the first three months of 2026, the median processing time for standard individual export license applications was 18 working days on SPIRE, the UK’s older licensing system, and 16 on LITE, the system replacing it. Of the applications closed in the quarter, a count that includes withdrawn cases and those that needed no license, 55% on SPIRE and 66% on LITE closed within 20 working days, against a target of 70%. The UK missed its own target that quarter, and because the figures are public, British exporters can see by how much.

What the Netherlands Publishes About Export Licensing

Bits&Chips, a Dutch technology publication, ran a feature on October 16 on the state of the Dutch quantum industry. Its editor, Paul van Gerven, wrote that Dutch export procedures were much slower than those in the US, Switzerland and Israel, and that each extra month spent waiting for a permit gave foreign competitors a chance to win customers. He gave no processing times either.

On its licensing page, the Dutch government states that the CDIU, the customs unit that handles export licenses, assesses an application within eight weeks. The CDIU decides itself on exports to EU and NATO countries, Switzerland, Japan, Australia and New Zealand. It refers every other destination to the Ministry of Foreign Affairs, which can consult the intelligence services, so a Dutch application to ship a controlled item to South Korea, Israel or Singapore goes through the ministry.

I could not find published figures on how long those decisions take in practice.

Dutch exporters have needed licenses for specified quantum items since December 1, 2024, when national controls took effect, according to a June 2025 letter to parliament from the State Secretary for Foreign Affairs. The US added the Netherlands to its license exception for quantum computers on December 2, 2024, the next day. In almost two years of Dutch quantum licensing, exporters and the CDIU have recorded application and decision dates that, as far as I can find, nobody has published.

Three of the paper’s 13 contributors work at Dutch companies. Ulrich Mans works at QuantWare, one of the merchant QPU vendors that sell processors to other system builders; QuantWare says it serves more than 50 customers across 20 countries. Freeke Heijman-te Paske works at Qblox, which makes control electronics for quantum computers. Michiel Plaisier works at Falqon Systems, the QuTech spin-out formerly called Q*Bird that builds quantum-secure networks. Falqon’s products are a measurement-device-independent QKD series, a key manager and a domain controller for network orchestration, the same three kinds of product QuIC listed for quantum communication in its table. Heijman is also QuIC’s vice president and a cofounder of Quantum Delta NL. Bits&Chips quoted her on industrial policy in the same feature.

South Korea, EU001 and the US License Exception

Of the allied-trade requests, the South Korea extension has the clearest legal route. Under Article 17(2), the Commission can add destinations to a general authorization by delegated act after consulting the Dual-Use Coordination Group. Parliament and the Council then have two months to object, a period either of them can extend by two more.

South Korea and the UK each accounted for 7% of the value authorized under individual and general authorizations in 2024, according to the Commission’s report. The Commission gave no destination breakdown for global authorizations, which made up 47% of all authorized value. Individual authorizations for South Korea covered €2.6 billion, 10% of all value licensed that way, against €1.2 billion and 5% for the UK. France alone reported €2.2 billion of individual licenses for South Korea in 2024, so the EU-wide total is a poor measure of quantum trade.

Exporters can use EU001 for eligible items going to the UK. For South Korea, they need individual or global licenses unless one of the narrower Union general authorizations or a national one, such as Finland’s FI003, covers the shipment.

QuIC called South Korea a partner with a comparable control regime but left out the strongest evidence for it. South Korea’s trade ministry added quantum computers, cryogenic refrigerators and measurement equipment for cryogenic temperatures to its strategic-items list from February 28, 2025, more than eight months before the EU’s quantum entries took effect. In a September 2026 revision, the ministry added AI chips and chipmaking equipment that the US, the EU and Japan already control.

South Korea does not appear in the US license exception table for any quantum entry. The Bureau of Industry and Security (BIS), which administers US export controls, marks the table as last modified on December 2, 2024, nearly three months before Korea’s quantum entries took effect. Korea’s absence from it is therefore no evidence about how Korea’s rules compare with those of the countries in the table.

In the 2025 regulation, the Commission replaced only Annex I. It left Annex II, including its list of items excluded from general authorizations, unchanged. On my reading, the new quantum entries already qualify for EU001, subject to its conditions. QuIC wants the Commission to confirm that in guidance.

With South Korea added, EU companies could ship quantum computers there without an individual license. Member states would first want to compare the technical parameters of Korea’s quantum entries, which the ministry’s announcement does not give, with those of the EU. They can make that comparison without waiting for the evaluation.

QuIC’s request for equal treatment under the US exception is a matter for negotiation with the US government. BIS lists eight of the 27 member states as eligible destinations for quantum computers under ECCN 4A906: Denmark, Finland, France, Germany, Italy, the Netherlands, Slovenia and Spain. Its table predates the EU-wide quantum controls of November 2025.

QKD, Key Management and Remote Maintenance

In its table of friction points, QuIC listed QKD systems, key management and network orchestration software under Category 5 Part 2 with no performance threshold. QuIC said these items need individual or national authorizations even where conventional encryption products can ship under EU008.

If the Commission modeled a QKD general authorization on EU008, the same limits would apply. According to Sweden’s licensing authority, exporters cannot use EU008 for military, police, intelligence or state-security end users, or for items accredited to handle classified information. In its guidance, Ireland’s Department of Enterprise, Tourism and Employment lists the destinations EU008 excludes, among them China, Russia, Israel, Saudi Arabia and the UAE. Under such an authorization, exporters would still need licenses for QKD sales to security agencies.

I would not trust critical systems to QKD today, but I think continued investment in it is warranted. QKD vendors lose time and pay legal fees for every individual or global license they need. On my reading, the general authorization QuIC wants would need an amendment to the regulation.

Post-quantum vendors have a stake in QuIC’s question about key-management software and hybrid products. A vendor that combines QKD keys with ML-KEM (CRYSTALS-Kyber) key establishment needs to know how authorities will classify the product. Eligibility for EU008 would still depend on each product’s functions. In Ireland’s guidance, EU008 covers 5A002.a.2 for networking equipment and 5A002.a.3 for computers, both with encryption, plus related software and technology. A dedicated hardware key manager, whose primary function is information security, falls under 5A002.a.1 and outside EU008, with or without a QKD component.

Part of the remote-maintenance relief QuIC wants is already in Annex I. Under its General Technology Note, controls do not apply to the minimum technology necessary to install, operate, maintain or repair an item whose export was authorized. Under the General Software Note, the same applies to the minimum necessary object code, except for software in Category 5 Part 2.

QuIC wants more: relief for calibration, bug fixes and software updates as long as no development or production technology passes. For an exported quantum computer, the notes already cover part of that work. For an exported QKD system, the software note does not apply, so the vendor’s firmware updates get no relief under it. The Commission can explain in guidance how far the notes reach. To go further, the EU would have to change the control list or the regulation.

Licensing Data QuIC’s Members Already Have

QuIC does not have to wait for the Commission to start measuring.

Its members have records of every license application they have filed since the EU-wide controls took effect in November 2025, and the Dutch members’ records go back to December 2024. QuIC could follow each application from submission through the licensing office’s confirmation that the file is complete, any requests for more information, the decision and customs release, including applications still pending or withdrawn.

If QuIC published those records by member state and destination group, with sample sizes, medians and 90th percentiles, readers could see the typical wait, the cases long enough to put contracts at risk and the stage where the time goes. QuIC could bring a first version to the Commission’s Export Control Forum in Brussels on November 20. With it, the Commission could decide whether faster decisions, clearer classification, customs changes or broader general authorizations should come first.

From the author