Quantum Computing: The Future We Need to Govern Before It Arrives

For much of its history, quantum computing has occupied an unusual place in technology. It has been close enough to attract serious research and investment, yet distant enough to remain largely abstract for most businesses and members of the public. It promised extraordinary computational power, but often without a clear explanation of when that power might become useful, who would gain access to it, or how society should prepare.

That distance is beginning to narrow.

Investment is rising, governments are treating quantum capability as strategically important, and researchers are steadily improving the hardware, algorithms, and error correction required to make quantum systems useful beyond controlled demonstrations. McKinsey reported that investment in quantum technology start-ups reached approximately $12.6 billion in 2025, more than six times the previous year, with most of that capital directed towards quantum computing. The commercial timelines remain uncertain, and genuine quantum advantage will not suddenly make every classical computer obsolete, but the direction of travel is increasingly difficult to ignore.

At White Rabbit Foundry, we find that extraordinarily exciting.

Quantum computing could help researchers explore areas that remain stubbornly difficult for even the most powerful conventional computers. It could deepen our understanding of chemistry, accelerate the discovery of new materials, support more sophisticated drug development, improve optimisation across complex systems, and help scientists simulate parts of the physical world with far greater accuracy.

It could contribute to better batteries, new catalysts, more efficient supply chains, stronger materials, and medical discoveries that would otherwise take years to identify. These are not merely opportunities to make existing processes faster. In the most promising cases, quantum computing could make previously inaccessible forms of discovery possible.

Yet the same capabilities that make the technology exciting also make early governance essential.

We should not wait until quantum computing becomes sufficiently powerful, widely accessible, and commercially embedded before deciding what responsible use looks like. By that point, the incentives, infrastructure, and concentration of control may already be difficult to change. The lesson from previous waves of technology is not that regulation should block innovation. It is that governance introduced only after widespread harm tends to become blunt, reactive, and disruptive.

With quantum computing, we have an opportunity to do better.

Traditional computers process information using bits, which represent either a zero or a one. Quantum computers use quantum bits, or qubits, which can behave in ways that have no direct equivalent in ordinary computing. Through properties such as superposition and entanglement, quantum systems can represent and manipulate particular kinds of information differently from classical machines.

This does not mean a quantum computer will perform every task faster. For writing documents, processing payroll, hosting websites, streaming films, or running most everyday business software, conventional computers are likely to remain more practical and economical. Quantum computing is not a universal replacement for classical computing. It is a specialised form of computation that may be extraordinarily powerful for a narrower set of problems.

That distinction matters because the public conversation can easily slip into the same exaggeration that has surrounded artificial intelligence. A breakthrough in one carefully selected experiment becomes a claim that everything is about to change. Genuine progress is flattened into either hype or dismissal, leaving businesses uncertain about what to believe.

The more credible opportunity lies in hybrid systems. Classical supercomputers will continue to handle the majority of computation, while quantum processors may be introduced for specific parts of a problem that match their strengths. In practice, the future may look less like every company owning a quantum computer and more like organisations accessing specialist capability through tightly managed cloud infrastructure, research partnerships, and regulated providers.

That model creates enormous possibilities, but it also concentrates power.

Perhaps the most compelling applications sit within chemistry and materials science. Nature is quantum mechanical, yet simulating complex molecular behaviour using classical computers becomes extraordinarily demanding as the number of interacting particles increases. Quantum computers are attractive precisely because their underlying behaviour may be better suited to modelling other quantum systems.

If that promise is realised, researchers could explore molecular structures, reactions, and material properties with greater precision. Pharmaceutical teams might test potential interactions earlier in the discovery process. Engineers could search for lighter, stronger, or more sustainable materials. Energy researchers could investigate better catalysts, more efficient batteries, or compounds relevant to carbon capture and industrial decarbonisation.

The value would not come from a machine spontaneously inventing a medicine or material. It would come from expanding the range of possibilities scientists can model, test, and understand before committing years of laboratory work and significant capital.

There are also possible applications in optimisation, where organisations need to choose among an enormous number of potential combinations. Logistics networks, production schedules, financial portfolios, energy systems, and transport planning can all involve decisions that become more difficult as the number of variables and constraints increases. Quantum approaches may eventually help with some of these problems, although the precise areas where they offer durable advantage over increasingly capable classical methods still need to be demonstrated.

This is why our excitement should remain ambitious but disciplined. Quantum computing may transform particular fields without becoming a universal answer to every computational problem. Recognising that limitation does not weaken the case for investment. It helps direct attention towards the places where the technology might genuinely matter.

The most immediate reason to care about quantum computing may not be what it enables us to discover, but what it could allow someone to uncover.

Much of the modern digital economy relies on public-key cryptography. It protects financial transactions, confidential communications, authentication systems, government information, healthcare records, and the infrastructure used to establish trust across the internet. These protections are effective because solving the mathematical problems beneath them would take classical computers an impractical amount of time.

A sufficiently capable quantum computer could change that calculation.

The algorithms required to threaten widely used forms of public-key encryption are already known. The missing component is a large and reliable enough quantum computer to run them at a meaningful scale. We do not know exactly when that threshold will be reached, but uncertainty is not the same as safety.

The Economist recently drew attention to the risk of “harvest now, decrypt later”. An attacker does not need a cryptographically relevant quantum computer today to create a future problem. They can collect encrypted information now, preserve it, and attempt to decrypt it once the required technology becomes available. Any information that needs to remain confidential for many years is therefore potentially exposed before the visible quantum breakthrough occurs.

The good news is that organisations do not need to wait for quantum hardware to mature before responding. Post-quantum cryptography uses mathematical approaches designed to resist known quantum attacks while operating on conventional computers. Standards are already available, and migration guidance is being published by security authorities.

The difficult part will be implementation.

Cryptography is embedded across software, hardware, cloud services, sensors, industrial systems, medical devices, connected products, and older infrastructure that may no longer be actively supported. Organisations first need to understand where vulnerable cryptography exists, which information requires long-term protection, and which systems will be hardest to upgrade.

This is not a problem that can be solved by installing a single patch shortly before a hypothetical “Q-day”. It is a long migration programme requiring inventory, prioritisation, supplier engagement, architectural change, testing, and continuing cryptographic agility.

The organisations that begin now will have options. Those that wait may find themselves forced into rushed changes across critical systems.

The need for early action extends beyond encryption.

Quantum computing is a dual-use technology. The same capability that could support medical discovery or climate modelling could also be used to undermine security, accelerate surveillance, strengthen offensive cyber operations, or create strategic advantages concentrated within a small number of governments and corporations.

This does not mean access should be closed or research should retreat behind national borders. Scientific openness, international collaboration, and commercial experimentation have all contributed to the progress made so far. Excessive restrictions could slow beneficial research, duplicate effort, deepen inequality, and leave smaller countries or institutions dependent on a few dominant providers.

But unrestricted access is not a neutral position either.

When capability has consequences beyond the individual user, access becomes part of governance. We already accept this principle in areas such as aviation, pharmaceuticals, nuclear science, and financial infrastructure. Different levels of capability come with different responsibilities, oversight, and controls.

Quantum computing may require a similarly graduated model.

Researchers should be able to explore and challenge the technology. Businesses should be able to experiment with legitimate use cases. Start-ups should not be excluded simply because established companies can absorb larger compliance costs. At the same time, access to the most security-sensitive capabilities may need stronger identity verification, use restrictions, audit trails, independent oversight, and carefully designed export controls.

The objective should not be to decide that quantum computing is too dangerous to use. It should be to prevent a situation where fear, abuse, or a major security incident causes governments and organisations to impose sudden restrictions after dependence has already formed.

Artificial intelligence provides a useful, although imperfect, comparison.

Generative AI spread rapidly because the tools were accessible, compelling, and easy to use. Governance, provenance standards, copyright rules, platform controls, and public understanding developed much more slowly. By the time many institutions began responding, AI-generated content had already become deeply embedded across search, social media, education, marketing, software development, and professional work.

The result has not been a uniform catastrophe. AI has created genuine value and enabled work that would previously have required far more time or specialist support. Emily, our own virtual assistant, exists because of that progress.

But the weaknesses of reactive governance are becoming visible.

The term “AI slop” has entered everyday language to describe the flood of low-effort synthetic content created primarily to occupy feeds, attract clicks, or manipulate ranking systems. Major platforms are now introducing labels, reporting mechanisms, detection systems, and restrictions intended to preserve quality and trust. LinkedIn has introduced a way to flag suspected AI slop, while YouTube has strengthened its approach to synthetic and repetitive content. Some organisations have also found that more visibly human content performs better than automated material, although robust evidence for a platform-wide collapse in human engagement remains limited.

The important signal is not that all AI-generated content is bad. It is that reducing the cost of production without protecting quality can overwhelm the environments in which content has value. When every system optimises for volume, the result is not infinite engagement. It is declining trust, fatigue, and a search for spaces that still feel recognisably human.

We are also seeing how late intervention can produce abrupt changes to access. In June 2026, Anthropic said it was required by a United States export-control directive to suspend foreign-national access to its Fable 5 and Mythos 5 models, resulting in the models being disabled for customers so the company could comply. Whatever view one takes of that decision, it demonstrates the operational consequences of governance arriving through sudden restriction rather than predictable rules established before dependency forms.

Quantum computing presents a chance to avoid repeating that pattern.

Technology regulation is often framed as a contest between innovation and control. That is too simplistic.

Good governance can make adoption possible by creating confidence. Businesses invest when they understand the rules. Researchers collaborate when responsibilities are clear. Customers use services when they believe their data and interests are protected. Providers build durable products when access requirements are predictable rather than politically improvised.

For quantum computing, that means beginning with the risks we can already identify.

Governments should support urgent migration to post-quantum cryptography, particularly across critical infrastructure and data that must remain confidential for many years. Providers should build cryptographic agility into products so security methods can be changed without rebuilding entire systems. Procurement standards should require suppliers to explain their migration plans rather than relying on vague claims of being “quantum ready”.

Access to advanced quantum services should also be designed deliberately. Providers need to know who is using sensitive capability, what systems are connected to it, and whether certain workloads require additional review. Auditability should be built into infrastructure from the beginning, not added after misuse. Clear processes will also be needed for handling research that reveals new vulnerabilities without suppressing legitimate scientific inquiry.

International alignment will be essential. Quantum capability will not respect national borders, while fragmented standards could encourage regulatory arbitrage or divide research into incompatible blocs. At the same time, global agreement should not become an excuse for inaction. Countries can begin by aligning technical standards, sharing migration guidance, coordinating risk classifications, and establishing common expectations for responsible providers.

Most importantly, regulation needs to be proportionate to capability. A student learning through a small cloud-based quantum simulator should not face the same controls as an organisation operating a machine capable of threatening widely used cryptography. Rules that fail to distinguish between education, experimentation, commercial use, and strategic capability will either become ineffective or unnecessarily restrictive.

Most organisations do not need to begin purchasing quantum hardware or recruiting large specialist teams. They do need to understand where the technology could affect them and where preparation already has value.

The first priority is cryptographic visibility. Businesses should identify which systems depend on vulnerable public-key algorithms, where long-lived sensitive information is stored, and which suppliers control important parts of their security architecture. This is valuable even if a cryptographically relevant quantum computer remains years away, because organisations frequently lack a complete picture of their existing cryptographic dependencies.

The second priority is strategic literacy. Leaders do not need to become quantum physicists, but they should understand what quantum computing is likely to help with, what it is unlikely to improve, and how access may develop. Industries involving chemistry, materials, pharmaceuticals, finance, logistics, energy, or complex scientific modelling should pay especially close attention to emerging applications and partnerships.

The third priority is governance. Businesses exploring quantum services should decide in advance what information may be submitted, which use cases require approval, how results will be validated, and who remains accountable for decisions. The novelty of a technology should never be allowed to obscure ordinary responsibilities around privacy, security, quality, and human oversight.

Preparation should not be mistaken for panic. The objective is not to reorganise an entire business around a technology that has yet to mature. It is to avoid being surprised by a transition that may require more time than expected.

We are excited about quantum computing precisely because its potential reaches beyond incremental efficiency.

It could allow scientists to ask better questions of the physical world. It could expand what can be modelled, discovered, and designed. It could contribute to progress in medicine, energy, materials, logistics, and fields we have not yet considered.

But excitement should not require naivety.

The lesson of the internet was not that openness was a mistake. It was that platforms and incentives established during rapid expansion can become difficult to govern once billions of people depend on them. The lesson of AI is not that accessible models should never have been released. It is that capability, safeguards, provenance, and accountability need to develop together.

Quantum computing gives us a rare opportunity. The most consequential capabilities are not yet universally available, but the risks are visible enough to prepare for. Standards exist. Migration can begin. Governance models can be tested before the technology becomes deeply embedded.

We should use that time.

The question is not whether quantum computing should be allowed to transform the world. It is whether we can build the conditions for that transformation to remain useful, secure, and broadly beneficial. Because the worst outcome would not be that quantum computing fails to arrive. It would be that it arrives without the trust required for society to use it.