Advancing Quantum Safe Transitions: Ethical, Legal, Social, and Policy Dimensions

Expanded Summary: Advancing Quantum-Safe Transitions — Ethical, Legal, Social, and Policy Dimensions

Session Overview and Objectives

The session, held during AI Digital Week in Geneva as part of the World Summit on the Information Society (WSIS) forum, brought together representatives from UNESCO, the ITU, the private sector, and academia to examine quantum-safe transitions through an ethical, legal, social, and policy lens. Shamira Ahmed, from the Data Economy Policy Hub, opened by framing the session's core premise: that quantum-safe migration should be understood not merely as a technical cryptographic upgrade, but as "a broader socio-technical infrastructure transformation that aims to redistribute trust, responsibility, and risk across institutions, markets, and communities." The discussion was informed by an ITU Kaleidoscope paper entitled An Innovation Ecosystem Ethics Approach for Quantum Safe Transitions, whose conference proceedings were already publicly available at the time of the session.

The session carried two explicit objectives. The first was to present and discuss the research findings of the Kaleidoscope paper. The second was to contribute to the development of a forthcoming policy issue brief being produced jointly by UNESCO's Information for All Programme and the ITU. Ahmed described the overarching mission as promoting information for all while supporting ITU's efforts to foster international cooperation, trusted standards, and inclusive digital transformation through quantum technologies — summarised under the banner of "quantum for good." Speakers included Xianhong Hu from UNESCO's Information for All Programme, Gillian Makamara from the ITU, Maikki Sipinen from Verde, and Professor Tommaso Calarco from the University of Cologne and chair of the Quantum Flagship, who joined online.

UNESCO's Perspective: Human Rights, Anticipatory Governance, and the Quantum Divide

Xianhong Hu situated the discussion within the broader context of the third decade of WSIS, noting that the international community is now grappling not only with the Internet and digital technologies but with a wave of emerging technologies — including AI, quantum, and neuroscience — that are "mushrooming so fast and profoundly impacting the concept and the approach of building knowledge societies." She emphasised that UNESCO's mandate, including its Information for All Programme, is built on the principle of building inclusive futures, and that the Global Digital Compact similarly calls for inclusive digital development.

Hu highlighted two key UNESCO resources relevant to the session. The first was a policy brief co-authored with Shamira Ahmed, previously published, which advocated for human rights-centred governance of quantum technology. She described the brief's approach as deliberately balanced — "neither utopianist nor dystopianist" — recognising that quantum technologies could enhance communication, access to information, and human rights, while also posing significant risks to privacy and encryption. The brief argued that governance must be anticipatory, drawing lessons from AI: "we should really think about this governance issue before the technology is mainstreamed and being applied widely." It also called for governance that is agile, inclusive, and human rights-sensitive.

The second resource Hu referenced was UNESCO's Quantum Moment global report, a comprehensive compilation of more than 100 pages drawing on research, outcomes, and surveys from the whole year-long celebration of the International Year of Quantum in 2025. One of its most significant findings was that the quantum divide is already in place, with the human capacity gap identified as the most pressing barrier: 43% of countries lack sufficient human talent to develop quantum technologies. Hu argued that this necessitates a major expansion of quantum education and capacity building, extending well beyond students and researchers to cover professionals and individuals at all levels. She called explicitly for quantum literacy to be mainstreamed "from now on", noting that it is "so much underdeveloped unlike AI literacy, digital literacy." She also flagged a significant gender imbalance, with fewer than 30% of the quantum industry workforce being female — a divide she described as "nothing new" but nonetheless deeply concerning. Hu further noted that UNESCO has a programme specifically designed to enhance policymakers' capacity to understand new technologies, underscoring the importance of equipping decision-makers — not only citizens — with the tools to engage meaningfully with quantum governance.

ITU's Perspective: Standards as a Mechanism for Closing the Security Divide

Gillian Makamara, introducing herself as "primarily a technical person" and an engineer, acknowledged upfront that "it's very hard to incorporate the ethical dimensions" into engineering, though she noted that more is now being done to address this. Building directly on Hu's concept of the quantum divide, Makamara extended the framework to include a security dimension alongside the human capacity dimension. She referenced the ITU's Global Cybersecurity Index, which is published annually and reveals stark disparities between countries in how they are implementing cybersecurity frameworks. Her assessment was blunt: adding the quantum threat to this already unequal landscape "doesn't look good."

Makamara argued that international standards represent one of the most important mechanisms for closing this gap. She noted that standards "don't make headlines, but they really support our systems today", citing the ITU's X.509 standard as the concrete foundation of all current Internet security. In response to the emerging quantum threat, the ITU is actively reviewing this standard to identify vulnerabilities and gaps, with the aim of ensuring that Internet security infrastructure is as robust as possible before the quantum threat materialises. She used a house-building analogy to explain the philosophy behind standards development: standards should serve as a flexible foundation — determining the structure — while leaving room for customisation in terms of specific implementation, so that they remain applicable across diverse economies and contexts.

On the question of inclusivity in standards development, Makamara described the ITU's consensus-based process, which incorporates governments, industry, and academia to create a genuine multi-stakeholder environment. She acknowledged, however, that demographic diversity and gender representation in standards processes remain significant gaps that she could encourage but not mandate. She called on member delegations to include people from different parts of the world and to improve gender distribution in their participation.

Private Sector and AI Governance Lessons: An Ecosystem-Wide Approach

Maikki Sipinen, bringing an industry perspective and a background in AI policy, presented what she described as the core argument of the Kaleidoscope paper: "we should not let the quantum safe transition stay purely a technical conversation." She argued that an ecosystem-wide transformation approach is needed — one that addresses infrastructure, institutions, standards, and values simultaneously rather than sequentially. The danger of treating the transition as a purely technical migration, she warned, is that it fails to answer the most important governance questions: "who gets to decide on the timelines, who bears the risk of quantum, who benefits and who is then accountable if something goes wrong."

Sipinen drew extensively on the trajectory of AI governance as a cautionary and instructive parallel. She noted that AI governance "started as a technical conversation" and only gradually came to be recognised as encompassing fundamental governance questions about whose values are embedded, who bears risk, and who is at the table. She argued that quantum policy should build on these lessons rather than repeat the same slow evolution. However, she was careful to note that AI governance remains incomplete, with persistent challenges including "unequal participation from the global south in standard setting on AI" and the fact that "AI capacity is on global scale to great extent owned and controlled by only a handful of companies." These failures, she argued, must be actively avoided in quantum governance.

Sipinen also introduced a forward-looking argument about the convergence of AI and quantum technologies. She suggested that governance frameworks should increasingly address both together rather than treating them as entirely separate domains, predicting that "in let's say five years we will have a more solid one joint discussion on AI and quantum not separate topics of different sessions." She emphasised that understanding the unique qualities of quantum as an emerging technology is foundational — and that this understanding must be built not just within the technical community but by bringing all stakeholder communities together. It is also worth noting that Patrick Bell, co-author of the Kaleidoscope paper alongside Sipinen and Shamira Ahmed, was physically present in the building during the session and subsequently contributed from the floor.

Europe's Quantum Strategy: Multilateralism, Inclusivity, and the Quantum Act

Professor Tommaso Calarco, from the University of Cologne and chair of the Quantum Flagship, offered a detailed account of Europe's structured approach to quantum governance. He began by noting that Europe's internal experience of harmonising quantum policy across 27 sovereign member states is itself an exercise in multilateralism, providing "the training to go towards overcoming these obstacles and being able to establish cooperation across and beyond the borders of our own countries." He acknowledged that Europe is not a monolith — member states vary significantly in their levels of investment and advancement in quantum technologies — and that the EU has developed "widening participation" programmes to ensure that less advanced member states can participate in European research and innovation excellence. He also acknowledged that gender bias is "unfortunately very strong" in the quantum field and that European policy measures are in place to address this.

Calarco described the forthcoming Quantum Act as representing the first time the European Commission is giving itself a structured and clear policy for international quantum cooperation. He outlined three pillars that have been recommended to and taken up by the Commission: research and science; innovation and industrialisation; and strategic security and protection, which includes standardisation. He emphasised that this framework will be developed jointly between the Commission and member states and will not be treated as a matter of optional participation.

On international cooperation beyond European borders, Calarco cited the Euro HPC joint undertaking for high-performance computing as an example of an initiative in which non-EU countries — including the UK, South Korea, and Japan — are involved in discussions and in some of these initiatives. He also pointed to growing initiatives towards cooperation with Africa and other neighbouring continents. However, he was candid about the geopolitical constraints on such cooperation, acknowledging that "the era of multilateral cooperation and globalization in the positive sense kind of has come to a halt" in what he described as the current "multi-polar world disorder." He argued that international cooperation must therefore be built pragmatically on mutual interests rather than on naive assumptions about globalisation.

Audience Discussion and Panel Responses

The audience discussion significantly enriched the session by introducing concrete structural and political economy arguments that had been implicit but not yet fully articulated by the panel. Wouter Natus from the BORF, coordinator of an IGF dynamic coalition on the implementation of Internet standards, drew on his coalition's study of the social, economic, and political effects of post-quantum cryptography to make a pointed intervention. He argued that the failure to deploy existing Internet security standards — such as DNS security and RPKI — is not a technical problem but a political, economic, and social one: "the topic is not technical. This topic is about political, economic, social, security will to deploy standards." He observed that "everybody leaves the room as soon as the word Internet standard or post-quantum cryptography is mentioned," and identified two structural barriers: the absence of a level playing field (where investing in security creates a competitive disadvantage relative to non-investing competitors) and the absence of economic incentives because "nobody procures secure by design, almost nobody." His proposed solution was for governments and large organisations to mandate secure-by-design requirements — including post-quantum cryptography — in their ICT procurement processes.

Patrick Bell, co-author of the Kaleidoscope paper, built on Natus's intervention by introducing a structured analytical framework from security studies: the three-layer information environment model comprising the physical layer (hardware), the informational layer (data flows and algorithms), and the cognitive or decisional layer (governments and large corporations as strategic decision-makers). He argued that "almost all the discussion" on quantum stays at the technical layer and "very rarely does it go up to the cognitive or decisional layer." He warned that smaller nations without dedicated quantum budgets "essentially accept whatever the vendor gives them", creating long-term vendor lock-in and path dependence. His proposed remedy was to tell decision-makers directly: "unless you're in the room, things are going to be decided for you" — and that participation does not require a PhD in quantum information systems. He also introduced the concept of "Q-Day" — the moment when a fully operational quantum computer could decrypt currently harvested encrypted data — as a concrete and communicable risk narrative for engaging non-technical decision-makers.

A further audience question from Muganatha from DIMAYA raised the "harvest now, decrypt later" threat — the practice of organisations collecting encrypted data now with the intention of decrypting it once quantum computers become operational. The question was raised but the session moved on without a direct response from the panel, though it reinforced the urgency of the quantum-safe transition and aligned with Bell's Q-Day framing.

Xianhong Hu responded to the broader audience discussion by reaffirming the importance of multi-stakeholder governance and quantum literacy. She acknowledged the challenge that quantum is "very abstract physical concept and theory" and that discussions are sometimes gatekept by demands for technical expertise. She argued against this, asserting that "if technology is going to be so revolutionary... every citizen has a right to know." She emphasised that quantum literacy must extend to government officials and policymakers who need to take decisions about quantum technologies in their procurement, regulation, and policy work.

Tommaso Calarco went further, making a strong democratic empowerment argument: "every citizen has a right to say what they want, to be empowered, to determine the direction of future developments." He drew an explicit analogy with voting — one does not need a PhD to participate in democratic governance — and argued that "it is of paramount importance to get the decision makers not only in the room, but also ready to listen to what society wants." He directly endorsed the Kaleidoscope paper's framing of the problem as an ecosystem governance issue rather than a purely technical or cybersecurity issue, and confirmed that the Quantum Act's three-pillar structure — research, innovation and industrialisation, and strategic security and protection — reflects exactly this integrated ecosystem approach.

Conclusions and Unresolved Challenges

The session concluded with broad consensus across all speakers and audience participants on several foundational principles: that quantum-safe transitions are socio-technical governance challenges requiring genuine multi-stakeholder engagement; that the quantum divide is real, multidimensional, and already in place; that quantum literacy must be mainstreamed across all levels of society; that AI governance offers useful but imperfect lessons; and that international standards, while critical, must be complemented by political will, economic incentives, and inclusive processes.

Nevertheless, the session also surfaced important unresolved tensions. A productive tension existed between Makamara's standards-centred approach and Natus's argument that the real barrier is the absence of political and economic will to deploy standards that already exist. A further tension existed between the aspirational calls for broad citizen empowerment and quantum literacy and the empirical reality that 43% of countries lack even the basic human talent to develop quantum capabilities, and that even professional decision-makers are rarely engaged in quantum governance discussions. The question of how to ensure equitable participation from the Global South — given that similar challenges remain unresolved in AI governance — was raised but not concretely resolved. Similarly, how to build genuine multilateral cooperation in the current multi-polar world disorder, and how to address the immediate "harvest now, decrypt later" threat, were identified as urgent priorities without clear resolution within the session.

The session's two concrete outputs — the publicly available ITU Kaleidoscope paper and the forthcoming UNESCO-ITU policy issue brief — were presented as vehicles through which the community could continue to contribute to these unresolved questions, with participants encouraged to engage with both processes.