A good quantum strategy for boards starts with one question: “What is our quantum strategy?” Once a director asks it, the question enters the minutes and becomes a management mandate.
A memo for independent directors and CEOs on how to oversee quantum computing, and for the CIO office on the answer the board needs.
Summary
When a director asks about quantum strategy, the question enters the minutes and becomes a management mandate. A credible answer fits on two pages and covers four things:
- where the organisation is exposed, and who owns each part of that exposure;
- the posture chosen for each relevant domain, and the alternative that was rejected;
- an owner, a budget envelope and the observable events that would change the position;
- the date on which the board will see the question again.
“Nothing yet, and here is why” is a legitimate answer when it carries the same reasoning, ownership and review date.
This memo gives directors three questions to ask, a place for quantum on the board’s oversight calendar, and seven warning signs to look for in management’s answer. It gives the CIO office the structure of the two-page memo that answers the board.
Situation: a minuted question becomes a mandate
Quantum computing usually reaches the board through an individual director. They may have read about a competitor’s announcement, heard a regulator discuss post-quantum security, or sat on another board that has already debated the topic. The question is asked once and recorded in the minutes.
From that moment it belongs to management. The board secretary tracks it, the CEO passes it to the CIO or CTO office, and the office typically has one board cycle to respond. It has to answer with imperfect evidence: estimates of commercial usefulness vary by many years, hardware roadmaps keep moving, and AI already fills most of the technology agenda.
The precision of the question shapes the quality of the answer. “Are we doing anything on quantum?” invites a list of activities. A precise question gives management something specific to answer and gives the board a standard to hold management to.
Complication: three answers that leave the board unable to judge
Boards usually receive one of three answers. Each sounds reasonable, and none tells directors whether the company’s position is defensible.
The activity report. A list of pilots, partnerships, conferences and training sessions. It records what was done and leaves out what was decided, what was learned and what would change.
The technology briefing. An explanation of qubits, error correction and vendor roadmaps. It may educate the board, yet it moves the discussion towards forecasts that specialists dispute and away from the company’s own exposure.
The quiet deferral. “It is too early for us.” This is often a sound judgement, and it is often recorded nowhere. With no owner, evidence, criteria or review date, the reasoning has to be rebuilt each time the question returns.
The director’s role is to confirm that management has a reasoned position and a mechanism that signals when the position should change. The choice of technologies stays with management.
Three questions about quantum strategy for boards
1. Where are we exposed, and who owns each part?
Exposure has three parts with different owners: computational dependence (the CIO or CTO with business owners), competitive tempo (strategy) and cryptographic exposure (the CISO). The first two shape the company’s quantum posture. The third runs on its own track and deserves separate board attention, because public authorities have already set its timetable.
In the EU, the coordinated roadmap published by the NIS Cooperation Group in June 2025 asks Member States to start the transition to post-quantum cryptography by the end of 2026, to protect high-risk use cases by the end of 2030, and to migrate as many systems as feasible by 2035. In the UK, the National Cyber Security Centre has set migration milestones for 2028, 2031 and 2035.
For organisations within the scope of NIS2, Article 20 requires management bodies to approve cybersecurity risk-management measures, oversee their implementation and follow training, and it allows members to be held liable for infringements. Post-quantum migration therefore sits on the board’s cyber-risk agenda, whatever the company decides about quantum computing as an opportunity.
2. What is our position, and which alternative did we reject?
For each relevant domain, management should state a posture: lead, follow, prepare or monitor. Lead means building capability now on a small number of owned problems. Follow means being ready to act quickly on validated external evidence. Prepare means closing named gaps in data, baselines and skills at low cost. Monitor means keeping a light watch with defined triggers and a named owner. Directors can leave the method to management and ask for evidence that it was applied.
The most useful follow-up question is: which alternative did you reject, and why? A position that names its alternative has been tested. A position that names none is usually a default.
The relevant comparison is the best available way to solve the business problem, whether that is classical computing, GPUs, HPC, AI, quantum or a combination. If a better classical method wins today, that is a business finding worth reporting. Any claim of improvement also needs a documented baseline, so directors should ask what each result was measured against.
3. Who owns it, what would change it, and when will we hear again?
This is the governance question, and boards skip it most often. A credible answer names an executive owner and a bounded budget, which may be zero. It lists a small number of observable events that would change the position, and it sets a review date.
Useful triggers include a credible result on a problem comparable to one of the company’s own, a peer moving a workload into operations, a material change in hardware capability or cost, and a regulatory change. Supplier roadmap dates are assumptions to test, and they make weak triggers.
Triggers must work in both directions. Evidence can justify more commitment, and it can equally justify stopping an experiment, narrowing the scope or continuing to wait. A trigger list that can only increase commitment describes a programme looking for funding.
Putting quantum strategy for boards on the oversight calendar
A minuted question needs a home after the first answer. Directors can agree where each part is overseen and how often, at the meeting where management responds.
| Topic | Where it is overseen | Cadence |
| Quantum posture and investment | The board, or its strategy or technology committee where one exists | Annual review, plus any meeting at which a trigger fires |
| Post-quantum cryptography migration | The risk or audit committee, within cyber-risk oversight | Each regular cyber-risk report, measured against the applicable milestones |
| Triggers and external evidence | The executive committee, through the named owner | Quarterly, with escalation to the board when a trigger fires |
The minutes should record the posture adopted, the owner, the review date and the forum that tracks evidence. When the topic returns, directors start from that record.
Seven warning signs in management’s answer
Directors can test any answer against a short list. Each warning sign has a counterpart that a credible answer shows.
| Warning sign | What a credible answer shows |
| The answer is a vendor presentation. | The company’s own problems, data and baselines. |
| Progress is measured by the number of pilots or partnerships. | Decisions taken and evidence gathered, including negative results. |
| No baseline is mentioned. | The current method each experiment was compared against. |
| Ownership sits with an innovation team alone. | A named executive owner, with a business owner for each domain. |
| Every trigger points towards more spending. | Triggers that can also pause, narrow or stop work. |
| Post-quantum migration is funded from the innovation budget. | A security programme with its own owner, budget and milestones. |
| The review date is “when the technology matures”. | A calendar date and a list of observable events. |
What the CIO office should bring back: the two-page board memo
The answer fits on two pages, with supporting analysis in an appendix.
Page 1: the position
- The answer in one sentence, for example: “We will prepare in two computational domains and monitor elsewhere; no dedicated quantum budget is requested this year.”
- Exposure across its three parts, with the owner of each.
- The posture for each relevant domain and the main alternative rejected, with the reason.
- The budget envelope, which may be zero, and the executive owner.
Page 2: the evidence and the review mechanism
- The problems inventoried and the baselines established.
- The approaches compared and the results to date, including negative results.
- Post-quantum migration status against the applicable milestones, provided by the CISO.
- The triggers that would change the position, in either direction.
- The forum that tracks evidence and the date of the next board review.
If the honest answer is “nothing yet”, the memo keeps the same length and structure. Its reasoning and its review mechanism are what make waiting a strategy.
Actions before the next board cycle
- Ask the three questions and minute them. Owner: chair or lead independent director. Record the question, the forum responsible and the date the answer is due.
- Name an executive owner. Owner: CEO. Make that person accountable for the position memo and for tracking triggers between reviews.
- Prepare the two-page memo. Owner: CIO/CTO office, with business owners, strategy and finance. State the rejected alternative for each domain.
- Report post-quantum migration separately. Owner: CISO. Present status against the applicable milestones to the committee responsible for cyber risk.
Success is easy to recognise. The next time a director asks “What is our quantum strategy?”, the answer takes two minutes: the position, the evidence, the owner and the conditions under which it will change. The same discipline then applies to the next computing technology that reaches the board.
Part of the QuantumOps Executive Series by QCentroid: practical guidance for leaders building a repeatable, evidence-based and governed approach to advanced computing.