Study Finds Quantum Industry Relies on Cross-Border Supply Chains
A survey of 160 quantum companies, published on September 23, 2026, revealed that almost none build quantum technology using only domestic suppliers. Ninety percent reported using at least one foreign supplier, and 74% reported at least one foreign customer. According to the Global Quantum Supply Chain report, the typical company relies on suppliers from three countries and sells into three others.
This finding contrasts sharply with how governments often discuss quantum technology. National strategies frequently promise sovereign capability and protected critical technology. However, the data indicates that companies actively working in the field, including the smallest ones, already depend on international partners. This article will explore the study’s findings and then examine four 2026 initiatives that exhibit the same pattern.
Key Findings from the Global Study
The report was a joint effort by industry consortiums, including QED-C (United States), QuIC (Europe), Quantum Industry Canada, UK Quantum, Japan’s Q-STAR, and Korea’s KQIA, with additional engagement from India’s ecosystem. Respondents hailed from 15 countries and identified suppliers in 36 countries, customers in 49, and manufacturing sites in 25.
The United States, Germany, the United Kingdom, Canada, and Japan were most frequently cited as both supplier and customer locations. Component suppliers reported selling into more countries than firms building complete quantum systems, which aligns with an industry where specialized parts travel further than finished machines. As a bloc, the European Union ranked second most frequent for both suppliers and customers, according to QuIC’s Cécile Perrault.
Virginia’s Hub Relies on Transatlantic Hardware
In 2026, George Mason University announced the Virginia Quantum Hub, a state-backed initiative aimed at establishing a quantum presence in Northern Virginia. The central machine for this hub will come from TreQ, an Oxford-based company that builds open-architecture systems.
This illustrates a U.S. public initiative depending on a UK vendor for its core hardware. It’s important to note the current status: the hub has been announced, TreQ has completed the system design, but the machine is not yet operational. This represents a plan with a foreign anchor, not a fully operational sovereign capability. It perfectly aligns with the study’s predictions and serves as a single illustrative case, not statistical proof of import ratios.
Switzerland’s Proposed PQC Center
On September 21, 2026, WISeKey, SEALSQ, and the Canton of Jura signed a memorandum of understanding to establish a Swiss post-quantum semiconductor and cybersecurity center.
WISeKey and SEALSQ are Swiss firms partnering with a Swiss canton, so this does not appear to be a cross-border partnership at first glance. The captured release only provides the headline and date, lacking details on scope, funding, site, or timeline. Its relevance lies in the product category: post-quantum secure chips. These depend on semiconductor fabrication, IP, and equipment that no single country can supply end-to-end. An MoU is merely a statement of intent, not a built facility, and details that would confirm any foreign dependency are not yet available.
Fujitsu Opens its Quantum Software Globally
Fujitsu released OpenQARP, a quantum application package, as a v0.1.0 Apache 2.0 open-source project in September 2026. More than 80 organizations had previously accessed a beta version through Fujitsu’s Quantum Simulator Challenge, which ran on the company’s 40-qubit simulator.
A Japanese firm making its software available under a permissive license invites developers worldwide to build upon it. This demonstrates a software supply chain that crosses borders by design. It’s worth noting the precision: the 80-plus organizations accessed the tool through a challenge, and OpenQARP is an early release.
The Cross-Border Nature of Security Layers
Post-quantum cryptography (PQC) exhibits the same pattern within security products. Vendors selling quantum-readiness solutions assemble them from components manufactured elsewhere. For example, Sectigo’s PQC tooling relies on a hardware security module (HSM) partnership with Crypto4A, a Canadian company. This means a U.S.-facing certificate vendor depends on foreign HSM hardware. Similarly, Arqit, which presents as UK-based, markets symmetric-key products for the same market.
These claims are attributed to the vendors’ own promotional materials. Two clarifications are essential. PQC and Quantum Key Distribution (QKD) are distinct: PQC operates on classical hardware using NIST-standardized algorithms (e.g., FIPS 203, 204, and 205), whereas QKD requires specialized quantum links. Also, no cryptographically relevant quantum computer currently exists, meaning these products address a future threat, not a present one. The standards themselves are believed to be secure, though not yet proven unbreakable.
Policy Implications of Cross-Border Dependency
The study’s authors frame their findings around two conflicting goals: maintaining access to trusted suppliers and markets while protecting critical technology. Jonathan Legh-Smith of UK Quantum highlighted the inter-governmental Quantum Development Group’s April 2026 communique as a coordination mechanism, and QED-C’s Celia Merzbacher cited ICQIA’s new charter.
Export controls remain an unanswered question in the report. None of the sources captured document specific U.S., EU, or China regimes impacting quantum components. This means any government tightening controls on quantum components could disrupt the very links these companies depend on, and the extent of this exposure has not been publicly mapped.
For buyers and planners, the takeaway is clear. Before labeling a capability as sovereign, inquire about the origin of your hub’s hardware, chips, and cryptographic modules. Consider the consequences if a single foreign supplier is cut off. The voices gathered on World Quantum Day 2026 consistently emphasized international collaboration, and the supply chain data explains why. Complete self-sufficiency is not the operational plan for any of these programs.