Brief

How Telecom Carriers Are Preparing for Quantum

Mobile and fixed network operators have only a few years to build skills for quantum cryptography, computing, and communications before 2030.

Laurent-Pierre Baculard, Frank Ford, Velu Sinha, and Alex Bhak

First published on июня 05, 2026
min read


Резюме Quantum technology poses an outsized and immediate challenge for telcos, with implications spanning network security, infrastructure strategy, and regulation. Post-quantum cryptography is the most pressing priority as “harvest now, decrypt later” threats put today’s sensitive telecom data at risk. Quantum computing has the potential to solve some of telecom’s most complex optimization challenges, but carriers need to build capabilities now to stay ahead of the curve. Quantum communications is one area in which telcos hold a structural advantage—namely, owning the fiber infrastructure makes targeted solutions for high-security use cases commercially viable. Quantum is generating more executive anxiety per unit of understanding than any technology since blockchain. Board members read about quantum computers breaking encryption and ask their chief information security officers (CISOs) whether the sky is falling. Chief technology officers (CTOs) hear about quantum-optimized networks and wonder whether they should be running pilots. Strategy teams see market-sizing decks projecting trillions and cannot distinguish signal from noise. The better starting point is this: Quantum is not one technology; it is four distinct domains—post-quantum cryptography (PQC), quantum computing, quantum communications, and quantum sensing—each operating on a different timeline. The first three apply most urgently to telecom, each requiring a different organizational response. Conflating them is where most carrier leadership teams make their first mistake. It leads either to premature overinvestment across the board or to dangerous complacency on cryptography, the one domain in which the threat is already active. For telecom carriers specifically, the stakes are higher than for most enterprises. Carriers sit at the center of national communications infrastructure. They handle sovereign data, financial transactions, healthcare records, and critical infrastructure signaling. They manage cryptographic dependencies across 5G core networks, subscriber identity systems that serve hundreds of millions of devices, and interconnect agreements that span borders. The quantum question for a carrier board is not abstract; it is operational, regulatory, and strategic all at once. Three domains, three urgency profiles The most practical way to think about quantum for a carrier is not by physics but by action timeline. Each domain demands a different posture. Post-quantum cryptography: Defend now This is the domain that should be keeping CISOs awake. Quantum computers don’t exist yet at the scale needed to break RSA and elliptic curve encryption. But the threat is already here: Nation-state actors are harvesting encrypted data today, banking on the expectation that they will be able to decrypt it once the hardware arrives. For telecom carriers, the risks in that harvested data could last decades. NIST finalized the first three post-quantum cryptographic standards in August 2024 and selected an additional algorithm in March 2025. While many PQC algorithms can run on classical hardware, implementation complexity varies significantly depending on the environment, protocols, and performance requirements, and some use cases may require hardware upgrades or architectural changes. The challenge extends far beyond the algorithms themselves: Every cryptographic dependency across the carrier’s estate, including the 5G core, RAN, transport, SIM and eSIM infrastructure, VPN termination, OSS/BSS, APIs, and interconnect agreements, must be identified, assessed, and migrated. For a major carrier, discovery alone can take 12 to 24 months, creating an increasingly urgent timeline for operators aiming to achieve PQC readiness by 2030. Carriers face unique complexity that most enterprises do not. 5G core authentication protocols are being updated by 3GPP to include PQC options, but migration requires coordinated equipment vendor upgrades across the entire network. Carriers with hundreds of millions of subscribers must upgrade the cryptographic keys and algorithms in hundreds of millions of SIMs and do it so smoothly that customers’ devices keep authenticating and working without any noticeable disruption. Transport layer security termination at carrier-grade throughput (millions of handshakes per second) requires hardware acceleration that most current gear does not support for PQC algorithms. And the regulatory clock is hardening: CNSA 2.0, the NSA’s algorithmic standard for post-quantum cryptography, mandates quantum-safe algorithms for national security systems by January 2027 for new acquisitions. The regulatory clock is also accelerating in Europe, where the European Commission is pushing critical infrastructure sectors, including telecom, toward post-quantum readiness by the end of 2030. In many carrier boardrooms, this should be the first and most concrete quantum discussion. It is enterprise-wide, it is actionable, and it does not depend on a future quantum business case; it depends on the threat model that already exists. Quantum computing: Explore selectively Quantum computing will not optimize your network tomorrow. The technology is converging toward a critical threshold of roughly 100 stable logical qubits, with some players expecting to meet or exceed that level around 2028–2029. Until that threshold is crossed, classical computing still has the edge for most real-world problems. But the learning curve cannot be compressed. Bain’s research with Le Lab Quantique (a French organization aimed at stimulating and integrating quantum capabilities), which is based on in-depth interviews with about 20 executives from major enterprises, confirms that it takes three to four years for a company to build the internal capabilities to gain a competitive advantage from quantum computing. Each use case requires six to nine months of structured work, including business qualification, mathematical modeling, algorithm parametrization, data preparation, computation, and impact assessment. This is not generative AI, in which a proof of concept takes weeks; quantum computing requires different analytical skills and a much longer experimentation cycle. For carriers, several computational problems are strong candidates for a quantum advantage. Network planning and fiber route optimization become more difficult as networks grow denser and more complex, a computational challenge that eventually exceeds the means of classical algorithms. Vodafone (in collaboration with ORCA Computing) has already demonstrated quantum-assisted fiber routing. RAN optimization (beamforming, interference management, Cloud RAN resource provisioning) fits quantum’s sweet spot. Energy management across thousands of cell sites with variable load and grid constraints is another natural fit. But the relevant comparison is always quantum against the strongest available classical approach for a specific problem, not quantum against a vague notion of legacy computing. Carriers will want to gauge the relative ROI of using quantum in these applications compared with currently available approaches. Companies risk falling far behind if they move too slowly. If a competitor masters quantum advantage and resets industry cost structures by operating 30% to 40% more efficiently, laggards face a structural disadvantage that’s difficult to overcome. The right approach isn’t a sweeping quantum transformation agenda; it’s a targeted effort of two or three high-value use cases, tested with cloud-based quantum services or classical emulators and designed to build organizational muscle rather than deliver immediate returns. Quantum communications: Build options Quantum key distribution (QKD) uses the laws of physics, not mathematical assumptions, to guarantee that an encryption key exchange hasn’t been intercepted. This is the domain in which carriers have a genuine infrastructure advantage: They own the fiber. The technology is commercially real at metro scale. BT and Toshiba operate a metro network in London secured by QKD. South Korean mobile operator SK Telecom (in collaboration with ID Quantique) runs one of the world’s largest QKD networks. French telecom Orange (in collaboration with Toshiba) has launched a hybrid PQC-QKD enterprise service. Deutsche Telekom (in collaboration with Qunnect) demonstrated quantum teleportation over 30 kilometers of commercial fiber in Berlin in early 2026. These are no longer lab experiments, but the hype-to-deployment ratio remains high. QKD over fiber is limited to around 100 kilometers without trusted relays. Satellite-based QKD extends reach but remains pre-commercial. Quantum repeaters, the building blocks of a future quantum Internet, are genuinely long term. For most carriers, the right posture is selective: Pilot QKD for high-value segments, such as government, finance, healthcare, and critical infrastructure, in which provable security commands a premium. Do not confuse QKD with PQC; they are complementary. PQC protects everything at scale through software; QKD adds physics-layer security for the most sensitive links. You need both. Mapping the carrier landscape These four domains differ not only in kind but in how urgently they demand action and who in the organization should own the response. PQC sits in the upper right of any urgency map: It touches every carrier and requires a defensive response now. The CISO and the board own it. Quantum computing occupies the middle ground, being selectively relevant and worth exploring where specific high-value problems align but not a blanket mandate. The CTO and network engineering own it. Quantum communications is an opportunity play for carriers with fiber assets and sovereign ambitions. The chief commercial officer and the strategy team should evaluate it. This unevenness is the strategic fact that matters. Not every carrier needs the same playbook. A nationally licensed incumbent with sovereign infrastructure responsibilities has a fundamentally different quantum agenda than a regional mobile operator. A carrier positioning as a sovereign trust anchor for enterprise AI will find that quantum-safe infrastructure is not simply nice to have but rather a prerequisite. An enterprise will not trust its AI workloads to a carrier that cannot guarantee quantum-resistant encryption of the data flowing through the service. The appropriate quantum posture scales with three variables: the carrier’s size, its sovereign role, and its strategic ambition. Sovereign incumbents, including Deutsche Telekom, Orange, BT, NTT, and SK Telecom, need comprehensive PQC programs, active quantum computing experimentation, and QKD pilots. Major operators with enterprise businesses need PQC migration and selective quantum computing experimentation. Smaller carriers and mobile virtual network operators need vendor-driven PQC compliance and a watching brief on everything else. A practical agenda for carrier boards For most carrier leadership teams, the appropriate response has three parts. First, defend now. Post-quantum cryptography should already be on the enterprise risk agenda. Carriers need visibility into cryptographic dependencies across the 5G core, RAN, transport, subscriber identity management, and enterprise services. They need migration priorities driven by data sensitivity and regulatory exposure. They need coordinated timelines with equipment vendors, such as Ericsson, Nokia, and others, as their PQC roadmaps will constrain the pace of migration. Organizations beginning this work in 2026 are already on the outer edge of a responsible timeline. Second, explore selectively. Most carriers do not need a wide portfolio of quantum computing pilots. They need two to three focused efforts linked to high-value problems in which there is a plausible fit between the workload and the technology—for example, network planning, energy optimization, or spectrum allocation. Each opportunity should be evaluated with discipline, problem by problem, against the best available classical approach. The goal is building the organizational capability to recognize and capture quantum advantage when the hardware matures, not chasing headlines. Third, build options. For carriers with fiber assets and sovereign ambitions, QKD piloting in high-value metro segments is a low-regret investment that builds institutional knowledge, tests commercial willingness to pay, and positions the carrier for the emerging sovereign security proposition. For carriers in R&D-adjacent areas (network equipment vendors, for instance), quantum simulation of materials and signal processing is worth tracking through partnerships rather than internal labs. Quantum readiness does not exist in isolation from the broader carrier transformation agenda; it reinforces it. The carrier pursuing autonomous network operations will find that quantum computing extends AI’s reach into currently intractable optimization problems. The carrier positioning as a sovereign trust anchor will find that quantum-safe infrastructure is a condition of maintaining that status. The carrier building the AI dial tone will find that PQC and QKD are prerequisites for the governed, compliant delivery that enterprise customers demand. The telecom industry has navigated technology inflection points before: analog to digital, fixed to mobile, circuit-switched to IP. Each rewarded the operators that prepared early and punished those that waited for certainty. Quantum is the next such inflection. The technology timeline is converging. The regulatory timeline is hardening. By the end of last year, 35 carriers worldwide had active quantum programs. The question for every other carrier board is whether their absence from that list is a deliberate strategic choice or an oversight that needs correcting, starting next Monday morning.

Резюме

Quantum technology poses an outsized and immediate challenge for telcos, with implications spanning network security, infrastructure strategy, and regulation.
Post-quantum cryptography is the most pressing priority as “harvest now, decrypt later” threats put today’s sensitive telecom data at risk.
Quantum computing has the potential to solve some of telecom’s most complex optimization challenges, but carriers need to build capabilities now to stay ahead of the curve.
Quantum communications is one area in which telcos hold a structural advantage—namely, owning the fiber infrastructure makes targeted solutions for high-security use cases commercially viable.

Quantum is generating more executive anxiety per unit of understanding than any technology since blockchain. Board members read about quantum computers breaking encryption and ask their chief information security officers (CISOs) whether the sky is falling. Chief technology officers (CTOs) hear about quantum-optimized networks and wonder whether they should be running pilots. Strategy teams see market-sizing decks projecting trillions and cannot distinguish signal from noise.

The better starting point is this: Quantum is not one technology; it is four distinct domains—post-quantum cryptography (PQC), quantum computing, quantum communications, and quantum sensing—each operating on a different timeline.

The first three apply most urgently to telecom, each requiring a different organizational response. Conflating them is where most carrier leadership teams make their first mistake. It leads either to premature overinvestment across the board or to dangerous complacency on cryptography, the one domain in which the threat is already active.

For telecom carriers specifically, the stakes are higher than for most enterprises. Carriers sit at the center of national communications infrastructure. They handle sovereign data, financial transactions, healthcare records, and critical infrastructure signaling. They manage cryptographic dependencies across 5G core networks, subscriber identity systems that serve hundreds of millions of devices, and interconnect agreements that span borders. The quantum question for a carrier board is not abstract; it is operational, regulatory, and strategic all at once.

Three domains, three urgency profiles

The most practical way to think about quantum for a carrier is not by physics but by action timeline. Each domain demands a different posture.

Post-quantum cryptography: Defend now

This is the domain that should be keeping CISOs awake. Quantum computers don’t exist yet at the scale needed to break RSA and elliptic curve encryption. But the threat is already here: Nation-state actors are harvesting encrypted data today, banking on the expectation that they will be able to decrypt it once the hardware arrives. For telecom carriers, the risks in that harvested data could last decades.

NIST finalized the first three post-quantum cryptographic standards in August 2024 and selected an additional algorithm in March 2025. While many PQC algorithms can run on classical hardware, implementation complexity varies significantly depending on the environment, protocols, and performance requirements, and some use cases may require hardware upgrades or architectural changes. The challenge extends far beyond the algorithms themselves: Every cryptographic dependency across the carrier’s estate, including the 5G core, RAN, transport, SIM and eSIM infrastructure, VPN termination, OSS/BSS, APIs, and interconnect agreements, must be identified, assessed, and migrated. For a major carrier, discovery alone can take 12 to 24 months, creating an increasingly urgent timeline for operators aiming to achieve PQC readiness by 2030.

Carriers face unique complexity that most enterprises do not. 5G core authentication protocols are being updated by 3GPP to include PQC options, but migration requires coordinated equipment vendor upgrades across the entire network. Carriers with hundreds of millions of subscribers must upgrade the cryptographic keys and algorithms in hundreds of millions of SIMs and do it so smoothly that customers’ devices keep authenticating and working without any noticeable disruption. Transport layer security termination at carrier-grade throughput (millions of handshakes per second) requires hardware acceleration that most current gear does not support for PQC algorithms. And the regulatory clock is hardening: CNSA 2.0, the NSA’s algorithmic standard for post-quantum cryptography, mandates quantum-safe algorithms for national security systems by January 2027 for new acquisitions. The regulatory clock is also accelerating in Europe, where the European Commission is pushing critical infrastructure sectors, including telecom, toward post-quantum readiness by the end of 2030.

In many carrier boardrooms, this should be the first and most concrete quantum discussion. It is enterprise-wide, it is actionable, and it does not depend on a future quantum business case; it depends on the threat model that already exists.

Quantum computing: Explore selectively

Quantum computing will not optimize your network tomorrow. The technology is converging toward a critical threshold of roughly 100 stable logical qubits, with some players expecting to meet or exceed that level around 2028–2029. Until that threshold is crossed, classical computing still has the edge for most real-world problems.

But the learning curve cannot be compressed. Bain’s research with Le Lab Quantique (a French organization aimed at stimulating and integrating quantum capabilities), which is based on in-depth interviews with about 20 executives from major enterprises, confirms that it takes three to four years for a company to build the internal capabilities to gain a competitive advantage from quantum computing. Each use case requires six to nine months of structured work, including business qualification, mathematical modeling, algorithm parametrization, data preparation, computation, and impact assessment. This is not generative AI, in which a proof of concept takes weeks; quantum computing requires different analytical skills and a much longer experimentation cycle.

For carriers, several computational problems are strong candidates for a quantum advantage. Network planning and fiber route optimization become more difficult as networks grow denser and more complex, a computational challenge that eventually exceeds the means of classical algorithms. Vodafone (in collaboration with ORCA Computing) has already demonstrated quantum-assisted fiber routing. RAN optimization (beamforming, interference management, Cloud RAN resource provisioning) fits quantum’s sweet spot. Energy management across thousands of cell sites with variable load and grid constraints is another natural fit. But the relevant comparison is always quantum against the strongest available classical approach for a specific problem, not quantum against a vague notion of legacy computing. Carriers will want to gauge the relative ROI of using quantum in these applications compared with currently available approaches.

Companies risk falling far behind if they move too slowly. If a competitor masters quantum advantage and resets industry cost structures by operating 30% to 40% more efficiently, laggards face a structural disadvantage that’s difficult to overcome. The right approach isn’t a sweeping quantum transformation agenda; it’s a targeted effort of two or three high-value use cases, tested with cloud-based quantum services or classical emulators and designed to build organizational muscle rather than deliver immediate returns.

Quantum communications: Build options

Quantum key distribution (QKD) uses the laws of physics, not mathematical assumptions, to guarantee that an encryption key exchange hasn’t been intercepted. This is the domain in which carriers have a genuine infrastructure advantage: They own the fiber.

The technology is commercially real at metro scale. BT and Toshiba operate a metro network in London secured by QKD. South Korean mobile operator SK Telecom (in collaboration with ID Quantique) runs one of the world’s largest QKD networks. French telecom Orange (in collaboration with Toshiba) has launched a hybrid PQC-QKD enterprise service. Deutsche Telekom (in collaboration with Qunnect) demonstrated quantum teleportation over 30 kilometers of commercial fiber in Berlin in early 2026.

These are no longer lab experiments, but the hype-to-deployment ratio remains high. QKD over fiber is limited to around 100 kilometers without trusted relays. Satellite-based QKD extends reach but remains pre-commercial. Quantum repeaters, the building blocks of a future quantum Internet, are genuinely long term. For most carriers, the right posture is selective: Pilot QKD for high-value segments, such as government, finance, healthcare, and critical infrastructure, in which provable security commands a premium. Do not confuse QKD with PQC; they are complementary. PQC protects everything at scale through software; QKD adds physics-layer security for the most sensitive links. You need both.

Mapping the carrier landscape

These four domains differ not only in kind but in how urgently they demand action and who in the organization should own the response.

PQC sits in the upper right of any urgency map: It touches every carrier and requires a defensive response now. The CISO and the board own it. Quantum computing occupies the middle ground, being selectively relevant and worth exploring where specific high-value problems align but not a blanket mandate. The CTO and network engineering own it. Quantum communications is an opportunity play for carriers with fiber assets and sovereign ambitions. The chief commercial officer and the strategy team should evaluate it.

This unevenness is the strategic fact that matters. Not every carrier needs the same playbook. A nationally licensed incumbent with sovereign infrastructure responsibilities has a fundamentally different quantum agenda than a regional mobile operator. A carrier positioning as a sovereign trust anchor for enterprise AI will find that quantum-safe infrastructure is not simply nice to have but rather a prerequisite. An enterprise will not trust its AI workloads to a carrier that cannot guarantee quantum-resistant encryption of the data flowing through the service.

The appropriate quantum posture scales with three variables: the carrier’s size, its sovereign role, and its strategic ambition. Sovereign incumbents, including Deutsche Telekom, Orange, BT, NTT, and SK Telecom, need comprehensive PQC programs, active quantum computing experimentation, and QKD pilots. Major operators with enterprise businesses need PQC migration and selective quantum computing experimentation. Smaller carriers and mobile virtual network operators need vendor-driven PQC compliance and a watching brief on everything else.

A practical agenda for carrier boards

For most carrier leadership teams, the appropriate response has three parts.

First, defend now. Post-quantum cryptography should already be on the enterprise risk agenda. Carriers need visibility into cryptographic dependencies across the 5G core, RAN, transport, subscriber identity management, and enterprise services. They need migration priorities driven by data sensitivity and regulatory exposure. They need coordinated timelines with equipment vendors, such as Ericsson, Nokia, and others, as their PQC roadmaps will constrain the pace of migration. Organizations beginning this work in 2026 are already on the outer edge of a responsible timeline.

Second, explore selectively. Most carriers do not need a wide portfolio of quantum computing pilots. They need two to three focused efforts linked to high-value problems in which there is a plausible fit between the workload and the technology—for example, network planning, energy optimization, or spectrum allocation. Each opportunity should be evaluated with discipline, problem by problem, against the best available classical approach. The goal is building the organizational capability to recognize and capture quantum advantage when the hardware matures, not chasing headlines.

Third, build options. For carriers with fiber assets and sovereign ambitions, QKD piloting in high-value metro segments is a low-regret investment that builds institutional knowledge, tests commercial willingness to pay, and positions the carrier for the emerging sovereign security proposition. For carriers in R&D-adjacent areas (network equipment vendors, for instance), quantum simulation of materials and signal processing is worth tracking through partnerships rather than internal labs.

Quantum readiness does not exist in isolation from the broader carrier transformation agenda; it reinforces it. The carrier pursuing autonomous network operations will find that quantum computing extends AI’s reach into currently intractable optimization problems. The carrier positioning as a sovereign trust anchor will find that quantum-safe infrastructure is a condition of maintaining that status. The carrier building the AI dial tone will find that PQC and QKD are prerequisites for the governed, compliant delivery that enterprise customers demand.

The telecom industry has navigated technology inflection points before: analog to digital, fixed to mobile, circuit-switched to IP. Each rewarded the operators that prepared early and punished those that waited for certainty. Quantum is the next such inflection. The technology timeline is converging. The regulatory timeline is hardening. By the end of last year, 35 carriers worldwide had active quantum programs. The question for every other carrier board is whether their absence from that list is a deliberate strategic choice or an oversight that needs correcting, starting next Monday morning.