Marin Ivezic
On August 13, 2024, NIST published three finished post-quantum cryptography standards, closing an eight-year selection process. On the same day, and every day since, no quantum computer anywhere could solve a power flow problem larger than a teaching exercise. Both statements are accurate, and together they explain the most common mistake energy executives make with this technology: treating quantum computing as one decision when it is two.
Post-quantum cryptography, or PQC, means classical algorithms designed to resist attack by a future quantum computer. It runs on ordinary hardware, it has published standards, and the migration is a multi-year engineering programme with dates attached. Quantum computing as a tool for grid optimization, battery chemistry, or demand forecasting is something else entirely: a research bet on machines that do not yet exist at the required scale.
These two decisions have different owners, different time horizons, different budget sizes, and different failure modes. Confusing them is how a utility ends up funding a pilot that produces a conference slide while its metering fleet quietly accumulates cryptographic debt. This guide separates them, and gives you a screening test for the proposals that will arrive on your desk.
What has actually been demonstrated on the compute side
The theoretical case for quantum computing in energy is genuinely strong in places and weak in others. The gap between those places is where most of the vendor noise sits.
Grid and network optimization
A grid operator solves the same family of problems every day. Unit commitment decides which generating units run over the coming hours. Optimal power flow decides how much each one produces and how power moves across the network, subject to physical limits. Network partitioning divides a system into sections that can operate independently during a fault. Two of the three are combinatorial: the number of possible configurations in unit commitment and in partitioning grows explosively with the number of assets, so an exact answer becomes unreachable. Optimal power flow is a large nonconvex continuous optimization, sometimes with discrete controls layered on top, and it is normally handled with approximations or convex relaxations. In all three cases the operator runs on a very good approximation rather than an exact answer.
Quantum optimization is proposed as a better approximation. The method most often named is QAOA, the Quantum Approximate Optimization Algorithm, a hybrid procedure in which a quantum processor prepares candidate solutions and a classical optimizer tunes the parameters that produced them. It runs on what the field calls NISQ hardware, meaning Noisy Intermediate-Scale Quantum machines: enough qubits to be interesting, too much error to run long calculations reliably.
Serious work is happening here. NREL has built quantum-in-the-loop testbeds that couple a quantum processor to grid simulation hardware, so algorithms can be tested against something closer to real system behaviour than a spreadsheet. E.ON has tested quantum annealing on network partitioning. These are the right experiments to be running.
What none of them has produced is a result that beats a good classical solver on a real network. The demonstrations run on reduced models, typically tens of nodes, against baselines that are not always the strongest available. Commercial mixed-integer solvers have had four decades of tuning and run on hardware that costs a fraction of a cryogenic dilution refrigerator. Any proposal claiming quantum advantage on a grid problem today should be read with that comparison in front of you.
The honest read: grid optimization is a research programme with a plausible long-term case and no near-term operational payoff. Fund it as research, if at all.
Materials and chemistry
This is the strongest theoretical case, and it is worth understanding why. The behaviour of electrons in a molecule is itself a quantum mechanical problem. Classical chemistry codes approximate it, and the approximations degrade badly for strongly correlated systems, which is exactly the category that includes many battery cathode materials, catalysts, and CO₂-binding compounds. A quantum computer simulates a quantum system directly, without that particular approximation.
The applications follow: electrode and electrolyte design for higher-density storage, catalysts for green hydrogen and lower-energy ammonia synthesis, sorbents and metal-organic frameworks for carbon capture. Volkswagen has a materials programme with Xanadu aimed at cathode compounds. IBM and Daimler published early work calculating energy states of lithium-containing molecules relevant to lithium-sulfur chemistry. The German Aerospace Center has run quantum simulation projects on electrode materials.
Every one of those results involves molecules small enough that classical methods can also handle them, which is how the quantum answers were checked. Getting to industrially useful chemistry requires error correction, and this is where the physical-versus-logical distinction becomes the number you should ask about.
A physical qubit is a piece of hardware. It is noisy, and how long it holds its quantum state depends on the hardware, from microseconds on many superconducting devices to seconds on some trapped-ion systems. A logical qubit is an error-corrected qubit assembled from many physical ones, with the redundancy used to detect and fix errors as the calculation runs. Ratios vary by architecture, but the overhead is large: hundreds to thousands of physical qubits per logical qubit is the range currently discussed. Published demonstrations have reached tens of logical qubits. Resource estimates for chemistry problems of industrial interest run into the millions of physical qubits.
So when a vendor tells you their machine has a thousand qubits, the useful follow-up is which kind, and what error rate. Physical qubit counts have become a marketing number in this sector, and treating them as capability is the single most common way an energy company misjudges a proposal.
IBM’s published roadmap targets a fault-tolerant system in 2029. That is an announced target, not a demonstrated capability, and roadmaps in this industry have moved before. Plan against the announcement as a possibility, not a delivery date.
Forecasting and market analytics
Utilities forecast demand, price risk, and optimize portfolios of generation and contracts. Quantum machine learning is pitched as an improvement on all three. EDF has worked with Pasqal on forecasting demand from electric vehicle charging. E.ON has explored quantum approaches to pricing and risk modelling.
Here we would encourage the most scepticism of the three areas, and the reason is structural rather than about hardware maturity. Quantum machine learning has no established advantage on classical data. Demand forecasting is a classical-data problem: you have years of meter reads, weather history, and price series, and the binding constraint is usually data quality and model specification rather than compute. Loading a large classical dataset into a quantum processor is itself expensive enough to erase most theoretical speedups. A quantum computer doesn’t improve a forecast whose weakness is that nobody modelled behind-the-meter solar properly.
The market-side problems with a better case are the combinatorial ones, unit commitment and portfolio optimization under constraints, which puts them back in the same category as grid optimization: research, not procurement.
The decision that already has dates
The cryptographic side of quantum is a different kind of problem, and it is the one we would put first on an energy executive’s agenda. It has published standards, published transition dates for some organizations, and an asset base that turns over slowly.
The threat model has a name: harvest now, decrypt later, or HNDL. An adversary captures encrypted traffic today, stores it, and decrypts it once a sufficiently capable quantum computer exists. The relevant question is not when that machine arrives but how long your data and your equipment need to stay trustworthy.
For most utilities, the exposure is less about secrecy than about authenticity and equipment lifetime. Consider firmware signing. A substation controller, a protection relay, or a smart meter verifies firmware updates using a digital signature, today almost always RSA or ECDSA. Both are broken by a large enough quantum computer running Shor’s algorithm. Gidney and Ekerå’s 2019 resource estimate put factoring RSA-2048 at roughly twenty million noisy physical qubits running for about eight hours, far beyond anything built since. Estimates of this kind have been revised downward as the algorithms and the error-correction schemes improve, and that direction of travel is what to plan against.
Now put that next to the asset. Pull the specified service life of your metering fleet, your RTUs, and your protection equipment. If any of it is expected to be in service past 2035, and its trust anchor is a hardcoded RSA or ECDSA public key with no field-updatable path, then the device you procure this year is a migration problem you have already bought. That is a procurement specification question, answerable this quarter.
The standards, by their proper names
NIST’s finished standards are ML-KEM (formerly CRYSTALS-Kyber) for key establishment, ML-DSA (formerly CRYSTALS-Dilithium) for digital signatures, and SLH-DSA (formerly SPHINCS+) as a hash-based signature alternative with different security assumptions. A fourth signature scheme, FN-DSA (formerly FALCON), was still in draft as this was written. Use the current names in specifications. Vendor documents still carrying only the competition names are usually documents that have not been revised since selection.
For organizations touching national security systems, the NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) sets its own algorithm requirements and transition dates, and those dates reach further into the supply chain than many defence-adjacent energy suppliers expect.
What regulation is doing, and what is moving faster
NERC CIP does not currently mandate post-quantum cryptography, and we wouldn’t advise waiting for it to. In practice three other pressures arrive first. Procurement language moves fastest: large buyers add crypto-agility clauses to contracts, and suppliers who cannot answer them lose bids. Insurance questionnaires have begun asking about cryptographic inventory. And clients with their own regulatory exposure push requirements down to their energy suppliers.
Crypto-agility means building systems so the cryptographic algorithm can be changed without replacing the system. Configurable rather than hardcoded algorithms, certificate and key formats that can accommodate larger post-quantum keys, and a firmware update path that can itself be re-signed under a new scheme. It is cheap to specify at procurement and expensive to retrofit.
The inventory comes first
None of it is actionable without an inventory of what you actually have. A cryptographic bill of materials, or CBOM, is a structured inventory of the cryptographic assets in a system: which algorithms are used, where, with what key lengths, by which components, and with what dependencies. It is the equivalent of a software bill of materials for cryptography.
For an energy company the inventory has an awkward property. Corporate IT is the easy part. The hard part is operational technology: substation automation, SCADA, distribution management systems, metering head-ends, and the vendor-supplied equipment where nobody at the utility knows what algorithm is running inside because nobody ever needed to. Scoping that inventory realistically, including the OT estate and the third-party equipment, is the first deliverable of any credible migration programme. Methodology for that work is set out in detail at pqcframework.org.
Where QKD fits
Quantum key distribution, or QKD, uses the physics of single photons to distribute encryption keys, with the property that eavesdropping disturbs the quantum states and can be detected. Oak Ridge National Laboratory has demonstrated it on a live utility fibre network, authenticating traffic between grid control systems.
It is real physics and a real demonstration. It’s also, for almost every utility, the wrong place to spend money right now. QKD needs dedicated fibre or trusted relay nodes, it addresses key distribution rather than authentication, and it does nothing for the firmware-signing problem described above. The NSA has published its position that it does not support QKD for national security systems, citing exactly this kind of limitation alongside the cost of specialized hardware. If a vendor presents QKD as the answer to your quantum risk, they’ve answered a question you didn’t ask.
A screening test for quantum proposals
You will receive proposals. Some are good. Six questions separate them, and none requires a physics background.
1. Which of the two decisions is this? A cryptography proposal and a compute proposal have almost nothing in common. If the deck covers both, the vendor is selling breadth rather than depth.
2. Physical or logical qubits? Ask for both numbers and the error rate. A proposal that quotes only a physical qubit count is quoting a marketing figure.
3. Demonstrated or announced? Separate what has been run and published from what is on a roadmap. Roadmaps in this industry slip, and the slippage is not evenly distributed across vendors.
4. What is the classical baseline, and who chose it? Any claimed advantage is a comparison. Ask which classical solver, on what hardware, tuned by whom. A quantum result that beats a naive baseline has told you about the baseline.
5. Is the bottleneck actually compute? For forecasting and analytics, the answer is usually no. It is data quality, model specification, or organizational latency in acting on the output. None of those improves with a quantum processor.
6. What do you keep if the hardware disappoints? The best near-term pilots produce retained value regardless of the quantum outcome: a problem formulated cleanly for the first time, a cleaner dataset, an improved classical solver, and a handful of people who now understand the technology well enough to evaluate the next proposal. Fund pilots that pass this test. Decline pilots whose only output is a result.
What readiness looks like inside an energy organization
Readiness is mostly about named people rather than technology.
Someone owns the cryptographic inventory. Not as a project, as a standing responsibility. That person needs authority across IT and OT, because the OT half is where the inventory is hard and where the long-lived assets sit.
Someone in procurement can write and evaluate crypto-agility language. This is the most valuable skill in the whole programme, because every contract signed without it extends the migration by the service life of whatever was bought.
Someone in planning or operations research can read a quantum paper critically. Not write algorithms. Read a claimed result and identify the classical baseline, the problem size, and the gap to your actual network. One such person prevents a great deal of wasted budget.
Someone at board level can distinguish the two decisions. In our experience this is where the confusion originates, and it propagates downward as mixed signals about urgency.
The skills gap here is specific and worth naming. A QED-C workshop bringing quantum researchers together with electric sector participants surfaced a mismatch running in both directions: energy participants expected practical results sooner than the quantum researchers thought realistic, while the quantum side underestimated the reliability and integration constraints of grid operations. Neither group is wrong about its own field. The gap is that very few people know both, and hiring for the combination is difficult because the combination barely exists yet. Building it internally is currently the cheaper path.
The two ways this goes wrong
Over-investing in compute, under-investing in cryptography. This is the more common failure and the more expensive one. Quantum computing pilots are visible, they generate good press, and they are intellectually satisfying. Cryptographic inventory work is tedious, it involves arguing with equipment vendors, and it produces a spreadsheet. The pilot is optional for the next decade. The spreadsheet is not, and every procurement cycle that passes without crypto-agility requirements adds years to the eventual migration.
Treating the whole subject as vapour until a regulator says otherwise. The compute side can reasonably wait. The cryptographic side cannot, because the constraint is your asset replacement cycle rather than the technology’s maturity. A utility that begins its inventory when a mandate lands will be starting a five-year programme against a shorter deadline, on equipment it can no longer specify.
The balanced position is unglamorous and cheap. Run the cryptographic inventory now. Put crypto-agility into procurement now. Keep the compute work small, joint with a research partner, and structured so the organization retains something either way. Revisit the compute question when someone demonstrates a logical-qubit result on a problem resembling yours, rather than when a roadmap says they will.
Building the capability
Most of what is described here is a skills problem before it is a technology problem. The inventory needs people who understand both PKI and substation automation. The procurement clauses need people who can tell ML-KEM from a marketing claim. The compute proposals need someone who can ask the six questions and understand the answers.
Quantum Academy’s programs are built for exactly that gap, with separate tracks for executives who need to make the funding decision and for the technical staff who will run the migration. You can review the current program portfolio at quantumacademy.com/. Assessments are practitioner-focused rather than theoretical, and the migration content follows the same methodology published at pqcframework.org.
For deeper technical background on the underlying algorithms and the threat model, PostQuantum.com covers the research literature in more detail than a field guide can.
Start with the inventory. Everything else is easier once you know what you have.