Two very different things get called the quantum internet, and confusing them is why so much coverage feels overblown. One is a research programme: a network that moves quantum states between machines, still years from anything you could buy. The other is a security deadline with published dates that already shows up in procurement questionnaires. This guide separates the two: what a quantum network is, where it genuinely stands in 2026, and what a business should be doing meanwhile.
Key Takeaways
- The quantum internet moves quantum states between machines. It is not a faster version of the internet you use today.
- The best demonstrations in 2026 connect two or three nodes over tens of kilometres, not whole cities.
- Quantum key distribution works, but the NSA, the UK NCSC and Germany’s BSI all decline to recommend it for general use.
- The change that affects ordinary companies now is post-quantum cryptography, and it comes with published deadlines.
- NIST expects RSA-2048 and ECC-256 to be deprecated by 2030 and disallowed after 2035.
- The first useful step costs almost nothing: find out where your systems use encryption and who owns changing it.
What the Quantum Internet Is
The internet you use today moves bits. Every message, payment and video call is a stream of ones and zeros, copied from one machine to the next along the way. A quantum internet moves something different: quantum states, carried by single particles of light and held in devices called quantum memories.
Those states live in qubits, the quantum version of a bit. A qubit can hold a mixture of 0 and 1 at once, a property called superposition, and that mixture collapses to a single value the moment anyone measures it. The fragility sounds like a defect. In a network it is the point: an eavesdropper cannot read a qubit in transit without leaving evidence.
The second ingredient is entanglement. Two particles can be prepared so that measuring one immediately tells you something about the other, however far apart they are. This is often described as instant communication, and that description is wrong. Entanglement on its own carries no message, and you still need an ordinary classical channel to make sense of the result. What it gives you is a private correlation shared between two distant points, which is exactly the raw material an encryption key is made of.
So the honest description is narrow. A quantum internet would sit alongside the classical internet and do a few things it cannot: distribute keys that cannot be silently copied, link separate quantum computers into one machine, and synchronise sensors and clocks with unusual precision. It will not make your web pages load faster.
Why Copying Is Impossible, and Why That Limits Distance
Physics forbids duplicating an unknown quantum state, a result known as the no-cloning theorem. It is what makes eavesdropping detectable, because an attacker has to measure the traffic to read it, and measuring changes it.
It also creates the central engineering problem. Because a qubit cannot be copied, it cannot be amplified the way a classical signal is boosted along a fibre. Quantum networks instead build long links out of short ones and stitch them together in a step called entanglement swapping. Do that reliably and you have a quantum repeater, the component that separates a laboratory link from an actual network.
For a business reader the consequence is simple. Quantum networking is a security and computing technology, not a bandwidth technology. It sits closer to how quantum computers work than to anything in your network cupboard. If your problem is moving more data faster, the answers are ordinary ones such as better 5G coverage or processing data closer to where it is created.
How a Quantum Network Actually Works
A working quantum link has three parts: a source of entangled photons, a fibre or free-space path to carry them, and memories at each end that hold the state until both sides are ready. Miss one and you have a demonstration rather than a network.
Distance is the hard limit. Photons are absorbed as they travel through glass, and beyond roughly 100 kilometres of fibre so few survive that the link stops being practical. Classical networks solve this with amplifiers along the route. Quantum networks cannot, for the no-cloning reason above.
Two workarounds exist. The first is the trusted node, a relay that receives one key, decrypts it and encrypts it onward. Most deployed QKD networks rely on it, but the relay sees the key in the clear, so whoever operates that node has to be trusted in the ordinary, boring sense of the word. The second is the quantum repeater, which extends entanglement without ever exposing the key in the middle. That is the real target, and it is why the 2026 results below matter.
One piece is missing entirely: standards. There is no equivalent of TCP/IP for quantum networks, no agreed way to address nodes, route traffic or handle errors across different vendors’ equipment. Until that settles, every quantum network is a bespoke installation.
What It Could Mean for Business Later
Once the engineering is solved, the benefits are real but narrow. A quantum network would distribute keys that cannot be silently copied, join several modest quantum processors into one larger machine, and support clocks and sensors that beat classical accuracy limits. That is the whole list.
Where the First Real Users Will Be
- Banking and market infrastructure: a handful of high-value links between data centres, where dedicated fibre is easy to justify and regulators already ask about long-term security posture.
- Government and defence: national networks where the requirement comes from policy rather than a business case.
- Healthcare and research: genomic and patient data that must stay confidential for decades, already a pressure point in healthcare digitisation.
Notice the pattern. Every credible early case involves a few fixed sites with an unusual need for secrecy, not a distributed workforce or a hybrid cloud estate.
Where Quantum Networking Stands in 2026
2026 produced the clearest results the field has seen, and the numbers are worth reading carefully.
In February 2026, a team at the University of Science and Technology of China led by Jianwei Pan reported device-independent quantum key distribution over 100 kilometres of fibre, using entanglement held between memories at two separate nodes. Device-independent means the security argument holds even if you do not trust the hardware you were sold. That approach had previously worked only over a few hundred metres.
In the same month, Qunnect and Cisco demonstrated entanglement swapping across 17.6 kilometres of deployed commercial fibre between Brooklyn and Manhattan, on Qunnect’s GothamQ testbed. They reported roughly 5,400 entangled pairs per hour over that fibre, with polarisation fidelity above 99%. Small in absolute terms, but it happened on working city fibre rather than a laboratory bench.
Now set those numbers against the roadmaps. In November 2025, Cisco and IBM announced a partnership to link quantum computers into networked machines, with a first proof of concept targeted about five years out and a quantum computing internet in the late 2030s. In Europe, EuroQCI is moving from pilots toward operational capability, with activity starting from 2026 at the European Commission’s Joint Research Centre in Ispra, Italy, alongside a prototype satellite, Eagle-1, developed with the European Space Agency.
Two or three nodes, seventeen kilometres, a few thousand entangled pairs an hour, a target of the late 2030s. Genuine progress, and nowhere near a product you can budget for next year.
Quantum Key Distribution and Why Security Agencies Are Cautious
QKD is the one piece of quantum networking you can buy today, which makes it the piece most often oversold. The agencies whose job is protecting classified traffic have declined to endorse it, and their reasons are instructive.
The US National Security Agency set out five objections, and the UK’s NCSC and Germany’s BSI reached the same conclusion. QKD needs its own dedicated physical infrastructure. It is expensive. Real hardware has been broken by attacks on the equipment rather than the physics. It does not scale across large networks. And the quantum channel cannot authenticate the other end by itself, so you still need conventional cryptography to prove who you are talking to.
The numbers reinforce the point. Commercial systems run reliably to about 100 kilometres over fibre. Key generation rates sit in the tens of kilobits per second, fine for refreshing keys and useless for encrypting a gigabit link outright. Any network larger than a single link needs trusted nodes, which quietly reintroduces the human trust QKD was sold as removing.
None of this makes QKD worthless. It makes it a niche product for a few point-to-point links where the threat model justifies the cost. For everyone else, all three agencies point to the same alternative.
The Deadline That Actually Affects You: Post-Quantum Cryptography
Post-quantum cryptography, usually shortened to PQC, means ordinary software algorithms running on ordinary computers, designed so that a future quantum computer cannot break them. No new fibre, no new hardware, no physicists. NIST standardised the first set in 2024 as FIPS 203, 204 and 205, and this is what quantum-safe encryption means in practice.
The urgency has a name: harvest now, decrypt later. An attacker copies your encrypted traffic today and stores it until a machine capable of breaking it exists. Anything you send now that still has to be secret in 2035 is effectively exposed already. That covers patient records, signed contracts, long-lived credentials and intellectual property, and it is where protecting employee and customer data stops being a paperwork exercise.
The Published Deadlines
- NIST IR 8547 (November 2024): RSA-2048 and ECC-256 deprecated by 2030 and disallowed after 2035.
- CNSA 2.0, covering US national security systems: new acquisitions must support quantum-resistant cryptography from 1 January 2027, software and firmware signing by 2030, exclusive use for web, cloud and operating systems by 2033.
- European Union (NIS Cooperation Group, June 2025): cryptographic inventories by the end of 2026, high-risk critical infrastructure migrated by 2030, medium-risk systems by 2035.
- UK NCSC: cryptographic discovery by 2028, high-priority systems migrated by 2031, full transition by 2035.
These are government timetables, but they set the pace for everyone. If you sell to the public sector, to banks or to critical infrastructure, your customers’ deadlines arrive on your desk through their procurement questionnaires, exactly as privacy requirements did.
The migration is further along than most people assume. Cloudflare reports that more than 65% of human web traffic across its network already uses post-quantum encryption, and it has set 2029 for full post-quantum security, including authentication, across its products. Much of that happened silently, inside browser and server updates nobody had to approve.
What to Do in the Next Twelve Months
- Build a cryptographic inventory. List where your systems use encryption: TLS certificates, VPNs, code signing, backups, databases and anything embedded in connected equipment. Most companies cannot answer this today, and every roadmap starts here.
- Ask vendors for their PQC roadmap in writing. Most exposure sits in software you did not write, including your cloud platforms. Put the question into renewals and tenders while you still have leverage.
- Sort data by how long it must stay secret. Information that loses value within a year needs no special treatment. Anything that must hold until 2040 needs attention this year.
- Prioritise crypto-agility. Swapping one algorithm for another without rebuilding the application is worth more than any single algorithm choice, because the standards will keep moving.
- Treat QKD as a procurement question, not a strategy. Consider it only for fixed high-value links with a specific regulatory reason to go beyond software.
None of this needs a quantum specialist. It is security housekeeping with a deadline, and it slots into the compliance framework, zero trust access work and remote work security most companies already run.
What the Next Decade Realistically Looks Like
Market forecasts for quantum networking vary so widely, from a few billion dollars to tens of billions over almost identical timeframes, that they say more about the forecaster than the market. The engineering roadmap is easier to read.
Between now and about 2030, the visible change is cryptographic rather than physical. PQC migration becomes routine maintenance, metropolitan testbeds such as GothamQ grow, and QKD stays a specialist purchase. Nothing here changes how your network is built, which is why quantum work belongs inside an existing digital transformation programme rather than a separate initiative.
Through the 2030s, the deciding question is whether quantum repeaters become reliable and manufacturable. If they do, linked quantum processors arrive first, because that is where the commercial pull is. Cisco and IBM say plainly that connecting quantum computers is the near-term prize and secure communication the follow-on. That would also change what quantum computing can realistically do for everyday work, since the constraint today is the size of a single machine.
Beyond that, honest forecasting runs out. The asymmetry is what matters for planning. Being late to quantum networking costs nothing, because there is nothing yet to be late for. Being late to post-quantum cryptography means traffic you sent years earlier becomes readable.
Conclusion
The quantum internet is real research with real 2026 results, and it is also further away than the coverage suggests. A hundred kilometres of device-independent key distribution and seventeen kilometres of entanglement swapping on city fibre are genuine milestones, not the start of a rollout. If your plan depends on quantum networking before the 2030s, it depends on something nobody can sell you.
The part that needs attention this year is unglamorous. Find out where your systems use encryption, ask your suppliers what they are doing about it, and work out which of your data still has to be secret in ten years. Monitor quantum networking; schedule post-quantum cryptography. That split is the difference between preparing for the technology and being sold it.
Found this useful?
Make SmartKeys a preferred source on Google, and our articles will surface more often in your Top Stories, AI Overviews, and AI Mode.
Add as Preferred Source
