How to assess quantum hardware supply-chain risk

Assess quantum hardware supply-chain risk against the bill of materials and the processes needed to deliver and maintain the system. A dependency becomes material when disruption cannot be absorbed through qualified alternatives, inventory or redesign within the required time. Supplier counts and country lists are insufficient without identifying critical inputs and the difficulty of replacing them.

Critical inputs and independent production routes

The correct unit of analysis is a specified product and production route. Different quantum architectures depend on different combinations of cryogenic equipment, optical components, materials, fabrication, electronics and specialised testing. A general sector map can suggest questions but cannot establish an individual company’s exposure. Ask the supplier to identify the items and services whose interruption would stop fabrication, acceptance or repair of the purchased configuration. Include externally owned facilities as well as physical parts.

The US National Quantum Initiative Advisory Committee’s 2023 report identified enabling technologies and specialised materials, including isotopes, as supply-chain concerns. That is a dated sector-level diagnosis, not evidence that every quantum company faces the same shortage. For a specific input, establish specification, provenance, available capacity and the part of the process that actually creates scarcity. A commodity may be widely traded while the required purity, enrichment, geometry or qualification narrows the usable supply base substantially.

Count independent production routes, not only distributors. Two vendors can rely on the same manufacturer, facility or upstream material. Conversely, one supplier may operate genuinely separate qualified routes. Trace the dependency far enough to identify common failure points, using proportionate confidential disclosure when necessary. Public corporate addresses rarely identify where the relevant process occurs. Record the evidence and its date, because supplier ownership and subcontracting arrangements can change without a product name changing.

Qualification time and the inventory gap

Substitution risk depends on qualification. A replacement component that meets a catalogue specification may still change noise, thermal behaviour, optical loss or calibration. Estimate the design work, manufacturing runs and acceptance testing required to use it. Treat an untested alternative as a development option rather than available redundancy. A small, inexpensive part can become more consequential than a high-value subsystem if replacing it requires reopening the entire system qualification.

An illustrative timing comparison makes the issue concrete. Suppose inventory covers six months of expected demand, but qualifying an alternative requires nine months and transferring production requires another three. The company has a six-month coverage gap if those activities cannot overlap. Increasing stock can help, but it ties up cash and may not address software, equipment maintenance or tacit knowledge. The exposure should be expressed as a recovery problem with assumptions, rather than a generic red risk score.

Service dependencies and recovery options

Manufacturing and service dependencies belong in the same review. A system may be delivered successfully yet remain vulnerable because one supplier controls a calibration tool, replacement module or firmware update. Establish what the buyer can retain and operate if support changes. Where export or transfer restrictions may apply, request a classification and licensing assessment for the actual item, destination and activity; do not infer the legal treatment solely from the word quantum. Commercial lead time and permission to transfer are separate constraints.

The response should match the failure mechanism. Qualified second sources address some supply interruptions; redesign addresses a component that cannot be replaced directly; spares address predictable maintenance; documentation and training address dependence on one specialist. The QED-C control and readout programme demonstrates that interfaces and integration themselves are industrial development tasks. Adding a vendor name does not resolve those tasks. A continuity plan should therefore record the remaining engineering work, its owner and the conditions under which it starts.

For an investor or procurement team, the meaningful result is a small set of dependencies with a documented operational consequence and recovery route. Review those dependencies when the product scales, the design changes or a supplier alters its production path. The European Commission’s quantum strategy places supply-chain resilience alongside industrialisation; at company level that becomes measurable through qualified access, replacement effort and delivery continuity. A risk assessment improves when it explains what happens after an interruption and how the business can recover.