# How to vet a quantum vendor

A procurement checklist for evaluating quantum hardware, software, cloud and services vendors. Technical, commercial and compliance questions to ask before you sign.

Updated 2026-11-01. Also on the [web page](https://quantumcompanies.fyi/guides/how-to-vet-a-quantum-vendor).

Procuring quantum technology requires due diligence beyond classical IT. Use this checklist to structure vendor evaluations.

## Technical evaluation

### Hardware vendors
- [ ] **Published specifications**: Qubit count, 1q/2q gate fidelity, readout fidelity, coherence times (T1, T2), connectivity graph, gate set, crosstalk matrix.
- [ ] **Benchmark results**: Request recent QED-C, SupermarQ or SupermarQ-like benchmark data on the target device. Run your own representative circuits.
- [ ] **Calibration cadence**: How often is the device recalibrated? What is the drift between calibrations?
- [ ] **Error mitigation**: Built-in (dynamical decoupling, ZNE, PEC, M3) or user-configurable? Cost impact?
- [ ] **Mid-circuit measurement**: Supported? Latency? Feed-forward capability?
- [ ] **Qubit reset / reuse**: Active reset time? Thermal relaxation wait time?
- [ ] **Upgrade roadmap**: Next-generation device timeline? Backward compatibility?

### Software & cloud vendors
- [ ] **SDK compatibility**: Qiskit, Cirq, PennyLane, Braket SDK, Azure Quantum SDK, native API. Open-source vs proprietary?
- [ ] **Compiler/transpiler quality**: Routing heuristic, gate decomposition, optimization passes. Can you inject custom passes?
- [ ] **Simulator fidelity**: Noise model accuracy (matched to hardware?). GPU-accelerated options?
- [ ] **Hybrid job support**: Parameterized circuits, gradient estimation, optimizer integration (SciPy, PennyLane, custom).
- [ ] **Data access**: Real-time results streaming? Raw data download (counts, histograms, metadata)? Retention policy?
- [ ] **Monitoring & analytics**: Job dashboard, queue position, cost tracking, utilization reports, error budgets.

### Sensing / networking / PQC vendors
- [ ] **Environmental specs**: Operating temperature, vibration, magnetic shielding, power, size/weight.
- [ ] **Interface**: Digital (UART/SPI/Ethernet), analog, SDK languages, ROS drivers, time sync (PTP/NTP).
- [ ] **Calibration**: Factory calibration interval, field recalibration procedure, traceability (NIST/PTB).
- [ ] **Export classification**: ECCN/ITAR status. End-user certificate requirements.
- [ ] **Certifications**: CMVP (FIPS 140-3), Common Criteria, NIST SP 800-90B (RNG), ISO 17025.

## Commercial evaluation

### Pricing transparency
- [ ] **Complete pricing model**: Per-shot, per-task, per-minute, per-hour, subscription, reservation. All components listed?
- [ ] **Hidden costs**: Classical compute (instance types), storage, data egress, notebook instances, support tiers, reservation cancellation fees.
- [ ] **Volume discounts**: Published tiers or negotiation required?
- [ ] **Free tier / credits**: Eligibility, limits, expiration.
- [ ] **Currency & billing**: USD only? Local currency? Invoicing terms (net-30, prepaid)?

### Contract & legal
- [ ] **Data ownership**: You own job results, circuits, logs. Vendor may use anonymized aggregates for improvement — opt-out?
- [ ] **IP ownership**: Custom algorithms, transpiler passes, error mitigation strategies developed during engagement.
- [ ] **SLA**: Uptime target (%), queue priority guarantees, maintenance windows, credits for SLA breach.
- [ ] **Liability**: Cap (fees paid? 12 months fees?). Exclusions (consequential, data loss).
- [ ] **Term & termination**: Auto-renewal? Notice period? Data export on termination (format, timeline).
- [ ] **Export compliance**: Vendor confirms ECCN classification. End-use/end-user statements if required.
- [ ] **Security**: SOC 2 Type II, ISO 27001, FedRAMP (for GovCloud). Pen test reports available under NDA.

### Vendor viability
- [ ] **Funding stage & runway**: Public filings, press releases, investor list.
- [ ] **Customer references**: 2–3 similar-scale customers willing to speak (under NDA if needed).
- [ ] **Team depth**: PhD-level quantum scientists, hardware engineers, compiler engineers, support engineers.
- [ ] **Partnerships**: Cloud integrations (AWS, Azure, GCP, IBM), HPC centers, national labs, standards bodies.
- [ ] **Roadmap credibility**: Public milestones met on time? Delayed? Cancelled?

## Compliance evaluation

| Requirement | Applies to | Verification |
|---|---|---|
| FIPS 140-3 Level 2/3 | PQC, QKD, QRNG, key management | CMVP certificate # |
| CNSA 2.0 | US NSS / classified | Vendor self-attest + CMVP |
| NIST IR 8547 timeline | Federal agencies, critical infra | Migration plan document |
| ITAR / EAR | Cold-atom inertial, high-perf clocks | ECCN classification letter |
| GDPR / CCPA | Personal data in job metadata | DPA, SCC, subprocessors |
| SOC 2 Type II | All cloud vendors | Audit report (NDA) |
| ISO 27001 | All vendors | Certificate + scope |

## Red flags

- ❌ No published gate fidelities or coherence times (or "contact us for specs")
- ❌ Pricing only available after NDA + sales call (no public page)
- ❌ No simulator access for pre-testing
- ❌ Single vendor lock-in (no open SDK, no export to OpenQASM)
- ❌ No customer references in your sector/scale
- ❌ Vendor cannot articulate error mitigation strategy
- ❌ Reservation required for basic access (no on-demand)
- ❌ Export classification "unknown" or "not determined"

## Sample RFI questions

1. "Provide the last 90 days of uptime, average queue time, and calibration dates for [device name]."
2. "What is the all-in cost to run a 100-qubit, 1000-gate, 10k-shot VQE job 50 times on [device]?"
3. "Share your compiler's routing pass performance on a 50-qubit heavy-hex graph vs. native connectivity."
4. "Describe your data retention and export policy. Can we download raw shot-level data?"
5. "What is your ECCN for [product]? Do you require an end-user certificate for [our country]?"
6. "Provide your SOC 2 Type II report and FedRAMP authorization status (if applicable)."

## Sources

- [QED-C Benchmarks](https://quantumconsortium.org/benchmarks/) — fetched 2026-11-01.
- [SupermarQ](https://supermarq.epiqc.cs.uchicago.edu/) — fetched 2026-11-01.
- [AWS Braket SLA](https://aws.amazon.com/braket/sla/) — fetched 2026-11-01.
- [IBM Quantum SLA](https://www.ibm.com/quantum/sla) — fetched 2026-11-01.
- [NIST CMVP validated modules](https://csrc.nist.gov/projects/cryptographic-module-validation-program) — fetched 2026-11-01.
- [NSA CNSA 2.0](https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/1/CSI_CNSA_2.0_FAQ_.PDF) — fetched 2026-11-01.
- [BIS ECCN lookup](https://www.bis.doc.gov/index.php/documents/regulations-docs/2326-ear-ccl-file) — fetched 2026-11-01.

*For general information only — not legal or compliance advice. Confirm export classifications and contract terms with counsel.*

## Questions

### Should I require a live demo?

Yes. Ask for a live circuit execution on the target QPU with your circuit or a representative benchmark. Record the job ID, queue time, execution time and results. Compare to simulator output.

### What benchmarks should I use?

Application-oriented: QED-C benchmarks, SupermarQ, QASMBench, or your own domain-specific circuit (VQE, QAOA, error correction). Avoid single-number metrics like quantum volume alone.

### How do I verify cloud availability claims?

Check the provider's status page and calendar. Ask for average queue time and uptime SLA over the last 90 days. Test submission at your intended time of day.

### What contract terms matter most?

Data ownership, export control compliance, SLA (uptime, queue priority), cancellation/reservation change policy, pricing model transparency, support tier, IP ownership for custom algorithms, liability caps.