Does Kuwait have a post-quantum cryptography (PQC) law?

Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is Central Bank of Kuwait (CBK).

What is Kuwait's PQC migration deadline?

None. No migration deadline has been published for Kuwait by any regulator we checked, including Central Bank of Kuwait (CBK).

Does Kuwait require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

KWMandated

Kuwait

Central Bank of Kuwait's Cyber-security and Operational Resilience Framework (CORF) contains a dedicated section of binding 'shall' clauses requiring regulated financial entities to adopt quantum-resistant cryptography, build a quantum-readiness strategy with migration timelines, and test PQC algorithms before deployment -- a genuine, enforceable migration mandate, though scoped to finance, not tied to named NIST algorithms, and without a cryptographic-inventory or CBOM requirement.

Kuwait's post-quantum cryptography posture is classified as mandated, led by Central Bank of Kuwait (CBK). It scores 40/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

The Central Bank of Kuwait's Cyber-security and Operational Resilience Framework (CORF) contains Chapter 4, Section 7.1.4, "Other Emerging Technologies (Quantum Computing, 5G, etc.) Security" -- a dedicated quantum-readiness control set using binding language throughout:

"7.1.4.1. Regulated Entities shall start considering the implications of the threats which will eventually be posed by quantum computing, by starting to adopt quantum-resistant cryptographic algorithms.

7.1.4.2. Regulated Entities shall periodically assess cryptographic practices to ensure resistance to quantum computing capabilities.

7.1.4.3. Regulated Entities shall develop a quantum readiness strategy, prioritizing the transition to quantum-resistant cryptographic algorithms across all systems and processes, while also addressing broader risks posed by quantum computing. The strategy shall include timelines and milestones for cryptographic migration, assessment of critical systems and data at risk, third-party dependencies, and operational preparedness.

7.1.4.4. Regulated Entities shall test and validate quantum-resistant cryptographic algorithms in testing environments to ensure compatibility and performance prior to deployment."

All four sub-clauses use "shall," making this a binding control rather than advisory guidance. CORF's Chapter 3 toolkit also defines dedicated workforce roles -- "Quantum Security Engineer" and "Quantum-safe Cryptography Engineer" -- among its named emerging-technology specialisms, and a capability heat-map table uses "quantum-safe" and "quantum-resistant" indicators as maturity criteria elsewhere in the document.

What we checked and did not find

Across the CORF document's 389 pages, neither "post-quantum" nor "PQC" appears as a formal defined term (one incidental mention inside unrelated role-description narrative), and neither "cryptographic inventory" nor "CBOM" appears anywhere. The mandate requires regulated entities to build their own migration timeline and asset assessment; CBK does not specify one itself, nor does it name ML-KEM, ML-DSA, or any other specific algorithm. CITRA, Kuwait's telecom/ICT regulator, has published no PQC-specific circular or guidance.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	15/20	CORF Section 7.1.4 uses 'shall' in all four of its operative sub-clauses (7.1.4.1-7.1.4.4), a binding regulatory framework issued by the central bank for supervised entities. It stops short of full marks because no penalty or enforcement clause is quoted alongside the mandate itself in the evidence reviewed.
Deadline concreteness	5/20	The clause requires regulated entities to 'develop a quantum readiness strategy' that itself must 'include timelines and milestones for cryptographic migration' -- a binding requirement to set a deadline, not a deadline set by the regulator itself. No CBK-specified year or date appears anywhere in the section.
Scope of coverage	10/20	CORF applies to CBK-regulated entities -- Kuwait's banking and financial sector -- a defined regulated sector, not economy-wide critical infrastructure.
Inventory/CBOM requirement	0/20	The section requires a 'quantum readiness strategy' including 'assessment of critical systems and data at risk' and 'third-party dependencies,' which implies asset-level awareness, but the text never uses the words 'inventory,' 'cryptographic bill of materials,' or 'CBOM,' and does not mandate a structured, auditable asset list.
Regulatory activity	10/20	CBK is a named financial regulator that has issued this framework directly to its supervised population, with binding language throughout. It falls short of full marks because the evidence does not show fines, audits, or a certification regime specifically tied to Section 7.1.4.
Total	40/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Communication and Information Technology Regulatory Authority (CITRA)
Not yet addressed, a gap to watch
No CITRA-issued circular or guidance specifically addressing post-quantum cryptography, quantum-readiness, or cryptographic inventory was located.

FAQ: Kuwait and PQC

Does Kuwait have a post-quantum cryptography (PQC) law?: Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is Central Bank of Kuwait (CBK).
What is Kuwait's PQC migration deadline?: None. No migration deadline has been published for Kuwait by any regulator we checked, including Central Bank of Kuwait (CBK).
Does Kuwait require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.