Does Taiwan have a post-quantum cryptography (PQC) law?

No. Nothing published for Taiwan carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Administration for Digital Industries (ADI), Ministry of Digital Affairs (數位發展部數位產業署), Taiwan.

What is Taiwan's PQC migration deadline?

None. No migration deadline has been published for Taiwan by any regulator we checked, including Administration for Digital Industries (ADI), Ministry of Digital Affairs (數位發展部數位產業署), Taiwan.

Does Taiwan require a Cryptographic Bill of Materials (CBOM)?

Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.

TWGuidance

Taiwan

Taiwan's approach is a non-binding industry-alliance guideline (backed by MODA/ADI as a sponsor, not an enforcer) that lays out a four-step PQC migration roadmap including an explicit cryptographic asset inventory step, but sets no deadline, no defined regulatory scope, and no enforcement mechanism.

Taiwan's post-quantum cryptography posture is classified as guidance, led by Administration for Digital Industries (ADI), Ministry of Digital Affairs (數位發展部數位產業署), Taiwan. It scores 20/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

Taiwan's Ministry of Digital Affairs, through its Administration for Digital Industries (ADI/數位產業署), supported the production of the 'Post-Quantum Cryptography Migration Guidelines' (後量子密碼遷移指引, v1.00, issued April 16, 2025 / ROC year 114), which was written and published by the Post-Quantum Cybersecurity Industry Alliance (後量子資安產業聯盟) and the Institute for Information Industry (財團法人資訊工業策進會). The document's own preface states it was formulated "在數位發展部數位產業署的支持下" (with the support of MODA's Administration for Digital Industries), meaning ADI is a supporting sponsor of an industry-alliance-authored guideline, not itself the publishing authority. The guideline lays out a four-step post-quantum migration roadmap: (1) establish a quantum-readiness plan, (2) inventory cryptographic assets (referred to in the document as 加密資產清單/Cryptographic Inventory, a CBOM-equivalent concept, though the document does not use the term "CBOM"), (3) discuss quantum-readiness plans with technology suppliers, and (4) confirm the quantum readiness of the supply chain.

Taiwan's National Communications Commission (NCC) could not be checked: its site consistently blocked automated access during research. This is left unresolved rather than recorded as a checked negative, since a blocked check and a real absence are different facts, and this tracker does not fabricate a negative when a check simply couldn't be completed.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The document is a 'Guidelines' (指引) authored by an industry alliance (後量子資安產業聯盟) and an institute (資策會) with ADI merely 'supporting' its formulation ('在數位發展部數位產業署的支持下，制定本指引'), and no statutory or regulatory binding language, penalties, or subset-mandatory scope appears anywhere in the evidence, so this is non-binding guidance only.
Deadline concreteness	0/20	No year, phased timeframe, or directional deadline language for completing migration appears anywhere in the provided evidence. Only the publication date (April 16, 2025) of the guideline itself is given, which is not a migration deadline.
Scope of coverage	0/20	The evidence describes a general four-step migration roadmap without naming any economy-wide mandate or specific regulated sector (e.g., banking, telecom) as the object of coverage; scope of who must follow the roadmap is undefined in the source.
Inventory/CBOM requirement	20/20	The roadmap explicitly names step two as '盤點加密資產清單' (inventory cryptographic assets / Cryptographic Inventory), an explicit CBOM-equivalent inventory requirement stated directly in the source, even though the term 'CBOM' itself is not used.
Regulatory activity	0/20	ADI is identified only as a supporting sponsor of an industry-alliance-authored guideline, not as an enforcing regulator, and no fines, audits, certification scheme, or enforcement mechanism is mentioned anywhere in the evidence.
Total	20/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Financial Supervisory Commission (FSC) Taiwan
Has published guidance
On 18 June 2026, FSC published the "Post-Quantum Cryptography Migration Reference Guide for the Financial Industry" (金融業後量子密碼遷移參考指引), explicitly naming both "harvest now, decrypt later" and "trust now, forge later" as threats, and covering governance, a cryptographic technology inventory (密碼技術盤點), crypto-agility, ecosystem collaboration, risk prioritization, supply chain management, and phased testing/cutover. This builds on FSC's earlier Financial Cybersecurity Resilience Development Blueprint (late 2025), which had already flagged PQC migration as a priority. Distinct from the separate, non-binding MODA/ADI industry-alliance guideline that is Taiwan's primary scored source.
"金融業後量子密碼遷移參考指引" (Post-Quantum Cryptography Migration Reference Guide for the Financial Industry, 18 June 2026) →Read the full breakdown →
Central Bank of the Republic of China (Taiwan)
Not yet addressed, a gap to watch
Not yet addressed directly. No circular, rule, or guidance addressing post-quantum cryptography or cryptographic inventory was located.

FAQ: Taiwan and PQC

Does Taiwan have a post-quantum cryptography (PQC) law?: No. Nothing published for Taiwan carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Administration for Digital Industries (ADI), Ministry of Digital Affairs (數位發展部數位產業署), Taiwan.
What is Taiwan's PQC migration deadline?: None. No migration deadline has been published for Taiwan by any regulator we checked, including Administration for Digital Industries (ADI), Ministry of Digital Affairs (數位發展部數位產業署), Taiwan.
Does Taiwan require a Cryptographic Bill of Materials (CBOM)?: Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.