Dataset
196 jurisdictions, including the ones with nothing to report
42 have a policy specific enough to score. 3 have published guidance too general to score. 151 were checked, against a named central bank, financial regulator, and cyber authority, and confirmed to have published nothing. Most trackers only show you the first group.
A blank row on most trackers could mean two very different things: nobody has regulated this yet, or nobody has checked. Every negative record here names the authorities we checked, so if one of them turns out to have published something after all, you can see exactly where the check missed it.
The machine-readable version
Everything on this page is also at /data.json: every scored country's full rubric, every guidance-only country, and every checked-nothing-found record with a confidence rating, since some jurisdictions have far thinner public search coverage than others.
Found an error, a policy we missed, or a country that has since published something? Tell us.
Not here yet
Two jurisdictions had real, dated government PQC activity turn up during research, but nothing we could verify against a reachable primary source. Rather than guess at a score or file it as a negative that isn't confirmed, we've left both out pending a direct check. See the methodology for what counts as verified.