How these pages are researched and classified

The status scale

Every country is assigned one of five statuses. The scale measures enforceability, not ambition or technical maturity. A country with a detailed voluntary roadmap ranks below one with a terse but binding rule.

The scoring rubric

Countries with a specific enough primary source are also scored 0 to 100 for the rankings and the world map, across five axes, 20 points each, scored independently so the reasoning is auditable rather than a single opaque number:

• Mandate strength: 20 for a binding statutory or regulatory mandate with penalties, 10 for binding on a defined subset only (e.g. national-security systems or regulated banks), 0 for guidance with no binding force.
• Deadline concreteness: 20 for specific published year(s), 10 for phased or directional language without a hard year, 0 for no timeline at all.
• Scope of coverage: 20 for economy-wide or all critical infrastructure, 10 for specific regulated sectors only, 0 for government systems only or an undefined scope.
• Inventory / CBOM requirement: 20 for an explicit cryptographic-inventory or CBOM mandate named in the source, 10 where a general risk-assessment obligation plainly implies one, 0 where it is not addressed.
• Regulatory activity: 20 for a named authority with a published enforcement mechanism, 10 for a named authority with no visible enforcement teeth yet, 0 for no designated authority.

A country with zero verifiable sources is not scored at all. It either doesn't appear in the rankings, or appears under tracked, not yet scored if we found guidance too general to score against the rubric. We do not interpolate a score from “what countries like this usually do.”

Where a country has more than one relevant primary source, since several national authorities often publish separately, the headline score comes from whichever verified source scores highest on mandate strength (the most binding instrument), and the others are cited in the page body as supporting context rather than averaged in. The United States is the clearest example: its score reflects OMB Memorandum M-26-15, with Executive Order 14412 and NIST's NCCoE guidance noted separately.

What counts as a source

Every country page cites primary sources only: the text of a regulation, a standards body's own publication, a regulator's circular or framework document, or an official government roadmap. We link the document itself wherever it is public.

Press coverage, vendor white papers, conference talks, and analyst notes are not used as the basis for a classification. They are useful for finding out that something happened; they are not evidence of what the rule says.

Where a jurisdiction publishes only in its national language, we work from the official text and note where an English version is a translation rather than the operative document.

Ambiguous and contested cases

A recurring problem: many jurisdictions have no PQC-specific rule at all, but do have general cryptographic risk-management obligations that plainly reach quantum risk. India and the EU are both examples. We classify these on the strength of the enforcement mechanism that actually exists, usually regulated or guidance rather than mandated, and explain the reasoning in the page body rather than burying it in the badge.

Where a deadline exists but applies only to a subset of entities (national security systems, systemically important institutions), the page says so explicitly. A date that binds one bank and not another is not a national deadline, and we do not present it as one.

Review cadence

Every page currently on this site was researched and verified in the same initial build, so the “last updated” dates you see today mostly cluster around one period. That will spread out as the site matures: from here on, the date only moves when a page is re-checked against its sources, not when unrelated parts of the site change. Pages covering active regulatory processes will be revisited more often than those covering settled ones. When a status changes, the page will record what changed and why.

Conflicts of interest

No page is sponsored, and no vendor, product, or service is recommended anywhere on this site. Contributors work in the industry, which is the point, and is also the obvious risk, so the rule we hold ourselves to is simple: classifications follow the cited source, and if the source does not support the claim, the claim does not run.

Corrections

If a page is wrong, out of date, or missing a source you think is decisive, send it to us. Substantive corrections are made promptly and the review date is updated. We would rather be corrected than cited incorrectly.