Methodology

The two axes

Two different things are easy to confuse, so the Atlas records both. An EU member coordinates through the European roadmap, yet the algorithms it deploys are the American NIST standards. The map colour shows which collective transition a country coordinates with; a badge on its profile shows whose algorithms it actually runs. A country active but committed to no bloc, standard or timeline is shown as engaged but unaligned: it sits on the posture axis but not yet on the role axis.

Coordination posture, the map colour

NIST-led ecosystem

Works to the standards and cadence the United States sets through NIST. The largest group.

EU coordinated roadmap

Migrates in step with the EU coordinated roadmap, on its 2030 and 2035 milestones, over the NIST algorithms underneath.

Sovereign bloc

Builds and mandates its own national algorithms, independent of NIST. The only real fork in the baseline.

Engaged but unaligned

Active on the transition, but committed to no bloc, standard, or timeline.

Standards role, the profile badge

Standard-maker

Writes the standards others adopt. Today there is one: the United States.

Standard-contextualiser

Adopts the baseline but adds national requirements, such as mandatory hybrid deployment or certification.

Standard-taker

Adopts the baseline broadly as published, without a substantial national overlay.

Sovereign developer

Designs and standardises its own post-quantum algorithms.

The regulatory layer

Each profile records the main regulation behind a country's posture, whether it is binding, soft-law or absent, and the plain obligation it places on organisations. This turns a label into what an organisation must actually do, and shows where post-quantum migration is mandated rather than merely encouraged. Binding EU duties under NIS2 and DORA read differently from a soft national roadmap, which reads differently again from nothing at all.

The evaluative layer

The evaluative layer asks not whether a plan exists but how credible it is. It adapts Paglieri et al.'s (2025) six-criteria comparative method for national quantum strategies, sharpened by Vance's (2025) split of evaluation into process, impact and cost-benefit, with two checks drawn from the CEPS governance recommendations (Pupillo et al., 2025) and the threat criterion from Pupillo et al. (2023). It sits inside the governance of expectations (Budde and Konrad, 2019): a score is a reading at a date, not a verdict.

Six criteria become eleven sub-criteria, each scored 0 (absent), 1 (partial) or 2 (present), and reported as a six-axis profile rather than a single number.

Verification rules

• No sub-score is recorded unless it traces to a sourced instrument. An unsupported axis reads as not assessed, never a default, and each axis is the mean of the sub-criteria that could be assessed.
• A second reviewer scores each country independently, and the two reconcile before a profile is shown.
• The Atlas confidence grade is carried onto each axis, so a country on thin evidence reads as tentative.

The credibility gauge

The instrument the layer produces: a six-axis reading, each axis linked to the source behind it, so the reading is auditable rather than asserted. It appears on each country profile, beside the regulatory basis.

France, an EU contextualiser, scores high on relevance, coherence, efficiency, governance and impact, and a step lower on effectiveness: ANSSI publishes a phased roadmap and France adopts the NIST baseline with mandatory hybridisation under binding EU instruments, while effectiveness sits lower because the milestones are not-earlier-than windows.

Sources

Every country position rests on official institutional documents, government bodies, national agencies and standards organisations. The full, searchable set is in the Documents tool, and each country profile links to the documents it rests on.