The Trust-Tech Procurement Observatory: a provenance-verified dataset of government demand for AI, post-quantum cryptography, PKI and digital identity

The Trust-Tech Procurement Observatory is a live, provenance-verified dataset of what governments worldwide procure across four trust-technology domains: artificial intelligence (AI), post-quantum cryptography (PQC), public-key infrastructure (PKI), and eIDAS/digital identity. This v0 release (build 2026-07-04) holds 4,401 unique procurement records spanning 106 countries, harvested from four public sources: EU TED, US USAspending, UK Contracts Finder / Find-a-Tender, and World Bank procurement notices.

Anti-fabrication by construction. Every record carries an immutable provenance stamp (source URL, fetch timestamp, HTTP status, and a sha256 hash of the raw upstream payload). A record enters the corpus only through a deterministic harvest script that received an HTTP 200 from a listed source; there is no manual-insertion path and no language model in the harvest loop. A validator rejects any record with a future date, a placeholder host, an unverified classification code, or a missing provenance field.

Headline finding — the post-quantum procurement gap. PQC appears in only 50 of 4,401 records (1.14%): 3.03% of the US slice, 1.0% of the EU slice, and 0% of the World Bank development-finance slice, despite finalized NIST PQC standards (FIPS 203/204/205, 2024) and NSA CNSA 2.0 migration deadlines running 2030–2033.

The archive contains the consolidated OCDS-1.1-aligned dataset, all computed statistics, the verified findings narrative, the source ledger, and the full harvest/validate/consolidate/analyze pipeline (dependency-free Python). Sources: EU TED (EU Publications Office reuse), USAspending (US public domain), UK Contracts Finder/FTS (OGL v3.0), World Bank (open). Released CC-BY-4.0 with per-source attribution preserved. Live site: procurement.eatf.eu

Archive SHA-256: d0a29641ce922f02dd7606af2e2d0c9fc961b96af420971f793293e6dc6ec7db. Live observatory: procurement.eatf.eu . Every reported statistic is computed by scripts/analyze.py and re-verified against the raw dataset.