Skip to content
Tyche Institute

Estonian public procurement open data

RHR AI/PQC/PKI Observatory

A reproducible research pipeline for tracking public procurement signals related to artificial intelligence, post-quantum cryptography, and PKI or trust-service-adjacent infrastructure in Estonia's Riigihangete register open-data exports.

Frozen on 15 October 2026. Collection stopped because no current research output needs new data from this series. Everything captured up to that date stays online here, and a copy is kept off this server in Tyche's research archive. Where this page says “latest” or “current”, it means the state on 12 October 2026.

Pilot Corpus

The first bounded run covers January-May 2026 procurement notices and award notices, plus the 2026 procurement-plan export. It parsed 11,191 records at the 1 June 2026 snapshot (11,197 at an independent re-verification on 21 July 2026, after living-register backfill) and produced 94 record-topic matches — reproduced exactly across both snapshots: 55 AI hits, 38 PKI hits, and one high-confidence PQC planning signal.

After the pilot, a scheduled monitor extended coverage through July 2026. On 3 August 2026 the observatory tracked 130 distinct AI, PQC, and PKI signal identities, up from the 91-signal seeded baseline. The monitor first ran in July 2026 and ran weekly from August 2026. It was frozen on 15 October 2026; its last run was on 12 October 2026.

AI

55

52 high-confidence hits

PQC

1

Postkvant teekaardi rakendamine

PKI

38

7 high-confidence; 31 review candidates

Evidence Receipts

Until the freeze on 15 October 2026, scheduled monitor runs packaged the RHR source manifest, normalized corpus, report outputs, and declared artifact hashes into an EATF/AEP evidence snapshot. The receipt verifies package bytes and declared hashes only; it does not certify RHR completeness, source XML signature validity, trust-service status, procurement-law interpretation, or compliance.

EATF/AEP

Signed snapshots

Each monitor run uploaded a package and verification receipt with the normalized artifacts.

Monitoring

New-signal notification

While the monitor ran, a GitHub issue was opened when a new AI, PQC, or PKI signal identity appeared after the seeded baseline.

Method Boundary

The observatory uses RHR open-data XML exports for notices, awards, and procurement plans. It does not scrape the public UI, does not use authenticated procurement workflows, and does not claim to certify legal compliance. The EATF receipt is an artifact-integrity receipt rather than a legal or trust-service attestation. Generic certificate language is treated as low-confidence PKI-adjacent signal until reviewed.

Research Use

The observatory supports Tyche's thesis work on public-sector evidence infrastructure: procurement as an early signal for AI deployment, post-quantum transition planning, and PKI governance demand. It was run as research infrastructure rather than a product.