AI, post-quantum-cryptography and PKI signals in Estonian public procurement: a corpus with a transparent classifier and a hand-adjudicated precision audit (January-May 2026)

A machine-readable corpus built from the open-data exports of the Estonian Public Procurement Register (Riigihangete register, RHR), covering procurement notices and contract-award/modification notices published January-May 2026 together with the 2026 procurement-plan export. Contents. 11,197 normalized records over a fixed 20-field schema; 94 record-topic hits produced by a transparent regular-expression classifier for artificial intelligence, post-quantum cryptography and public-key-infrastructure/trust-service terms; the classifier ruleset itself; a source manifest pinning each of the 11 source XML files by URL and SHA-256; and a row-level hand adjudication of every high-confidence hit. Precision is measured, not asserted. All 60 high-confidence rows were adjudicated by hand under two explicit definitions. If a true positive requires the buyer to acquire the technology, precision is 43.3%; if it requires the technology to be the subject matter of the purchase, precision is 71.7% (AI 75.0%, PKI 42.9%, PQC 1/1). Both figures are published with their decision rules, alongside a taxonomy of the false positives, so that reusers can choose their own operating point. Reproducibility. The pipeline was re-run against independently re-fetched sources 50 days after the original harvest and reproduced the entire signal layer exactly; only the total record count moved, by six records, as the register backfilled. Every source file can be re-fetched from the URLs in the manifest and checked against the recorded hashes. Redaction. E-mail addresses, contact telephone numbers, national personal identification codes bound to named individuals, and anonymous file-share links (whose tokens are bearer credentials) are replaced with placeholders at parse time. The personal-code rule requires both a valid checksum and a country marker, because five of the seventeen checksum-valid 11-digit strings in this corpus are Latvian legal-entity registration numbers that must survive as organisational identifiers. Limits. Open-data exports carry notice-level text; tender attachments are not necessarily included. The window is a snapshot, not a time series. Rows are record-topic pairs, not procurement cases: the 94 rows resolve to 55 distinct contract folders. The low-confidence layer was not adjudicated and its precision is unmeasured.