When Clients Ask About Quantum, Will Their Lawyers Be Ready?

Ralph Losey, August 2026.

Quantum computing is beginning to raise practical questions about confidentiality, contracts, evidence, and professional judgment. Lawyers do not need the physics, but they do need to recognize the legal issues.

Imagine this call

You are outside counsel to a technology company you have represented for fifteen years. The general counsel has just left a board meeting. Several directors asked whether the company’s most valuable trade secrets will still be secure ten years from now. Another asked whether its cloud providers are preparing for post-quantum encryption. Someone from the audit committee has heard about Q-Day and “harvest now, decrypt later” attacks. They wanted to know what they should do now.

Then the general counsel asks:

“Can your firm help us with this?”

That is the important quantum question for lawyers.

The client is not asking you to explain superposition. Nobody wants you to build a quantum computer in the conference room. Most clients would prefer that you not try.

They are asking whether you understand enough about a developing technology to identify the legal issues, separate real risks from hype, bring the right people into the room, and exercise professional judgment. They don’t want to be caught by surprise like many of them were by generative AI.

Some lawyers will be ready to identify the issues and bring in the right expertise. Others will begin learning after the phone rings. That difference may matter to the quality and speed of the response.

That difference may become economically important.

Clients Will Not Ask Their Lawyers for a Physics Lecture

This is the third article in my Quantum Law series. The first, Why Quantum Law, and Why Now?, laid out the terrain: confidentiality, Q-Day, post-quantum cryptography, AI, evidence, and legal judgment. The second, When Evidence Behaves Like Water, Law Cannot Think Like a Mouse, used a mouse, a maze, and a flood of water to explain why future machine-generated evidence may have to be tested through statistical fidelity rather than exact repetition.

The mouse has earned a rest. Schrödinger’s cat can remain in the box for now. This article asks the more practical question: what legal questions will clients ask, and what should lawyers be prepared to recognize?

Quantum Law begins when quantum physics becomes somebody’s legal problem. The client questions will sound familiar.

• A chief information security officer or IP lawyer may ask whether the company’s most valuable trade secrets and other long-lived confidential information are protected for as long as they must remain secret.
  
• Contracts and information-governance professionals may ask what cloud and software vendors have promised about cryptographic migration, software updates, reasonable deletion, digital signatures, and crypto agility, and who bears the cost and responsibility for the encryption transition. These questions may be asked of corporations’ internal security and IT departments.
  
• An M&A team may discover that a target company carries years of cryptographic “debt”: legacy systems, embedded certificates, outdated code, long-lived confidential information, and expensive dependencies that will eventually have to be inventoried and migrated.
  
• A litigator may confront a dispute involving quantum or hybrid-system outputs and need to determine what records must be preserved, what experts must explain, what risks were foreseeable, and what precautions or representations were reasonable. They will also need to determine possible insurance coverage.

None of these are primarily physics questions. They are legal questions involving confidentiality, contracts, intellectual property, cybersecurity, insurance, evidence, governance, risk allocation, and professional judgment.

That is where the legal work begins.

This Is Not Waiting for a Science-Fiction Computer

A useful dose of skepticism belongs here. A cryptographically relevant quantum computer does not exist today, and no one knows when one will arrive. NIST’s What Is Post-Quantum Cryptography? says expert estimates range from a few years to a few decades and explains why migration must begin before the machine exists. Formidable engineering problems remain. The latest efforts using AI assistance may be advancing the timeline.

Bob Sutor, one of the quantum experts whose work I studied while preparing my course, puts the current engineering reality rather well. In the June 19, 2026 interview with Bob Sutor on the Billion-Dollar Quantum Computing Race, Sutor said:

We are currently in the prehistory of quantum computing.

Exactly right. A cryptographically relevant quantum computer is not here yet. That does not mean the legal work has not begun. It has.

NIST finalized its first three post-quantum cryptography standards in August 2024. NIST Releases First 3 Finalized Post-Quantum Encryption Standards. They identify FIPS 203 for key establishment and FIPS 204 and 205 for digital signatures. NIST is encouraging organizations to begin transitioning to the new standards now.

NIST mathematician Dustin Moody states the recommendation plainly in What Is Post-Quantum Cryptography?:

We encourage organizations to begin their transition to these standards immediately to ensure their data remains secure in the quantum era.

Even though I quote a mathematician here, you do not need to write quantum algorithms to draft a quantum-safe vendor contract. In my Quantum Law Course, we bypass the complex mathematics entirely to focus on the practical legal frameworks, risk allocations, and strategic questions your clients will expect you to understand.

Why the urgency if the machine does not yet exist?

Because major cryptographic migrations take a long time. NIST’s What Is Post-Quantum Cryptography? explains that historical transitions from standardized algorithms into deployed information systems can take 10 to 20 years. NIST’s draft Transition to Post-Quantum Cryptography Standards describes the expected migration from quantum-vulnerable cryptographic standards to post-quantum key-establishment and digital-signature schemes. NIST’s federal transition planning uses 2035 as the principal migration horizon, with higher-risk systems expected to move earlier. AI may speed parts of that process, but migration will remain difficult, especially for organizations with a large volume of sensitive data to protect.

Then there is the shelf-life problem. NIST explains the risk known as “harvest now, decrypt later.” An adversary can capture encrypted information today and hold it until a future quantum computer can decrypt it. Long-lived trade secrets, sensitive research, strategic corporate information, government information, and privileged communications can therefore create a timing problem before Q-Day itself.

Congress is not treating this as science fiction either. The Quantum Computing Cybersecurity Preparedness Act, enacted in 2022, requires covered federal agencies to inventory information technology vulnerable to quantum decryption and develop prioritized migration plans. Congress also expressly recognized the risk that adversaries could steal encrypted information now for later decryption.

That is not evidence that Q-Day is next Tuesday. It is evidence that serious institutions are planning before Tuesday arrives.

Why These Problems Belong on the Legal Agenda

Lawyers are routinely asked to help clients identify duties, allocate risk, preserve evidence, and make decisions under uncertainty. Quantum-related problems fit that familiar pattern. The more consequential the problem, the more likely it is to cross practice areas and require careful coordination. Consider the characteristics of the potential matters:

• A client’s crown-jewel trade secret may be at risk.
  
• A major acquisition may contain hidden cryptographic migration costs.
  
• A cloud or software agreement may allocate responsibility for upgrading systems that rely on vulnerable cryptographic protocols.
  
• A board may need advice about a cybersecurity transition that affects intellectual property, data retention, insurance, contracts, regulatory obligations, and litigation exposure.
  
• A future dispute may involve machine-generated evidence that the opposing party cannot reproduce on an ordinary computer.

Those are not commodity questions. They are interdisciplinary questions with potentially large consequences.

RAND has already considered the institutional side of this problem. Its 2025 report, The Quantum Age and Its Impacts on the Civil Justice System, examines potential effects on lawyers, judges, court technology experts, and insurers, particularly in cryptography, liability and insurance, and privacy. RAND recommends that civil-justice stakeholders follow quantum-secure encryption developments and be prepared to adopt them when practical.

Interdisciplinary challenges like these have been a recurring part of my forty-five years in legal technology practice before I retired this year. They are demanding, but they reward lawyers who are willing to learn enough about a new technology to ask sound questions and exercise judgment. Quantum computing may become another such challenge. The timing is uncertain; the need for measured preparation is already visible.

Preparation Requires More than a Practice Group Name

Most firms do not need to announce a Quantum Law Practice Group next week. Credible preparation requires more than a webpage and a new name. Lawyers and technologists should know enough to recognize the issue, frame the legal problem, work with the right experts, and translate technical analysis into decisions.

We have seen this pattern before. When electronic records became important, clients did not initially ask for “e-discovery lawyers.” They brought discovery problems involving email, servers, backup tapes, databases, and eventually cloud systems.

Predictive coding followed the same path. In 2012, I served as lead technology counsel in Da Silva Moore v. Publicis Groupe, the first reported U.S. judicial opinion approving AI-assisted review. The method was fiercely contested. Today, such technology-assisted review is mainstream in discovery.

Generative AI repeated the pattern at greater speed. Clients began using it before courts, bar associations, and law schools had agreed on the terminology or rules. The legal questions followed.

Quantum may develop the same way. The first valuable skill will not be solving quantum equations. It will be recognizing when a client’s problem has a quantum component and knowing what to do next.

If a distinct legal specialty eventually emerges, firms that began learning earlier may already have useful experience, relationships, and credibility. That is a reason for measured preparation, not for premature branding. Recall the ancient saying, carpe diem (seize the day). Horace: Odes 1.11.

A Familiar Client-Service Problem

Consider Firm A and Firm B. Firm A has represented a corporate client for years. It knows the executives, the litigation history, the contracts, the business, and perhaps which conference room serves the better coffee. The client asks a quantum-related question. Firm A responds: “Interesting. I don’t think we do far-out quantum niche stuff. But let me see if we can find somebody.”

The client then calls Firm B, which it had once used when Firm A had a conflict. Firm B already has several trained lawyers who understand enough to frame the problem. They recognize that the immediate question about encryption also touches the client’s trade secrets, vendor contracts, cybersecurity program, insurance representations, records retention, and perhaps an upcoming acquisition.

Firm B makes a prompt, informed presentation and receives the assignment. With client consent they retain in an outside cryptography expert to assist cost-effectively. The lawyers assign tasks to the expert only as needed and ask informed questions. The lawyers then translate the technical answers into decisions the client can easily make. The lawyers supervise the legal work while recognizing the limits of their technical expertise. Firm B solves the first problem. Then it is asked about another vendor contract. Then an acquisition. Then the cyber-insurance policy. Then the dispute arising from the acquisition.

The loss to Firm A was not one small “niche quantum matter.” It was an introduction. Preventing that introduction doesn’t require your lawyers to spend years studying quantum physics. It requires a focused, practical baseline of literacy. My Quantum Law Course was specifically designed to bridge this gap and give your partners and associates the exact issue-spotting fluency they need to protect your firm’s most valuable client relationships.

Sophisticated clients do not divide their business problems according to law-firm organizational charts. A problem that begins in cybersecurity can migrate into contracts. A contract issue can implicate IP. An IP problem can become litigation. Litigation produces discovery. Discovery raises evidence questions. Evidence requires forensic experts.

That is why quantum literacy may become a client-service issue as well as a competence issue.

A firm does not need a full quantum practice group tomorrow. It does need enough baseline literacy to recognize tomorrow’s question and respond responsibly.

One Lawyer May See the Issue, but Serving the Client Takes a Team

Suppose a manufacturer has engineering designs expected to retain commercial value for twenty years.

• Cybersecurity lawyers may work with technical teams to identify the organization’s dependence on quantum-vulnerable public-key cryptography, including RSA and elliptic-curve cryptography, and help frame the legal implications of a migration plan.
  
• IP lawyers may need to consider how the technological transition affects reasonable measures to protect long-lived trade secrets.
  
• Commercial and technology-transactions lawyers may examine what obligations cloud providers, software vendors, and managed service providers have concerning cryptographic updates, digital signatures, migration costs, and implementation deadlines.
  
• M&A lawyers may ask whether an acquisition target has inventoried its cryptographic dependencies and budgeted for migration costs.
  
• Litigators may consider preservation duties, the authentication of digitally signed records, archived discovery productions, and future disputes over quantum or AI-assisted evidence.
  
• Insurance coverage lawyers may examine policy language and disclosure issues now, followed later by disputes involving exclusions, underwriting assumptions, and causation after a loss.

Nobody in that group needs to design a quantum processor or even know the math. But they need enough common vocabulary to recognize that they are looking at different parts of the same client problem.

NIST’s National Cybersecurity Center of Excellence treats cryptographic discovery and inventory as foundational to migration planning. Its Migration to Post-Quantum Cryptography project focuses on identifying where quantum-vulnerable public-key algorithms are used across hardware, software, and services, and then using those inventories to assess risk and prioritize migration.

Building that inventory is primarily a technical exercise. The decisions it informs are not. Lawyers must help determine which information matters most, how long it must remain protected, and what contracts or legal duties apply. They must also help allocate migration responsibility and identify risks that require escalation. That is where lawyers belong in the room.

This is also why group education makes sense. One informed lawyer can see the issue. A prepared firm can coordinate the response. Quantum literacy is less about creating a new department than giving several departments a shared language.

The Client Side of the Equation

The economics look different for in-house counsel. General counsel may reasonably prefer not to pay outside counsel to learn the vocabulary while the meter is running. They may want to turn to their own team first and only bring in outside specialists when needed.

Knowledgeable in-house lawyers need to know about ML-KEM, NIST’s standardized post-quantum encryption (as detailed in NIST Releases First 3 Finalized Post-Quantum Encryption Standards), but they do not need to understand its mathematics. The lawyer’s role is different: help identify cryptographic dependencies, determine which information and digital signatures require long-term protection, allocate migration responsibilities in third-party contracts, coordinate with IT and information-governance professionals, and recognize when specialist assistance is required.

That lawyer can also insist that experts explain assumptions, limitations, costs, and timelines in language decision-makers can understand. The Quantum Law Course goes to great pains to show the right kinds of questions to ask. Trained attorneys also know when the internal team is in over its head. That professional skill is often underrated.

Conclusion: When the Phone Rings

Return to our general counsel. The board has asked about a long-lived trade secret. The cybersecurity team is discussing post-quantum migration. A critical vendor contract is coming up for renewal. The insurer has questions. The company is considering an acquisition. The general counsel either calls outside counsel or turns to the company’s own quantum-readiness team.

She does not ask: “Can you explain Hilbert space?” She asks: “Can you help us?”

The answer does not require a quantum physicist with a law degree. It requires lawyers who can recognize the issues, bring in the right expertise, connect technology to law and business, and exercise accountable human judgment.

Being early guarantees nothing. It does not guarantee new clients. It does not guarantee premium rates. It certainly does not guarantee that today’s quantum predictions will unfold on schedule. Technology has a mischievous habit of ignoring our schedules. It can arrive astonishingly early or late.

But the competitive logic is familiar. Clients remember the lawyers who can help when an unfamiliar problem first becomes real. And they also remember the lawyers who cannot.

When clients begin asking quantum questions, the first competitive advantage may simply be having lawyers who understand what the client is talking about.

The machine may calculate. The law must still judge.

Educational only; no legal advice provided.
Ralph Losey Copyright 2026 — All Rights Reserved