When Clients Ask About Quantum, Will Their Lawyers Be Ready? | EDRM - Electronic Discovery Reference Model - JD Supra

[EDRM Editor’s Note: EDRM is proud to publish Ralph Losey’s advocacy and analysis. Images in the article were created by Ralph Losey using AI unless otherwise noted. Originally published on EDRM.net. This article remains the intellectual property of Ralph Losey and is shared with permission.]Quantum computing is beginning to raise practical questions about confidentiality, contracts, evidence, and professional judgment. Lawyers do not need the physics, but they do need to recognize the legal issues.You are outside counsel to a technology company you have represented for fifteen years. The general counsel has just left a board meeting. Several directors asked whether the company’s most valuable trade secrets will still be secure ten years from now. Another asked whether its cloud providers are preparing for post-quantum encryption. Someone from the audit committee has heard about Q-Day and “harvest now, decrypt later” attacks. They wanted to know what they should do now.Several directors asked whether the company’s most valuable trade secrets will still be secure ten years from now. Another asked whether its cloud providers are preparing for post-quantum encryption. Someone from the audit committee has heard about Q-Day and “harvest now, decrypt later” attacks. They wanted to know what they should do now.Then the general counsel asks:“Can your firm help us with this?”That is the important quantum question for lawyers.The client is not asking you to explain superposition. Nobody wants you to build a quantum computer in the conference room. Most clients would prefer that you not try.They are asking whether you understand enough about a developing technology to identify the legal issues, separate real risks from hype, bring the right people into the room, and exercise professional judgment. They don’t want to be caught by surprise like many of them were by generative AI.Some law firms will be ready for that call. Others will begin learning after the phone rings.That difference may become economically important.This is the third article in my Quantum Law series. The first, Why Quantum Law, and Why Now?, laid out the terrain: confidentiality, Q-Day, post-quantum cryptography, AI, evidence, and legal judgment. The second, When Evidence Behaves Like Water, Law Cannot Think Like a Mouse, used a mouse, a maze, and a flood of water to explain why future machine-generated evidence may have to be tested through statistical fidelity rather than exact repetition.The mouse has earned a rest. Schrödinger’s cat can remain in the box for now. This article asks the more practical question: what legal questions will clients ask, and what should lawyers be prepared to recognize?None of these are primarily physics questions. They are legal questions involving confidentiality, contracts, intellectual property, cybersecurity, insurance, evidence, governance, risk allocation, and professional judgment. That is where the legal work begins.Quantum Law begins when quantum physics becomes somebody’s legal problem. The client questions will sound familiar.None of these are primarily physics questions. They are legal questions involving confidentiality, contracts, intellectual property, cybersecurity, insurance, evidence, governance, risk allocation, and professional judgment.That is where the legal work begins.A useful dose of skepticism belongs here. A cryptographically relevant quantum computer does not exist today, and no one knows when one will arrive. NIST’s What Is Post-Quantum Cryptography? says expert estimates range from a few years to a few decades and explains why migration must begin before the machine exists. Formidable engineering problems remain. The latest efforts using AI assistance may be advancing the timeline.Bob Sutor, one of the quantum experts whose work I studied while preparing my course, puts the current engineering reality rather well. In the June 19, 2026, interview with Bob Sutor on the Billion-Dollar Quantum Computing Race, Sutor said:We are currently in the prehistory of quantum computing.Exactly right. A cryptographically relevant quantum computer is not here yet. That does not mean the legal work has not begun. It has.NIST finalized its first three post-quantum cryptography standards in August 2024. NIST Releases First 3 Finalized Post-Quantum Encryption Standards. They identify FIPS 203 for key establishment and FIPS 204 and 205 for digital signatures. NIST is encouraging organizations to begin transitioning to the new standards now.NIST mathematician Dustin Moody states the recommendation plainly in What Is Post-Quantum Cryptography?:We encourage organizations to begin their transition to these standards immediately to ensure their data remains secure in the quantum era.Even though I quote a mathematician here, lawyers do not need to write quantum algorithms to draft a contract addressing post-quantum migration. The needed baseline is legal and practical: understand the risk, identify the relevant duties and contracts, ask informed questions, and know when technical expertise is required.Why the urgency if the machine does not yet exist?Because major cryptographic migrations take a long time. NIST’s What Is Post-Quantum Cryptography? explains that historical transitions from standardized algorithms into deployed information systems can take 10 to 20 years. NIST’s draft Transition to Post-Quantum Cryptography Standards describes the expected migration from quantum-vulnerable cryptographic standards to post-quantum key-establishment and digital-signature schemes. NIST’s federal transition planning uses 2035 as the principal migration horizon, with higher-risk systems expected to move earlier. AI may speed parts of that process, but migration will remain difficult, especially for organizations with a large volume of sensitive data to protect.Then there is the shelf-life problem. NIST explains the risk known as “harvest now, decrypt later.” An adversary can capture encrypted information today and hold it until a future quantum computer can decrypt it. Long-lived trade secrets, sensitive research, strategic corporate information, government information, and privileged communications can therefore create a timing problem before Q-Day itself.Congress is not treating this as science fiction either.

The Quantum Computing Cybersecurity Preparedness Act, enacted in 2022, requires covered federal agencies to inventory information technology vulnerable to quantum decryption and develop prioritized migration plans. Congress also expressly recognized the risk that adversaries could steal encrypted information now for later decryption.That is not evidence that Q-Day is next Tuesday. It is evidence that serious institutions are planning before Tuesday arrives.Lawyers are routinely asked to help clients identify duties, allocate risk, preserve evidence, and make decisions under uncertainty. Quantum-related problems fit that familiar pattern. The more consequential the problem, the more likely it is to cross practice areas and require careful coordination. Consider the characteristics of the potential matters:Those are not commodity questions. They are interdisciplinary questions with potentially large consequences.Interdisciplinary challenges like these have been a recurring part of my forty-five years in legal technology practice before I retired this year. They are demanding, but they reward lawyers who are willing to learn enough about a new technology to ask sound questions and exercise judgment. Quantum computing may become another such challenge. The timing is uncertain; the need for measured preparation is already visible.RAND has already considered the institutional side of this problem. Its 2025 report, The Quantum Age and Its Impacts on the Civil Justice System, examines potential effects on lawyers, judges, court technology experts, and insurers, particularly in cryptography, liability and insurance, and privacy. RAND recommends that civil-justice stakeholders follow quantum-secure encryption developments and be prepared to adopt them when practical.Interdisciplinary challenges like these have been a recurring part of my forty-five years in legal technology practice before I retired this year. They are demanding, but they reward lawyers who are willing to learn enough about a new technology to ask sound questions and exercise judgment. Quantum computing may become another such challenge. The timing is uncertain; the need for measured preparation is already visible.Most firms do not need to announce a Quantum Law Practice Group next week. Credible preparation requires more than a webpage and a new name. Lawyers and technologists should know enough to recognize the issue, frame the legal problem, work with the right experts, and translate technical analysis into decisions.We have seen this pattern before. When electronic records became important, clients did not initially ask for “e-discovery lawyers.” They brought discovery problems involving email, servers, backup tapes, databases, and eventually cloud systems.Predictive coding followed the same path. In 2012, I served as lead technology counsel in Da Silva Moore v. Publicis Groupe, the first reported U.S. judicial opinion approving AI-assisted review. The method was fiercely contested. Today, such technology-assisted review is mainstream in discovery.Generative AI repeated the pattern at greater speed. Clients began using it before courts, bar associations, and law schools had agreed on the terminology or rules. The legal questions followed.Quantum may develop the same way. The first valuable skill will not be solving quantum equations. It will be recognizing when a client’s problem has a quantum component and knowing what to do next.If a distinct legal specialty eventually emerges, firms that began learning earlier may already have useful experience, relationships, and credibility. That is a reason for measured preparation, not for premature branding. Recall the ancient saying, carpe diem (seize the day). Horace: Odes 1.11.Consider Firm A and Firm B. Firm A has represented a corporate client for years. It knows the executives, the litigation history, the contracts, and the business. When the client raises a quantum-related encryption question, Firm A responds: “We have not dealt with that issue before, but let me find the right people.”The client then calls Firm B, which it had once used when Firm A had a conflict. Firm B already has several trained lawyers who understand enough to frame the problem. They recognize that the immediate question about encryption also touches the client’s trade secrets, vendor contracts, cybersecurity program, insurance representations, records retention, and perhaps an upcoming acquisition.Firm B makes a prompt, informed presentation and receives the assignment. With the client’s consent, it retains an outside cryptography expert and uses that expertise only where necessary. The lawyers ask informed questions, translate the technical answers into practical legal choices, and remain responsible for the legal judgment.The difference was not mastery of quantum physics. Firm B had enough baseline literacy to recognize the issue, frame it accurately, and work effectively with a specialist.Sophisticated clients do not divide their business problems according to law-firm organizational charts. A problem that begins in cybersecurity can migrate into contracts. A contract issue can implicate IP. An IP problem can become litigation. Litigation produces discovery. Discovery raises evidence questions. Evidence requires forensic experts.That is why quantum literacy may become a client-service issue as well as a competence issue.A firm does not need a full quantum practice group tomorrow. It does need enough baseline literacy to recognize tomorrow’s question and respond responsibly.Suppose a manufacturer has engineering designs expected to retain commercial value for twenty years.Nobody in that group needs to design a quantum processor or even know the math. But they need enough common vocabulary to recognize that they are looking at different parts of the same client problem.Nobody in that group needs to design a quantum processor or even know the math. But they need enough common vocabulary to recognize that they are looking at different parts of the same client problem.NIST’s National Cybersecurity Center of Excellence treats cryptographic discovery and inventory as foundational to migration planning. Its Migration to Post-Quantum Cryptography project focuses on identifying where quantum-vulnerable public-key algorithms are used across hardware, software, and services, and then using those inventories to assess risk and prioritize migration.Building that inventory is primarily a technical exercise. The decisions it informs are not. Lawyers must help determine which information matters most, how long it must remain protected, and what contracts or legal duties apply. They must also help allocate migration responsibility and identify risks that require escalation. That is where lawyers belong in the room.Lawyers must help determine which information matters most, how long it must remain protected, and what contracts or legal duties apply. They must also help allocate migration responsibility and identify risks that require escalation. That is where lawyers belong in the room.This is also why shared education can be useful. One informed lawyer may see the issue; a prepared cross-practice team can coordinate the response. Quantum literacy is less about creating a new department than giving several departments a common language.The economics look different for in-house counsel. General counsel may reasonably prefer not to pay outside counsel to learn the vocabulary while the meter is running. They may want to turn to their own team first and only bring in outside specialists when needed.Knowledgeable in-house lawyers need to know about ML-KEM, NIST’s standardized post-quantum encryption (as detailed in NIST Releases First 3 Finalized Post-Quantum Encryption Standards), but they do not need to understand its mathematics. The lawyer’s role is different: help identify cryptographic dependencies, determine which information and digital signatures require long-term protection, allocate migration responsibilities in third-party contracts, coordinate with IT and information-governance professionals, and recognize when specialist assistance is required.That lawyer can also insist that experts explain assumptions, limitations, costs, and timelines in language decision-makers can understand. A useful baseline includes knowing the right kinds of questions to ask and recognizing when the internal team is beyond its depth. That professional skill is often underrated.Return to our general counsel. The board has asked about a long-lived trade secret. The cybersecurity team is discussing post-quantum migration. A critical vendor contract is coming up for renewal. The insurer has questions. The company is considering an acquisition. The general counsel either calls outside counsel or turns to the company’s own quantum-readiness team.She does not ask: “Can you explain Hilbert space?” She asks: “Can you help us?”The answer does not require a quantum physicist with a law degree. It requires lawyers who can recognize the issues, bring in the right expertise, connect technology to law and business, and exercise accountable human judgment.Preparation guarantees nothing, including that today’s quantum predictions will unfold on schedule. Technology has a mischievous habit of ignoring our calendars; it can arrive astonishingly early or late.But the professional logic is familiar. Lawyers need not predict the exact date of technological change to recognize emerging legal issues, ask informed questions, and help clients prepare proportionately.When clients begin asking quantum questions, readiness may simply mean understanding what the client is asking and knowing how to find reliable answers.The machine may calculate. The law must still judge.Author’s note: This article is part of a series exploring themes developed in my eight-class online course, QUANTUM LAW: From Causation to Probability, AI, Quantum Computing, and the Future of Legal Judgment .See more »© EDRM - Electronic Discovery Reference Model Refine your interests »Are you...Share your lateral move experience in our confidential 8-minute survey.Back to TopExplore 2026 Readers' Choice Awards Do Not Sell or Share My Personal Information Cookie Preferences Copyright © JD Supra, LLC