Your firm’s confidentiality duty doesn’t expire when a matter closes. Encryption, as it turns out, might.
On June 30, 2026, Mark Russinovich, the chief technology officer of Microsoft Azure, wrote that the company is accelerating its Quantum Safe Program. The goal is to move its products and services to post-quantum cryptography (new encryption designed to hold up against quantum computers) by 2029. His post says Microsoft believes quantum computers capable of breaking current encryption “could arrive sooner than previously expected.” Microsoft hasn’t named a specific breakthrough behind the change. Russinovich told BleepingComputer it was a “proactive, risk-informed decision,” so nobody is claiming client files are readable today.
The risk that reaches your firm now is called “harvest now, decrypt later.” Attackers copy encrypted data today and hold it until a quantum computer can open it. Say someone captures the encrypted traffic between your office and your document management system this year. It’s unreadable now. If they can wait, it becomes a set of client communications and work product they can read later.
Most of what you handle stays confidential for years. Client files are commonly kept seven years or longer in California, depending on the matter, and the duty to protect a former client’s confidences doesn’t end when the file closes. A matter closed in 2026 is still confidential in 2036, which is well past Microsoft’s 2029 target.
What the rules ask of you
Nothing in California’s rules mentions quantum computing. The duty of competence under Rule 1.1 has been read by the State Bar to include technology, and Formal Opinion 2010-179 frames it as taking reasonable steps that fit the sensitivity of the information and the safeguards available. The confidentiality duty itself sits in Business and Professions Code section 6068(e). If you can show your firm asked the right questions about its tools, you’re in a stronger position than a firm that never looked.
What I would do
Microsoft’s own advice for other organizations is housekeeping. Its June post lists four items. Assign an owner and milestones for a multi-year transition, build systems so the encryption can be swapped out later, keep a living inventory of where cryptography is used, and move to TLS 1.3, the current protocol that secures network connections. Russinovich writes that the hardest part is finding where cryptography already exists.
I would start with that inventory, which comes down to knowing where your client data lives. List the systems that hold client information: Microsoft 365, your practice management platform, whether that’s Clio, MyCase or another, your document management system, e-filing portals, and the firewall and VPN at the office. Then ask each vendor in writing for their plan for post-quantum encryption. Write down the answers and the dates.
Microsoft is handling its own products. Your exposure sits with the tools it doesn’t ship, and with any hardware that is past its support date. Replacing unsupported equipment is the second step, and it’s one many firms are already planning. I’d skip any pitch for a quantum product this year.
The duty of confidentiality outlasts the matter, so the question to settle first is which of your systems carry client information. If you’d like help building that list, Xentric, which provides managed IT services for law firms, can walk through your systems and document the vendor answers before a client or an insurer asks for them. That part is up to you.