Classify First: Why encryption is not the first step for the Post-Quantum Migration

Before law firms spend a dollar on cryptographic upgrades, they need to answer a question most have never formally posed.

In December 2025, I wrote an article for Legalverse discussing the mechanics of the quantum threat and the NIST standards that define the industry’s response. That piece addressed the “what” of post-quantum cryptography. This article addresses what most organizations are getting wrong about the “how.”

The dominant industry posture toward post-quantum migration can be summarized simply: identify your cryptographic assets, prioritize migration timelines, and begin re-encrypting the enterprise. That response is incomplete, and in many cases, it is structurally counterproductive.

The more consequential question is not how to encrypt everything. It is what actually deserves to be encrypted in the first place.

Three Crises, One Unresolved Problem

Post-quantum migration does not arrive in isolation. It converges with two other crises already in motion, and all three share the same structural root.

The first is the Harvest Now, Decrypt Later (HNDL) threat. Nation-state actors and sophisticated criminal organizations are already capturing encrypted data today, including privileged communications, trade secrets, litigation files, and financial records, in anticipation of future quantum decryption capabilities. This is not speculative since “Intelligence” assessments have confirmed that state-level adversaries are systematically accumulating encrypted data. For any record with a sensitivity horizon longer than five to ten years, the risk is already in motion. Law firms…keep in mind that attorney-client privilege has no-shelf life, it goes on forever.

What makes this threat more complex than most practitioners appreciate is that quantum computing is not a single technology on a single timeline. At least six distinct hardware architectures are in active development, each maturing at a different pace. In addition, quantm chips are being used in traditional computing environments. The threat is not a single “Q-Day” event. It is a rolling capability expansion across competing systems, some of which will reach cryptographically relevant thresholds far earlier than current planning frameworks anticipate.

The second crisis is AI governance. Organizations are deploying generative and agentic AI systems across data estates that have never been classified, governed, or rationalized. An AI system does not distinguish between governed and ungoverned data. AI processes what it can access. An organization deploying AI across an unclassified repository of legacy content has not simply adopted a new technology. It has automated its governance failures at scale, surfacing expired personal data, obsolete trade secrets, and superseded records in outputs and training runs in ways that generate regulatory liability the organization cannot easily trace.

The third crisis is one that current regulatory frameworks have largely failed to acknowledge. Most AI governance regimes, including the approach reflected in the CAIDP Index 2026 and the EU’s developing regulatory architecture, are built on 20th century assumptions: that data has a fixed location, exists in a binary state, and can be governed through geographic jurisdictional frameworks. Quantum computing has already begun to render those assumptions obsolete.

Information processed across quantum-classical hybrid networks can exist in multiple states and locations simultaneously, and the encryption schemes that current regulations presuppose to be secure are precisely the ones that quantum adversaries are targeting. Applying classical binary governance frameworks to quantum-era AI is, to put it plainly, using last century’s concepts to regulate this century’s technology.

What all three crises share is this: they cannot be managed responsibly on an unclassified data estate. And most large organizations, including most large law firms, cannot describe with confidence what they hold, why they hold it, or how long its confidentiality must be preserved.

The Missing Layer: Legal Data Intelligence

The industry has produced extensive guidance on how to protect enterprise data from quantum-era threats. It has produced far less on how to determine, systematically and defensibly, which data is worth protecting in the first place.

That determination is the work of legal data intelligence: an AI-assisted process for classifying the enterprise data estate into what is Sensitive, Useful, or Necessary (SUN) and what is Redundant, Obsolete, or Trivial (ROT).

SUN data includes protected personal information, confidential business records, trade secrets, records subject to litigation hold, and any data with a documented legal or operational basis for continued retention. SUN data is the target of post-quantum migration and should be protected with quantum-resistant cryptographic controls as a priority.

ROT data includes duplicate records, superseded documents, expired personal data with no remaining retention basis, trivial communications, and any content that lacks a current legal or business justification for continued storage. ROT data is a deletion candidate and should be defensibly eliminated before migration begins.

The financial argument for this sequence is significant. For organizations holding petabyte-scale data estates, the ROT ratio frequently exceeds fifty percent of total stored data. Classifying and deleting before migration can reduce the effective migration scope by half or more before any cryptographic work begins.

The more fundamental argument is this: defensible deletion is the only mathematically certain defense against HNDL risk for legacy data. Every cryptographic control operates probabilistically. It can, in principle, be broken. Deleted data cannot be decrypted because it no longer exists. For law firms holding decades of client files, sealed settlement agreements, and litigation strategy memoranda, that distinction is not academic. It is the difference between a manageable migration and an indefinite HNDL exposure across an ungoverned archive.

What This Means for Law Firms

The SUN/ROT framework is not a technology problem. It is a governance problem, and one that legal professionals are better equipped to lead than most practitioners recognize.

The analytical work required, evaluating records for legal necessity, applying retention schedules, assessing litigation hold obligations, and documenting the rationale for disposition decisions, is the same discipline that competent records management and information governance programs have always demanded. Firms that have invested in those programs are closer to quantum readiness than they may realize. Firms that have not are starting behind in every dimension simultaneously.

AI-assisted classification makes this work tractable at enterprise scale. Modern classification systems can analyze document collections at high volume, apply issue-specific relevancy criteria calibrated to the organization’s legal and regulatory obligations, produce confidence-scored SUN/ROT assessments, and generate the audit trails that support defensible deletion in regulatory review, litigation, or insurance underwriting contexts.

The Model Rules implications follow directly. Competence under Rule 1.1 now encompasses quantum risk awareness. Confidentiality under Rule 1.6 requires that reasonable protective measures evolve with the threat landscape. Supervision under Rules 5.1 and 5.3 extends those obligations to third-party services providers, whose PQC migration timelines must be evaluated as part of any responsible governance program. As the first confirmed HNDL breaches become public, the argument that firms “did not know” will no longer function as a defense.

The Right Starting Point

The quantum clock is already running. The data governance clock has been running longer. The organizations that align them, using AI-driven classification to build a governed and defensible data estate before migration begins, will define what responsible data stewardship looks like for the next decade.

The first step is not a cryptographic decision. It is a governance decision.

Classify first. Delete what you can defensibly remove. Then protect what remains with newly established PQE standards.