Quantum is the next big thing for tech lawyers and 2027 will be the year we all talk about it — Part two

In the first part I said the Quantum Act is coming, that the negotiation runs across 2026 and 2027, and that the part nobody is discussing is the part that will reach our desks first. Let me now make good on all three.

Start with the legal basis, because it tells you what the Act is

The Commission’s 2026 Work Programme gave an indicative legal basis of Articles 173, 180 and 184 TFEU.

Read those three. Article 173 is industry and the competitiveness of European industry. Articles 180 and 184 sit in the research and technological development title. What is not there is Article 114, the internal market basis that carries the GDPR, the AI Act, the Data Act and almost everything else we deal with. And nothing in there speaks to fundamental rights.

This is not a technicality. The legal basis constrains what an instrument can do. An Act built on 173, 180 and 184 is an industrial and research instrument. It can fund things, coordinate things, build pilot lines, create governance structures, organise procurement and set up a design facility. It cannot easily impose rights-protective obligations on private actors, because that is not what those Articles are for.

So when you read the call for evidence and see the three objectives — boost research and innovation, scale up industrial capacity, reinforce supply chain resilience and governance — do not read that as a regulatory programme with the industrial bits attached. Read it the other way round. This is industrial policy, and it is honest about being industrial policy.

I want to be clear that this is legitimate. Europe has a real coordination problem in quantum: twenty-something national networks built to different specifications, a fragmented supply chain, and dependencies that make people in Brussels nervous for good reason. An instrument that fixes that is worth having.

The risk is not that the Act is industrial policy. The risk is that we discuss it as though it were protection, wait for it to address the questions we care about, and then discover in 2028 that it was never designed to.

Why “dual-use” is the word to watch

I flagged this phrase at the end of Part 1 and here is why.

The Quantum Europe Strategy identifies quantum computing, communication and sensing as having clear dual-use potential, civil and defence at once. That is not a rhetorical flourish. It is an accurate description, and it has consequences that most people in our field have not yet absorbed.

The first consequence is immediate and legal. Quantum technology sits inside the dual-use export control regime, and the control lists have been updated to reflect it. Export control does not care that your client is a university, a research consortium or a startup with eleven employees. It catches things that do not feel like exports at all: sharing technical knowledge with a colleague of the wrong nationality, granting a visiting researcher access to a system, hosting a repository in the wrong place. I now meet clients who are already non-compliant and entirely cheerful about it, because nobody has ever told them that this is an export control question.

The second consequence is cultural, and it is slower and more serious. When a technology is framed as dual-use, the governance logic that attaches to it is a security logic. Security logic prefers restriction to disclosure, classification to publication, vetted access to open access. Every transparency instinct we have built our profession on runs in the opposite direction.

So if you want to know where the friction in this file will be, it is there. Not in whether quantum should be funded. In how much of it can be discussed.

What actually lands on our desks first

Here is the part I most want to persuade you of. The first quantum obligations your clients face will not come from the Quantum Act. They come from law that already exists, and some of them are live now.

Article 32 GDPR. Security appropriate to the risk, taking into account the state of the art. State of the art is a moving standard — that is the whole point of drafting it that way. Post-quantum algorithms have been standardised and published, implementations exist, and national agencies across Europe have issued guidance saying to adopt them. Ask yourself at what point it stops being defensible to protect twenty-year-retention health data with cryptography that is known to be breakable. For some categories I think that point has already passed.

Retention. Harvest now, decrypt later means an attacker can take encrypted data today and open it in fifteen years. So a retention period is also a statement about how long confidentiality must survive, which makes it a statement about cryptography. Retention schedules and crypto inventories are now the same document, and nobody has ever built them together.

Breach notification. Article 34(3)(a) relieves you of notifying data subjects where the data was rendered unintelligible, with encryption as the example. Unintelligible when? The provision does not say, because in 2016 nobody needed it to. If you relied on that exemption for data that will be readable in 2040, you should at least know that the assumption underneath it is contestable.

NIS2 and DORA. The post-quantum migration already has dates attached in European instruments — the Commission’s 2024 Recommendation on a coordinated roadmap, the Cooperation Group’s milestones, and the proposal published in January 2026 to amend NIS2. Most of your clients have not heard of any of them.

Quantum cloud pilots. If anyone in your client’s organisation is experimenting with quantum computing, they are doing it through a cloud service on somebody else’s machine, usually outside the EEA, under terms nobody reviewed as a processing arrangement. That is Article 28, Chapter V and Article 30, all of it ordinary, all of it unexamined — because the word “quantum” makes people file it under research instead of under processing.

Not one of those requires a new Act. All of them are answerable today, and the honest summary is that our profession has a compliance backlog it does not yet know about.

And the thing nobody is talking about at all

One more, and it is the one I care about most.

Every risk list I have read about quantum concerns computing. Encryption, cost, supply chains, competitive advantage. Almost nothing concerns sensing — which is the pillar with the most actual deployment, and the only one where I can find a genuine gap in our law.

Quantum magnetometers are already being used to build lighter, cheaper brain imaging. Neural data is not named in Article 9; we reach it through “data concerning health,” which works cleanly in a hospital and requires an argument everywhere else. Colorado and California have both amended their statutes to add neural data explicitly. We have not. And beyond that sits the harder problem of measurement at a distance, through matter, of a person who never interacted with any system — where the GDPR’s whole delivery mechanism, notice and consent and objection, has nothing to attach to.

The Quantum Act will not address any of this, and not because anyone is being careless. It will not address it because Articles 173, 180 and 184 cannot.

Which leaves the question for us. If the instrument that gets all the attention cannot do the thing that most needs doing, whose job is that?

I think it is ours. And I think we have about two years in which the questions are still cheap to ask.