
AI and Post-Quantum Cybersecurity: A Migration Playbook
A practical 2026 guide to cryptographic inventory, NIST post-quantum standards, AI-assisted discovery, crypto agility, migration priorities, and release evidence.
Read MoreZharfAI Team

AI can retrieve authorities, compare clauses, organize discovery, draft chronologies, and make legal information easier to navigate. It can also fabricate a citation, waive confidentiality, miss controlling law, overstate a contract right, or give a vulnerable person advice without understanding the facts.
Legal AI in 2026 is an instrument under professional and institutional responsibility. It is not counsel, a judge, a privilege holder, or an accountable advocate. The lawyer or public authority remains responsible for accuracy, confidentiality, procedure, fairness, and judgment.
Separate public-information retrieval, internal research, document review, contract analysis, drafting, prediction, client advice, filing, judicial administration, and adjudication. The same model may be acceptable for one and dangerous for another.
State jurisdiction, court, matter, date, source corpus, user, output, and permitted action. Identify who may practice law, who owes duties to the client, and who can approve a filing or legal position.
Never present a general model as licensed counsel. A tool may assist an authorized professional or provide clearly bounded information; it cannot assume professional responsibility.
ABA Formal Opinion 512 addresses generative AI under duties including competence, confidentiality, communication, candor, supervision, and reasonable fees. It interprets ABA Model Rules and is not binding law in every jurisdiction.
Map the rules of the relevant court, bar, regulator, client, and matter. Some uses may require informed client consultation; some tools may be prohibited for particular data or proceedings.
Document the lawyer's review and independent reasoning. “The model wrote it” is neither an explanation nor a defense.
Models can retrieve a relevant case yet misstate its holding, jurisdiction, procedural posture, date, quotation, or subsequent treatment. Retrieval augmentation reduces some fabrication but does not ensure that the retrieved authority answers the question.
The original Stanford study Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools tested specific commercial tools on a defined question set and found material errors. Its rates should not be generalized to every version, jurisdiction, or research task.
Open every cited authority in an authoritative source. Check citation, quotation, proposition, jurisdiction, precedential status, negative treatment, effective date, and factual fit. Preserve the search trail and omitted contrary authority.
The UK judiciary's Artificial Intelligence judicial guidance warns judicial office holders about accuracy, confidentiality, bias, and responsible use. It is guidance for that judiciary, not a global procedural code.
Never file a citation, quotation, exhibit, declaration, translation, or factual assertion without verification. Synthetic evidence, altered media, and generated summaries need authentication and disclosure under applicable rules.
Court-specific AI certifications, standing orders, e-filing rules, and sanctions law must be checked at the time of filing. Supervising counsel signs because counsel has reviewed the work.
Prompts may contain client identities, legal strategy, health, trade secrets, witness accounts, settlement positions, or personal data. A provider may log, review, retain, route, or use inputs in ways inconsistent with professional duties.
Before use, examine terms, retention, training, subprocessors, location, access, security, deletion, incident response, and legal process. Use approved environments, minimum necessary data, matter-level access, and redaction where appropriate.
Do not assume anonymization preserves privilege or privacy. Privacy-enhancing technologies can reduce exposure in some workflows but cannot cure an unauthorized disclosure or inappropriate purpose.
A tool may serve opposing firms, train on licensed databases, rank sources through undisclosed commercial logic, or recommend services from a partner. Conflict checks cannot be delegated to semantic similarity.
Maintain ordinary client and matter conflicts, plus vendor, data, expert, and model-provider relationships that could affect independence. Contract for confidentiality and separation without claiming technical isolation that has not been verified.
Lawyers must exercise independent judgment when a model's output favors speed, settlement, or a familiar position. Convenience is not the client's interest.
AI can extract dates, parties, obligations, deviations, and missing clauses. It may confuse definitions, attachments, amendments, governing law, hierarchy, negotiated exceptions, or business practice.
Create a controlled playbook with clause source, jurisdiction, transaction type, risk owner, acceptable ranges, and escalation. Show reviewers the exact text and document location. Do not reduce legal effect to a red/green score.
AI for legal operations and contract intelligence describes how structured review can preserve negotiated context, approvals, and obligation tracking.
Classification can prioritize review, identify duplicates, cluster issues, and support privilege analysis. Recall, precision, sampling, and quality control must match the case, agreement, and court expectations.
Define custodians, sources, collection, preservation, processing, search, review protocol, validation sample, privilege handling, and production. Test unusual formats, languages, images, threads, and short messages.
AI for legal evidence and discovery addresses chain of custody, proportionality, technology-assisted review, and human privilege review. A model flag does not establish relevance, privilege, or authenticity.
Models may estimate case duration, judge behavior, settlement range, bail, sentence, or recidivism. Historical data reflect law, advocacy resources, enforcement, plea bargaining, missing cases, and prior inequality.
Report population, time period, exclusions, uncertainty, calibration, and subgroup performance. A prediction cannot replace individualized facts, procedural rights, or judicial discretion.
The EU's AI Act navigation guidance identifies certain administration-of-justice uses as high-risk while its application schedule evolves. Verify the current legal text and role; classification does not itself decide whether a use is lawful or wise.
AI can explain a process in plain language, translate, and prepare intake. It may miss urgency, coercion, disability, capacity, conflict, or facts that change the legal answer.
Tell clients when AI use is material to representation or confidentiality under applicable duties. Explain limits, options, cost, and who reviews. Provide a direct lawyer contact for advice and consequential decisions.
Do not let a chatbot create an accidental attorney-client relationship or a false deadline. Emergency, limitation, hearing, and safety issues need immediate escalation.
Guided information can help people identify forms and services, but “free AI lawyer” can shift risk onto those least able to verify it. Public tools should state jurisdiction, source date, scope, and when legal representation is needed.
Design for screen readers, keyboard, plain language, low bandwidth, multiple languages, and assisted offline routes. Test translated legal meaning with qualified reviewers. Track who abandons or receives no answer.
Accessibility is not achieved by shortening legal text until important rights disappear. People need usable explanation plus access to the authoritative document and human help.
AI can reduce time on repetitive work. Firms should not bill fictional hours or hide efficiency while charging as if manual work occurred. Fee arrangements and disclosures must follow applicable rules and client agreements.
Paralegals, junior lawyers, translators, reviewers, and support staff may lose training opportunities or face increased monitoring. Redesign supervision and learning so expertise is not hollowed out.
Measure quality, rework, workload, and professional development—not only hours removed. A firm that cannot independently verify output has automated away its competence.
Opponent documents, websites, emails, and data rooms may contain prompt injection or poisoned text. Treat retrieved material as untrusted. Separate model access from filing, billing, document-management, and client systems.
Require explicit authorization for writes, protect credentials and logs, scan outputs, and preserve matter boundaries. Test provider outage and model change. Maintain conventional legal-research and filing capability.
An AI incident may be a security breach, privilege problem, missed deadline, false filing, or malpractice event. Escalate through all relevant channels.
Research metrics include authority precision and recall, citation validity, treatment accuracy, jurisdiction fit, contrary-authority coverage, and reviewer correction. Contract metrics include extraction accuracy, missed material terms, escalation quality, and obligation completion.
Discovery metrics include recall, precision, elusion sampling, privilege error, production correction, and cost. Client metrics include comprehension, accessibility, response time, complaint, and outcome.
Compare against qualified human and conventional search baselines. Include verification time, subscription, security, remediation, and professional liability. Faster first drafts do not guarantee cheaper or better legal service.
Start with internal search over controlled, non-confidential material and low-risk drafting. Build approved sources, matter controls, verification checklists, and staff training. Run shadow evaluation on completed matters, then limited live use with supervising-lawyer approval.
Predefine stop conditions for fabricated authority, confidentiality exposure, privilege error, missed controlling law, inaccessible client service, unexplained model change, biased outcome, or inability to reconstruct research.
The release record should identify jurisdiction, matter type, legal task, provider and model, source corpus and date, data classification, privilege controls, evaluation, human reviewer, client communication, court rules, security, fallback, and reassessment date.
AI can help lawyers find and organize information. Justice improves only when human professionals verify the law, protect the client, explain the choice, and remain answerable to the court and public.
Sources reviewed and status checked on 2026-07-30:

A practical 2026 guide to cryptographic inventory, NIST post-quantum standards, AI-assisted discovery, crypto agility, migration priorities, and release evidence.
Read More
From approvals to multi-step operations: How agentic AI turns fragmented business processes into governed, observable workflows.
Read More
A field-service operating model for trustworthy asset data, predictive maintenance, constrained dispatch, technician evidence, and safe return to service.
Read MoreSee the daily briefing and the operational guides. This page is an archive note, not an invitation to start a project.