Legal impacts of AI, blockchain and quantum

Further reading from this practice: What is a Notary Public in Cork?, Notary Public vs Commissioner for Oaths in Ireland, The apostille process in Cork — a working guide, Irish company law in 2026 — what a CFO must know, Brexit and your commercial contracts five years on. For Hugh's background and qualifications, see Hugh Phelan.

Three forces are arriving at the corporate legal function at the same time. Artificial intelligence executes work that used to require a person. Blockchain records that work in a form that cannot be erased. Quantum computing threatens to undo the cryptography that holds the chain together. Each of these is a serious legal question on its own. The compound question — what happens when an AI agent executes a contract on a blockchain, signed with a cryptographic key that a quantum machine will eventually be able to forge — is the one I find general counsels are not yet ready to answer.

This is a working note on how I approach the compound problem for corporate clients. It is written from an Irish practice, applies Irish and EU law as transposed, and is intended for the in-house lawyer or finance leader rather than the technologist. The note is deliberately long because the question is layered. Where one of the three layers is doing the heavy lifting, I will say so.

The first layer: AI liability under the EU AI Act

The EU AI Act came into force in August 2024 and is being transposed in Ireland through a national implementation programme led by the Department of Enterprise. The Act takes a risk-based approach. High-risk AI systems — defined in Annex III and including systems used in credit decisions, employment, critical infrastructure and certain regulated professional services — attract substantive obligations on providers and deployers. Limited-risk systems attract transparency obligations. General-purpose AI models carry a layered set of duties depending on systemic risk.

The Irish exposure is twofold. First, an Irish company that develops or deploys a high-risk AI system is a provider or a deployer (or both) under the Regulation and inherits the corresponding obligations. Second, an Irish company that uses any AI system in a way that causes harm faces ordinary tort and contract liability, which is not displaced by the Act and which Irish courts will determine on Irish principles.

The harder question is who is liable when an AI agent executes a contract. The Irish position, which I take to follow from agency principles and the law of contract, is that the AI agent is not a legal person and cannot bind anyone in its own right. The person who deployed the agent is bound by what the agent does within the scope of the authority conferred. The drafting consequence is that the operative agreement must define that authority — what the agent may do, what it may not do, what threshold requires human ratification, and what happens if the agent acts outside scope.

This is uncomfortably close to nineteenth-century agency law and the law of master and servant. The doctrines transpose but the factual matrix is alien. A general counsel cannot rely on the conventional indicators of authority — instructions given, prior course of dealing, custom of the trade — because the AI agent has no concept of any of these. It has a system prompt, a tool set, and a reward function. The agreement must speak to all three.

The second layer: blockchain immutability versus GDPR versus admissibility

I have addressed the GDPR collision in detail in my note on blockchain and Irish law. The short version is that the Article 17 right to erasure is in structural tension with an immutable ledger, that the working answer is to keep personal data off-chain and store only hashes on-chain, and that this requires a Data Protection Impact Assessment before deployment.

The harder question, layered onto AI, is evidentiary. An immutable record of an AI agent's actions is, in one sense, the perfect audit trail. In another sense, it is a record of decisions made by a process that may not be capable of explanation. The EU AI Act's transparency obligations require deployers of high-risk systems to be able to explain decisions. A blockchain log of inputs and outputs is not an explanation; it is a record. The two are not the same.

The admissibility position in Irish courts has not been tested for AI-generated evidence on a blockchain. My working view is that the evidence is admissible — Irish rules on documentary and electronic evidence are not narrow — but that its weight depends on the integrity of the chain of custody from the AI agent's output to the on-chain record. The party seeking to rely on the record will need to show how the input arrived at the agent, what the agent's configuration was at the time, how the output was committed to the chain, and that the on-chain state has not been the subject of a contested fork. None of this is trivial.

The practical advice I give is to record more, not less. The blockchain record of an AI agent's action is most useful when it is paired with off-chain logs of the agent's configuration, system prompt, tool calls and decision rationale at the moment of action. A blockchain record alone is a thin evidentiary basis. A blockchain record cross-referenced to comprehensive off-chain logs is a much stronger one.

The third layer: quantum and the cryptographic substrate

The cryptography that secures every blockchain in production today — primarily ECDSA over the secp256k1 curve for Bitcoin and Ethereum, and Ed25519 for several newer chains — is breakable by a sufficiently large fault-tolerant quantum computer. The same is true of the RSA and ECC algorithms that secure most of the web's TLS connections, banking signatures and notarial digital seals.

The timing question divides serious cryptographers. Estimates of when a cryptographically relevant quantum computer will exist range from five years to twenty. The U.S. National Institute of Standards and Technology has standardised post-quantum signature algorithms — primarily ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) — and the EU's cybersecurity agency ENISA has recommended migration timelines. The harvest-now-decrypt-later threat — adversaries collecting encrypted material today to decrypt when a quantum machine arrives — is not hypothetical for long-lived secrets.

The legal implications run in three directions.

First, signatures. Every digital signature in use today is potentially forgeable by a future quantum machine. A contract signed in 2026 with a conventional cryptographic signature, if it remains in force in 2036, may be capable of being forged retrospectively. Irish electronic signatures law — primarily the eIDAS Regulation as it applies in Ireland and the Electronic Commerce Act 2000 — does not currently mandate quantum-resistant signatures. It will, in time. A general counsel signing long-dated contracts now should think about whether the cryptographic substrate of those signatures is intended to survive to maturity.

Second, notarial seals. The notarial profession in Ireland and across the European Union is moving toward digital notarial acts. The cryptographic seal that authenticates a digital notarial act is currently based on conventional public-key cryptography. The Faculty of Notaries Public Ireland and the Council of the Notariats of the European Union are aware of the quantum question. The practical response — which the profession has not yet formalised — will be migration to post-quantum signature schemes for digital notarial acts, and continued use of physical paper-and-seal notarial form for documents that must survive the migration.

Third, blockchain assets. A wallet whose public key is exposed on-chain — every wallet that has ever transacted — is, in principle, vulnerable to a quantum adversary. The crypto industry's response is the development of quantum-resistant chains and quantum-resistant key formats. For an Irish company holding meaningful digital-asset reserves, the question is when to migrate. The answer is before the threat is operational, not after. The same harvest-now-decrypt-later logic that applies to encrypted communication applies to wallet keys, with the additional twist that the assets are visible and addressable on-chain.

The compound problem: what happens when all three converge

Consider the following hypothetical, which is not particularly hypothetical for any company with a working AI and digital-asset programme. An AI agent, deployed by an Irish company, executes a contract with a counterparty by submitting a transaction to an Ethereum smart contract. The transaction is signed with the company's wallet key. The contract is performed on-chain, and the on-chain record is the evidence of performance. Three years later, the counterparty disputes the transaction, alleging that the AI agent acted outside its authority and that the signature was forged.

The general counsel's task is to defend the transaction. The questions multiply quickly. What was the agent's configuration at the moment of action, and can that configuration be reconstructed? What authority did the agent have, and how is that authority documented? Was the signature genuine, and what cryptographic substrate was used to verify it? Has the substrate been compromised, or is it still considered secure? If the substrate is no longer secure, what is the evidentiary weight of the on-chain record?

None of these questions has a single answer in Irish law as it stands. The first is a question of operational record-keeping, with the AI Act's transparency obligations providing some scaffolding. The second is a question of contract interpretation, where the operative agreement's definition of agent authority is decisive. The third is a question of cryptographic forensics, which Irish courts have not had to confront at scale. The fourth is a question of expert evidence on the state of the cryptographic art, and the fifth is a question of judicial discretion under Irish evidence rules.

What I tell clients is that the answers begin at the design stage, not in the courtroom. A company that has documented its AI agents' authority, that has paired on-chain records with comprehensive off-chain logs, that has a migration plan for its cryptographic substrate, and that has obtained periodic legal review of these as the regulatory landscape moves, is in a substantially stronger position than a company that has done none of these. The discipline is preparation, not prediction.

Professional negligence exposure for legal advisors

The standard of care of a solicitor in Ireland is the standard of a reasonably competent solicitor practising in the relevant field. That standard moves with the field. A solicitor who advised a client on a digital-asset transaction in 2018 was not negligent for failing to consider MiCA, because MiCA did not exist. A solicitor advising on the same transaction in 2026 is negligent if MiCA is not part of the analysis.

The implication for the legal profession — and I count myself in this — is that the compound problem of AI, blockchain and quantum is now squarely within the standard of care for any solicitor advising on technology, financial services, or significant commercial transactions. The defence "I am not a technologist" is not available. The expectation is that the solicitor will understand the legal implications of the technology well enough to advise on them, and will obtain expert evidence where the technical detail exceeds ordinary professional competence.

The same is true of in-house counsel. A general counsel who fails to flag the AI Act exposure of a new product, or the quantum vulnerability of a long-dated contract's signature substrate, or the GDPR collision of an on-chain personal-data deployment, is exposed under their employment relationship and, in regulated firms, under the Central Bank's fitness-and-probity regime.

Seven principles for the corporate legal function

1. Define the AI agent's authority in writing, and define it narrowly. The operative agreement under which an AI agent executes contracts must specify what the agent may do, what it may not do, what threshold of value or risk requires human ratification, and what happens if the agent acts outside scope. Authority comes from the agreement, not from custom or system prompt.

2. Pair on-chain records with off-chain logs. A blockchain record of an AI agent's action is most useful as evidence when it is paired with comprehensive off-chain logs of the agent's configuration, inputs, tool calls and rationale at the moment of action. Record more, not less.

3. Treat the AI Act's transparency obligations as a documentation discipline. The Regulation's requirement that high-risk systems be capable of explanation is not satisfied by post-hoc reasoning. It requires architectural choices made at deployment and documented through the system's life. The DPIA, the AI Act conformity assessment, and the contract under which the agent operates are the same documentation problem viewed three times.

4. Migrate cryptographic substrates before they are broken, not after. Long-dated contracts, notarial seals, digital signatures and wallet keys whose security depends on conventional public-key cryptography should have a migration plan to post-quantum schemes. The migration is not yet mandatory in Irish law but it will be, and the harvest-now-decrypt-later threat does not wait for the law.

5. Notarise in paper form for documents intended to survive the migration. Where a document is intended to remain enforceable beyond the working life of the cryptographic substrate that would otherwise secure it, a paper notarial act with manuscript signature, seal and apostille remains the gold standard. The cryptographic alternatives are improving but the paper instrument has the longest evidentiary half-life.

6. Conduct legal review of AI and blockchain deployments on a periodic basis. The regulatory landscape is moving faster than the design cycle of most deployments. A deployment that was compliant when launched may not be compliant a year later. Build a periodic legal review into the operating cadence of the function, not a one-off launch check.

7. Document the decisions that were not taken. The hardest position to defend, three years after the fact, is the position that no one considered the question. A short written record that the question was considered and the decision was made — even if the decision was to proceed without further action — is the difference between a defensible record and a negligent one.

The three forces are not going to slow down to accommodate the corporate legal function. The function is going to have to develop the muscle to think across them at once. The discipline is the same as in any other area of legal practice — classify the problem, identify the rules, apply them, document the work, prepare for the dispute — but the surface area is wider than anything most corporate legal teams have had to handle before.

For a related working note on the underlying treatment of blockchain transactions under Irish law, see blockchain and Irish law. To book a notarial appointment with Hugh Phelan, call (021) 489-7134 or visit phelansolicitors.com.