We investigate covert communication over general memoryless classical-quantum channels with fixed finite-size input alphabets. We show that the square root law (SRL) governs covert communication in this setting when product a ofninput states is used:$L_{\mathrm { SRL}}\sqrt {n}+o(\sqrt {n})$covert bits (but no more) can be reliably transmitted innuses of classical-quantum channel, where$L_{\mathrm { SRL}}\gt 0$is a channel-dependent constant that we callcovert capacity. We also show that ensuring covertness requires$J_{\mathrm { SRL}}\sqrt {n}+o(\sqrt {n})$bits secret key shared by the communicating parties prior to transmission, where$J_{\mathrm { SRL}}\geq 0$is a channel-dependent constant. We assume a quantum-powerful adversary that can perform an arbitrary joint (entangling) measurement on allnchannel uses. We determine the single-letter expressions for$L_{\mathrm { SRL}}$and$J_{\mathrm { SRL}}$, and establish conditions when$J_{\mathrm { SRL}}=0$(i.e., no pre-shared secret key is needed). Finally, we evaluate scenarios where covert communication is not governed by the SRL.