This paper considers the problem of communication over a memoryless classical-quantum wiretap channel subject to the constraint that the eavesdropper on the channel should not be able to learn whether the legitimate parties are using the channel to communicate or not. Specifically, the relative entropy between the output quantum states at the eavesdropper when a codeword is transmitted and when no input is provided must be sufficiently small. Extending earlier works, this paper proves the "square-root law" for a broad class of classical-quantum channels: the maximum amount of information that can be reliably and covertly transmitted over $n$ uses of such a channel scales like $\sqrt{n}$. The scaling constant is also determined.