UK to look at making software companies liable for cyber breaches

The British government will consult on how to hold technology companies liable for cyber breaches caused by insecure products — potentially a landmark shift for a country that has for years relied on voluntary codes to encourage software vendors to improve security.

The commitment, made in budget documents published on Wednesday, comes amid growing alarm in Westminster over the economic damage caused by cyberattacks. Last year's hack of Jaguar Land Rover alone is estimated to have cost the British economy £1.9 billion ($2.5 billion).

According to the budget, the government “will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.” The work will build on an ongoing review of product liability law by the Law Commission of England and Wales.

Although the pledge occupies just one bullet point in the 166-page document, it marks the first formal pledge by a British government to examine where liability for cyber breaches should sit.

Significant questions remain, including which department will lead the consultation, when it will begin and whether ministers envisage a civil liability regime, statutory obligations on vendors, or both. HM Treasury did not respond to a request for comment.

One option likely to be considered internally is expanding the Product Security and Telecommunications Infrastructure (PSTI) Act, which since 2024 has imposed basic security requirements on manufacturers of consumer smart devices.

Officials are expected to ensure any new rules are compatible with the European Union’s own software cybersecurity regime, to avoid businesses facing heavy costs to comply with two separate sets of requirements.

The move follows years of pressure from Britain's own cybersecurity authorities, particularly Ollie Whitehouse, the chief technology officer of the National Cyber Security Centre (NCSC), which is part of the cyber and signals intelligence agency GCHQ.

The agency called publicly for a “strategic policy agenda” last year, after efforts to address insecure technology had stalled. Whitehouse had already warned, in a keynote address at the CyberUK conference in Birmingham in 2024, that the technology market was failing to reward companies for building resilient and secure products, while regulation and legislation struggled to keep pace.

Last year, he wrote that “the reality is that in 2025, we know how to build secure products and services” but “the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient.”

His argument echoed a debate in the United States, where proposals to make software makers liable for flawed code stalled for years amid disagreements over how to define the proper standard of care. The Trump administration has since rolled back several Biden-era secure-software requirements for federal suppliers.

The political pressure in Britain intensified last November, when the House of Commons Business and Trade Committee, chaired by Liam Byrne, said a lack of liability for software vendors was among the most pressing issues putting Britain’s economic and national security at risk.

It urged ministers to make the NCSC's voluntary software security code of practice legally binding, with penalties for companies that fail to comply.

Byrne described the Jaguar Land Rover attack as a “cyber shockwave ripping through our industrial heartlands,” while the committee warned of “a huge increase in the private ownership of public risk.”

The government's Cyber Security and Resilience Bill, introduced to Parliament that same month and now before the House of Lords, acknowledged some of the market failures identified by the NCSC in its impact assessment, which pointed to the “information asymmetry between vendors and buyers” making it difficult for customers to judge the security of the technologies they purchase.

In its current form, the legislation stops short of imposing obligations on software developers, concentrating instead on operators of critical infrastructure and their suppliers.

Arguments ahead

The European Union’s Cyber Resilience Act allows regulators to fine manufacturers of insecure products up to €15 million or 2.5% of global turnover, whichever is higher, with its main obligations taking effect in December 2027.

A separate overhaul of the bloc’s product liability rules, which member states must adopt by December, extends strict liability to software, including defects caused by missing security updates.

Attempts in Britain to shift liability onto software vendors are likely to face resistance, with the Business Software Alliance — whose members include Microsoft, Oracle and Amazon Web Services — having lobbied against such measures and argued that they would stifle innovation.

The proposals could also create friction with the United States, where the world’s largest technology vendors are based, and where successive administrations have regarded overseas regulatory efforts with suspicion when they appear to constrain the sector's commercial success.

In Britain, the Law Commission consultation referenced in the budget opened on October 8 and runs until January 14. It proposes broadening the definition of a “product” under the Consumer Protection Act 1987 to include software and AI systems, which currently sit in a legal gray area because the law was written for physical goods.

That review is sponsored by the Department for Business, Innovation, Science and Trade, but responsibility for national cybersecurity policy now lies with the Department for Culture, Media and Sport. The country’s cyber minister, Baroness Lloyd, holds posts in both departments, as Recorded Future News previously reported.

£154 million for AI cyber defenses

Alongside the liability consultation, the budget commits £154 million ($205 million) in new funding for cyber defenses, much of which the Treasury had announced ahead of Wednesday's statement.

The largest allocation is £70 million ($93 million) for a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC. The centre will, according to the budget, use artificial intelligence to identify vulnerabilities across critical infrastructure and the wider economy.

The NCSC already scans internet-connected devices hosted in Britain, alerting organizations to exposed or vulnerable systems through its Early Warning and Proactive Notifications services. The budget does not explain how NERV will differ from those existing operations, and an agency spokesperson declined to comment.

A further £60 million ($79 million) will support the first phase of the NCSC’s Cyber Shield, announced in April as “a national scale, sovereign defense capability” that would use agentic AI systems to discover and fix cybersecurity weaknesses across government networks and critical national infrastructure.

Remaining funds will be used to strengthen the security of technology across the public sector, including systems operated by local authorities, hospitals and schools.

Separately, the government has allocated £40 million ($53 million) to establish a National Agentic Security Unit, tasked with detecting, investigating and responding to rogue AI agents.

The budget describes the unit’s ambitions as developing “world-first capabilities to detect and respond to misaligned agentic activity,” but does not identify which agency will host it nor how it will interact with similar projects associated with the NCSC.

The AI Security Institute, transferred to the Cabinet Office in July, will receive another £120 million ($159 million) over four years to expand its testing of frontier AI models. 

The investments follow a week in which critical flaws in PHP, discovered using AI, forced websites offline around the world. The NCSC urged organizations to patch affected systems or consider taking them offline.