UK to look at making software companies liable for cyber breaches

The British government will consult on holding technology companies liable for cyber breaches caused by insecure products, a potential landmark shift in liability. The commitment, made in budget documents published on Wednesday, comes amid growing alarm in Westminster over the economic damage caused by cyberattacks. Last year's hack of Jaguar Land Rover alone is estimated to have cost the British economy £1.9 billion ($2.5 billion).

According to the budget, the government “will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.” The work will build on an ongoing review of product liability law by the Law Commission of England and Wales. Although the pledge occupies just one bullet point in the 166-page document, it marks the first formal pledge by a British government to examine where liability for cyber breaches should sit.

Pressure from cybersecurity authorities

Significant questions remain, including which department will lead the consultation, when it will begin and whether ministers envisage a civil liability regime, statutory obligations on vendors, or both. Officials are expected to ensure any new rules are compatible with the European Union’s own software cybersecurity regime, to avoid businesses facing heavy costs to comply with two separate sets of requirements. The move follows years of pressure from Britain's own cybersecurity authorities, particularly Ollie Whitehouse, the chief technology officer of the National Cyber Security Centre (NCSC), which is part of the cyber and signals intelligence agency GCHQ.

The agency called publicly for a “strategic policy agenda” last year, after efforts to address insecure technology had stalled. Whitehouse had already warned, in a keynote address at the CyberUK conference in Birmingham in 2024, that the technology market was failing to reward companies for building resilient and secure products, while regulation and legislation struggled to keep pace. His argument echoed a debate in the United States, where proposals to make software makers liable for flawed code stalled for years amid disagreements over how to define the proper standard of care.

Political pressure and market failures

The political pressure in Britain intensified last November, when the House of Commons Business and Trade Committee, chaired by Liam Byrne, said a lack of liability for software vendors was among the most pressing issues putting Britain’s economic and national security at risk. It urged ministers to make the NCSC's voluntary software security code of practice legally binding, with penalties for companies that fail to comply. Byrne described the Jaguar Land Rover attack as a “cyber shockwave ripping through our industrial heartlands,” while the committee warned of “a huge increase in the private ownership of public risk.”

The government's Cyber Security and Resilience Bill, introduced to Parliament that same month and now before the House of Lords, acknowledged some of the market failures identified by the NCSC in its impact assessment, which pointed to the “information asymmetry between vendors and buyers” making it difficult for customers to judge the security of the technologies they purchase. In its current form, the legislation stops short of imposing obligations on software developers, concentrating instead on operators of critical infrastructure and their suppliers.

Funding for AI cyber defenses

Alongside the liability consultation, the budget commits £154 million ($205 million) in new funding for cyber defenses, much of which the Treasury had announced ahead of Wednesday's statement. The largest allocation is £70 million ($93 million) for a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC. The centre will, according to the budget, use artificial intelligence to identify vulnerabilities across critical infrastructure and the wider economy.

The NCSC already scans internet-connected devices hosted in Britain, alerting organizations to exposed or vulnerable systems through its Early Warning and Proactive Notifications services. The budget does not explain how NERV will differ from those existing operations, and an agency spokesperson declined to comment. A further £60 million ($79 million) will support the first phase of the NCSC’s Cyber Shield, announced in April as “a national scale, sovereign defense capability” that would use agentic AI systems to discover and fix cybersecurity weaknesses across government networks and critical national infrastructure.

Remaining funds will be used to strengthen the security of technology across the public sector, including systems operated by local authorities, hospitals and schools. Separately, the government has allocated £40 million ($53 million) to establish a National Agentic Security Unit, tasked with detecting, investigating and responding to rogue AI agents. The budget describes the unit’s ambitions as developing “world-first capabilities to detect and respond to misaligned agentic activity,” but does not identify which agency will host it nor how it will interact with similar projects associated with the NCSC.

The AI Security Institute, transferred to the Cabinet Office in July, will receive another £120 million ($159 million) over four years to expand its testing of frontier AI models. The investments follow a week in which critical flaws in PHP, discovered using AI, forced websites offline around the world. The NCSC urged organizations to patch affected systems or consider taking them offline.