UK considers software vendor liability for cyber breaches

The British government will consult next year on holding technology companies liable for cyber breaches caused by insecure products. The budget commitment marks its first formal pledge to examine where responsibility should sit, following mounting concern about the economic damage from cyberattacks. The Jaguar Land Rover hack alone is estimated to have cost the British economy £1.9 billion ($2.5 billion).

The consultation will build on a Law Commission review proposing that product liability rules cover software and AI systems. Ministers have not specified whether they favor civil liability, statutory obligations on vendors, or both. Existing cybersecurity legislation focuses on critical infrastructure operators and their suppliers rather than software developers.

Cybersecurity officials and lawmakers have argued that voluntary measures fail to give vendors sufficient incentives to build secure products. Any new regime is expected to account for European Union requirements to limit duplicate compliance costs. Software industry opposition and potential friction with the United States could complicate efforts to shift responsibility onto vendors.

The budget also commits £154 million ($205 million) in new funding for cyber defenses, including an NCSC centre using AI to identify vulnerabilities and support for its Cyber Shield program. Separately, £40 million ($53 million) will establish a National Agentic Security Unit to detect, investigate and respond to rogue AI agents. Details of its institutional home and coordination with related projects remain unspecified.