The British government will consult next year on whether technology companies should be held liable for cyber breaches caused by insecure products, marking a significant shift from the country’s longstanding reliance on voluntary security standards for software vendors.
The commitment was included in budget documents published on Wednesday, which said the government would examine how to tackle insecure technology “at source” and consider where liability for cyber breaches should sit.
The consultation will build on an ongoing review of product liability law by the Law Commission of England and Wales. Key questions remain over which department will lead the process, when it will begin and whether ministers will pursue civil liability, statutory duties on vendors, or a combination of both.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Government Examines Liability for Insecure Software
One option expected to be considered is an expansion of the Product Security and Telecommunications Infrastructure Act, which has imposed basic security requirements on manufacturers of consumer smart devices since 2024.
The government is also expected to examine how any new rules could align with the European Union’s cybersecurity regime to avoid creating significantly different compliance requirements for companies operating across both markets.
The move follows sustained pressure from the UK’s cybersecurity authorities, including the National Cyber Security Centre, which has argued that market incentives are not strong enough to encourage companies to build and maintain secure products.
Ollie Whitehouse, chief technology officer at the NCSC, has previously said that secure products and services can be built, but that commercial incentives to adopt and maintain stronger security remain insufficient.
Political pressure has also increased following major cyber incidents that caused significant economic disruption. The cyberattack on Jaguar Land Rover last year was estimated to have cost the British economy £1.9 billion, or about $2.5 billion (approximately ₹23,810 crore).
A House of Commons committee also called for stronger software vendor accountability, arguing that the absence of liability posed risks to economic and national security. It urged ministers to consider making the NCSC’s voluntary software security code legally binding.
UK Looks to EU Rules as Liability Debate Expands
The UK debate comes as the European Union introduces tougher requirements for insecure digital products.
The EU Cyber Resilience Act allows regulators to impose penalties of up to €15 million or 2.5 per cent of global turnover, whichever is higher, for breaches of its requirements. Its main obligations are due to take effect in December 2027.
Separately, revised EU product liability rules extend strict liability to software, including defects resulting from missing security updates.
Britain’s Law Commission consultation, which opened on October 8 and runs until January 14, is examining whether the definition of a “product” under the Consumer Protection Act 1987 should be expanded to include software and artificial intelligence systems.
Software and AI currently sit in a legal grey area because the legislation was originally designed around physical products.
Any move to impose liability on software vendors is likely to face opposition from industry groups. The Business Software Alliance, whose members include Microsoft, Oracle and Amazon Web Services, has argued that broad liability requirements could discourage innovation.
The issue could also become sensitive in relations with the United States, where many of the world’s largest software companies are based and where similar efforts to impose software liability have faced political and industry resistance.
Budget Adds New Funding for AI-Driven Cyber Defence
Alongside the liability consultation, the UK budget commits £154 million, or about $205 million (approximately ₹1,952 crore), in new funding for cyber defence programmes.
The largest allocation, £70 million, or about $93 million (approximately ₹886 crore), will go towards a National Exposure and Real-Time Vulnerability Centre at the NCSC. The centre is expected to use artificial intelligence to identify vulnerabilities across critical infrastructure and the wider economy.
A further £60 million, or about $79 million (approximately ₹752 crore), will support the first phase of the NCSC’s Cyber Shield, described as a national-scale sovereign defence capability using agentic AI systems to discover and remediate cybersecurity weaknesses across government networks and critical national infrastructure.
The remaining funding will be used to strengthen the security of technology used across the public sector, including systems operated by local authorities, hospitals and schools.
The government has also allocated £40 million, or about $53 million (approximately ₹505 crore), to establish a National Agentic Security Unit tasked with detecting, investigating and responding to rogue AI agents.
Separately, the AI Security Institute is set to receive another £120 million, or about $159 million (approximately ₹1,514 crore), over four years to expand its testing of frontier AI models.
The combined measures show the government pursuing two parallel approaches to cyber risk: increasing public investment in AI-enabled defensive capabilities while also considering whether software makers should face greater legal responsibility when insecure products contribute to cyber breaches.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
