# UK Government Eyes Landmark Shift: Tech Giants Could Face Liability for Cyber Breaches The British government is preparing to initiate consultations on a groundbreaking policy that could hold technology companies liable for cyber breaches caused by their insecure products. This marks a significant departure from the UK's previous approach, which has largely favored voluntary security standards for software vendors. ## The Rising Cost of Insecurity The commitment, detailed in recent budget documents, underscores increasing alarm within **Westminster** regarding the economic devastation wrought by cyberattacks. Last year's breach at **Jaguar Land Rover** alone is estimated to have cost the British economy a staggering £1.9 billion ($2.5 billion). According to the budget, the government plans to "consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit." This initiative will build upon an ongoing review of product liability law conducted by the **Law Commission of England and Wales**. While occupying just a single bullet point in a 166-page document, this pledge represents the first formal commitment by a British government to explore the allocation of liability for cyber incidents. ## Unanswered Questions and Potential Avenues Key questions remain, including which government department will spearhead the consultation, its commencement date, and whether ministers envision a civil liability regime, statutory obligations for vendors, or a combination of both. **HM Treasury** has not yet responded to requests for comment. One likely option under consideration is the expansion of the **Product Security and Telecommunications Infrastructure (PSTI) Act**. Since 2024, this act has imposed fundamental security requirements on manufacturers of consumer smart devices. Officials are expected to ensure any new regulations align with the **European Union's** own software cybersecurity regime. This proactive measure aims to prevent businesses from incurring substantial costs to comply with two distinct sets of requirements. ## NCSC's Persistent Advocacy This policy shift follows years of sustained pressure from Britain's cybersecurity authorities, most notably **Ollie Whitehouse**, Chief Technology Officer of the **National Cyber Security Centre (NCSC)**, which operates under the **GCHQ** cyber and signals intelligence agency. Last year, the **NCSC** publicly called for a "strategic policy agenda" after efforts to address insecure technology had stalled. At the **CyberUK** conference in Birmingham in 2024, Whitehouse warned that the technology market was failing to incentivize companies to develop resilient and secure products, with regulation and legislation struggling to keep pace. In a statement last year, Whitehouse asserted, "the reality is that in 2025, we know how to build secure products and services," but lamented that "the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient." This argument mirrors a similar debate in the **United States**, where proposals to hold software makers liable for flawed code have faced prolonged stagnation due to disagreements over defining appropriate standards of care. The **Trump** administration has since rolled back several **Biden-era** secure-software requirements for federal suppliers. Political pressure in Britain intensified last November when the **House of Commons Business and Trade Committee**, chaired by **Liam Byrne**, identified the lack of liability for software vendors as a critical issue endangering Britain’s economic and national security. The committee urged ministers to make the **NCSC's** voluntary software security code of practice legally binding, complete with penalties for non-compliant companies. Byrne described the **Jaguar Land Rover** attack as a "cyber shockwave ripping through our industrial heartlands," while the committee cautioned against "a huge increase in the private ownership of public risk." The government's **Cyber Security and Resilience Bill**, introduced to Parliament the same month and currently before the **House of Lords**, acknowledged some of the market failures identified by the **NCSC** in its impact assessment. The assessment highlighted the "information asymmetry between vendors and buyers," which makes it challenging for customers to accurately assess the security of the technologies they procure. In its current form, the legislation focuses on operators of critical infrastructure and their suppliers, stopping short of imposing obligations on software developers. ## Arguments Ahead The **European Union’s Cyber Resilience Act** empowers regulators to fine manufacturers of insecure products up to €15 million or 2.5% of global turnover, whichever is higher, with its main obligations set to take effect in December 2027. A separate overhaul of the bloc’s product liability rules, which member states must adopt by December, extends strict liability to software, including defects arising from missing security updates. Attempts in Britain to shift liability onto software vendors are likely to encounter resistance. Organizations such as the **Business Software Alliance**, whose members include **Microsoft**, **Oracle**, and **Amazon Web Services**, have historically lobbied against such measures, arguing they would stifle innovation. These proposals could also create friction with the **United States**, home to the world’s largest technology vendors. Successive US administrations have viewed overseas regulatory efforts with suspicion when they appear to constrain the sector's commercial success. In Britain, the **Law Commission** consultation referenced in the budget commenced on October 8 and concludes on January 14. It proposes broadening the definition of a “product” under the **Consumer Protection Act 1987** to encompass software and AI systems, which currently reside in a legal gray area as the law was originally drafted for physical goods. This review is sponsored by the **Department for Business, Innovation, Science and Trade**, although responsibility for national cybersecurity policy now lies with the **Department for Culture, Media and Sport**. The country’s cyber minister, **Baroness Lloyd**, holds posts in both departments. ## £154 Million for AI Cyber Defenses Alongside the liability consultation, the budget allocates £154 million ($205 million) in new funding for cyber defenses, much of which the **Treasury** had announced prior to Wednesday's statement. The largest allocation, £70 million ($93 million), is earmarked for a **National Exposure and Real-Time Vulnerability (NERV) Centre** at the **NCSC**. According to the budget, this center will leverage artificial intelligence to identify vulnerabilities across critical infrastructure and the broader economy. The **NCSC** currently scans internet-connected devices hosted in Britain, alerting organizations to exposed or vulnerable systems through its **Early Warning** and **Proactive Notifications** services. The budget does not clarify how **NERV** will differ from these existing operations, and an agency spokesperson declined to comment. An additional £60 million ($79 million) will support the first phase of the **NCSC’s Cyber Shield**, announced in April as "a national scale, sovereign defense capability" that will utilize agentic AI systems to discover and rectify cybersecurity weaknesses across government networks and critical national infrastructure. Remaining funds will be dedicated to strengthening the security of technology across the public sector, including systems operated by local authorities, hospitals, and schools. Separately, the government has allocated £40 million ($53 million) to establish a **National Agentic Security Unit**. This unit will be tasked with detecting, investigating, and responding to rogue AI agents. The budget describes the unit’s ambitions as developing “world-first capabilities to detect and respond to misaligned agentic activity,” but does not specify which agency will host it or how it will interact with similar projects associated with the **NCSC**. The **AI Security Institute**, transferred to the **Cabinet Office** in July, will receive another £120 million ($159 million) over four years to expand its testing of frontier AI models. These investments follow a week in which critical flaws in **PHP**, discovered using AI, forced websites offline globally. The **NCSC** urged organizations to patch affected systems or consider taking them offline.