Westminster is preparing to examine whether software makers should bear legal responsibility for cyber breaches stemming from defective code, according to budget documents released Wednesday. This represents a significant policy shift for a nation that has historically depended on voluntary frameworks to push vendors toward stronger security practices.

The announcement reflects mounting concern among British policymakers about the economic toll of cyberattacks. The 2024 breach of Jaguar Land Rover alone inflicted an estimated £1.9 billion ($2.5 billion) hit on the UK economy.

The budget states that the government "will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit." This work will draw on an ongoing product liability review conducted by the Law Commission of England and Wales. Though the commitment occupies just a single bullet point in a 166-page document, it marks the first formal government undertaking to explore liability allocation for cyber incidents.

Critical details remain unresolved, including which agency will oversee the consultation, its launch timing, and whether the government intends to pursue civil liability frameworks, statutory vendor obligations, or a combination of both. HM Treasury declined to comment.

Officials may consider broadening the Product Security and Telecommunications Infrastructure (PSTI) Act, which since 2024 has set baseline security standards for manufacturers of consumer smart devices. Any regulatory approach will likely need alignment with the European Union's cybersecurity framework to prevent companies from navigating conflicting compliance regimes.

The shift follows sustained advocacy from Britain's cybersecurity establishment, particularly Ollie Whitehouse, chief technology officer at the National Cyber Security Centre (NCSC), part of the GCHQ intelligence agency. The NCSC called for a "strategic policy agenda" last year after progress on insecure technology stalled. Whitehouse cautioned at the 2024 CyberUK conference in Birmingham that market forces were not incentivizing companies to develop resilient systems, while regulation lagged behind technological change.

In a 2024 statement, Whitehouse observed that "the reality is that in 2025, we know how to build secure products and services" but "the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient."

This reasoning mirrors longstanding debates in the United States, where efforts to impose liability on software developers for defective code have faced years of gridlock over defining appropriate care standards. The Trump administration has since reversed several Biden-era secure-software mandates for federal contractors.

Political momentum accelerated in November when the House of Commons Business and Trade Committee, led by Liam Byrne, identified software vendor liability gaps as a critical threat to Britain's economic and national security. The committee urged the government to convert the NCSC's voluntary software security code of practice into binding law with enforcement penalties.

Byrne characterized the Jaguar Land Rover incident as a "cyber shockwave ripping through our industrial heartlands," while the committee warned of "a huge increase in the private ownership of public risk."

The government's Cyber Security and Resilience Bill, tabled in November and now in the House of Lords, acknowledged market failures flagged by the NCSC, including "information asymmetry between vendors and buyers" that hampers customer assessment of product security. However, the current bill stops short of mandating obligations on software developers, focusing instead on critical infrastructure operators and their supply chains.

Arguments ahead

The European Union's Cyber Resilience Act empowers regulators to impose fines of up to €15 million or 2.5% of global turnover, whichever is higher, on manufacturers of insecure products, with core obligations taking effect in December 2027. A parallel overhaul of EU product liability rules, which member states must implement by December, extends strict liability to software, covering defects arising from absent security patches.

British attempts to shift liability toward software vendors will likely encounter pushback. The Business Software Alliance, representing Microsoft, Oracle and Amazon Web Services, has opposed such measures, contending they would dampen innovation.

Such proposals may also strain relations with the United States, home to the world's dominant technology firms, where administrations have traditionally viewed foreign regulatory efforts with wariness when they appear to constrain commercial performance.

The Law Commission consultation referenced in the budget commenced October 8 and concludes January 14. It proposes expanding the definition of "product" under the Consumer Protection Act 1987 to encompass software and AI systems, which currently occupy legal ambiguity because the statute was designed for tangible goods.

The Department for Business, Innovation, Science and Trade sponsors that review, though cybersecurity policy responsibility now rests with the Department for Culture, Media and Sport. Baroness Lloyd, the nation's cyber minister, holds positions in both departments.

£154 million for AI cyber defenses

Beyond the liability consultation, the budget allocates £154 million ($205 million) in fresh cyber defense funding, much of which Treasury had previewed before Wednesday's announcement.

The largest share—£70 million ($93 million)—will establish a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC. According to the budget, the centre will deploy artificial intelligence to detect vulnerabilities across critical infrastructure and the broader economy. The NCSC currently scans internet-connected devices within Britain, notifying organizations of exposed or vulnerable systems via its Early Warning and Proactive Notifications services. The budget offers no clarification on how NERV will differ from existing operations, and an NCSC spokesperson declined to elaborate.

An additional £60 million ($79 million) will support the initial phase of the NCSC's Cyber Shield, unveiled in April as "a national scale, sovereign defense capability" leveraging agentic AI systems to identify and remediate cybersecurity gaps across government networks and critical national infrastructure.

Remaining funds will strengthen technology security across the public sector, encompassing systems at local authorities, hospitals and schools.

The government has also earmarked £40 million ($53 million) to create a National Agentic Security Unit responsible for detecting, investigating and responding to rogue AI agents. The budget describes the unit's goals as developing "world-first capabilities to detect and respond to misaligned agentic activity," though it does not specify which agency will house it or how it will coordinate with related NCSC initiatives.

The AI Security Institute, relocated to the Cabinet Office in July, will receive £120 million ($159 million) over four years to expand its evaluation of frontier AI models.

These investments follow a week in which critical PHP vulnerabilities, uncovered using AI, forced websites worldwide offline. The NCSC urged organizations to apply patches or consider taking affected systems offline.