UK to Consult on Making Software Firms Liable for Cyber Breaches

When a cyber attack succeeds because software was insecure, who should carry the cost? In the UK, the answer has usually been the victim in practice. The buyer pays for the clean-up, the downtime, and the damage to trust, while the company that built the vulnerable product often faces little direct consequence. That balance may now be about to shift.

According to reports on the 2026 Autumn Budget, delivered on 28 October by Chancellor John Healey, the UK government will consult next year on how to tackle insecure technology at source and where liability for cyber breaches should sit. It is reportedly the first time a British government has placed that question formally on its legislative agenda. The pledge does not create any new legal duty by itself, but it signals a change that vendors, buyers, and insurers will need to watch.

What the Budget actually promised

The commitment sits inside the official 2026 Budget document. The government says it will consult on tackling insecure technology at its source, and consider where liability should sit. No draft law has been published, and no liability model has been chosen.

A broader liability regime would be a different kind of step, after years in which UK policy leaned mainly on voluntary standards for software security.

Why the debate has reached this point

The argument for change, as put by the National Cyber Security Centre, is about incentives. Its chief technology officer, Ollie Whitehouse, has previously argued that the market does not reward companies enough for building secure products, because the cost of a security failure tends to fall on the buyer rather than the builder. Speaking at the CyberUK conference in Birmingham in 2024, he warned in stronger terms that the market was failing to reward secure design.

If a vendor could face a claim after a breach caused by an insecure product, the calculation changes. Security work that once looked like an optional cost starts to look like a way to avoid a much larger bill. Supporters argue it would push vendors to fix known flaws faster and to design products with safer defaults.

Critics raise real concerns too. Software is often assembled from many components written by different teams over many years, so when a breach happens it can be hard to say which part failed. Small developers may also fear claims they cannot afford to defend, even when they acted responsibly.

Two reviews running alongside

The Budget pledge does not arrive alone. The Law Commission of England and Wales is already consulting on product liability law, in a review that opened on 8 October and runs until 14 January. One question is whether the definition of a product under the Consumer Protection Act 1987 should be expanded to include software and artificial intelligence systems. That review could shape the legal route any future liability rules take.

The UK debate is also unfolding against tougher rules in the European Union. Under the EU Cyber Resilience Act, regulators can impose penalties of up to 15 million euros or 2.5 percent of global turnover, whichever is higher. Its main obligations are due to take effect in December 2027. The Act is not a liability regime in the same sense as the UK proposal, but it raises the stakes for insecure products sold into the EU market, and the UK is expected to consider how its rules would sit alongside it.

The £154 million cyber defence package

Alongside the liability pledge, the Budget allocated £154 million in new funding for cyber defence. The largest share, £70 million, will establish a National Exposure and Real-Time Vulnerability Centre, known as NERV, at the NCSC. The NCSC already runs early warning services, and the Budget did not spell out how NERV will extend them.

A further £60 million will support the first phase of the NCSC's Cyber Shield, described when it was announced in April 2026 as a national scale defence capability using agentic AI to find and fix vulnerabilities across government networks and critical infrastructure. The remaining £24 million goes to cybersecurity for public services, including local authorities, hospitals, and schools. The package pairs a question about liability with investment in defence.

What buyers and vendors should do now

Buyers need not wait for a law that may be years away. Procurement teams can already ask sharper questions. Does a vendor publish a clear vulnerability disclosure policy? How quickly does it patch serious flaws? What security updates are included in the price, and for how long? Buyers should also review contract terms that limit a vendor's liability or leave patching vague, taking legal advice before renegotiating, especially for systems handling sensitive data.

For vendors, the message is to treat secure development as a business risk. That means documented secure coding, regular testing, prompt patching, and honest communication when a flaw is found. Keeping records matters too: if liability ever turns on whether a vendor acted reasonably, a paper trail will count far more than a general claim that security was taken seriously.

What to watch next

Three things will show whether this pledge turns into law: the scope of the consultation when it is published next year, the outcome of the Law Commission review, and the detail behind NERV and the Cyber Shield. None of those answers is available yet, and readers should be wary of claims that software firms are already liable in the way the Budget describes. They are not, at least not under this proposal. What has changed is that the question is now formally on the agenda, backed by fresh defence funding.

Frequently Asked Questions

Has the UK already made software firms liable for cyber breaches?

No. The 2026 Autumn Budget commits the government to a consultation next year on where liability should sit. No new liability law has been published or taken effect under this proposal.

What is the NERV Centre announced in the Budget?

The National Exposure and Real-Time Vulnerability Centre is a planned NCSC centre, backed by £70 million, that will use artificial intelligence to find weaknesses across critical infrastructure and the wider economy before attackers exploit them.

How does this relate to the EU Cyber Resilience Act?

The EU Act allows penalties of up to 15 million euros or 2.5 percent of global turnover, with main obligations due in December 2027. The UK is expected to consider how future liability rules would sit alongside it, but the two approaches are not the same.