Britain's government will consult next year on how to deal with insecure technology at its source and on where liability for cyber breaches should sit, according to the Budget document HM Treasury published Wednesday. The Record, a cybersecurity news site, called it the first formal pledge by a British government to examine that question. For vendors selling into the U.K., including large U.S. firms, it raises the prospect that breach costs now borne by customers shift toward the companies that built the products.
What Happened
The commitment is a single bullet in section 5.7 of the Budget 2026 document, which says the work will build on the Law Commission's consultation on product liability. The Record noted that it does not name a lead department, a start date or whether ministers favor civil liability, vendor duties or both. HM Treasury did not respond to the outlet's request for comment.
The Budget's summary commits £154 million to cyber defenses. Section 5.7 itemizes £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, £60 million for the first phase of a national Cyber Shield, an extra £24 million for public sector AI defense and £40 million for a National Agentic Security Unit, which The Record said would respond to rogue AI agents, software that carries out multistep tasks on its own.
Why It Matters
Britain has relied on voluntary codes for software security. In November 2025, a House of Commons committee called the absence of vendor liability among the most pressing risks to economic and national security and urged ministers to make the National Cyber Security Centre's voluntary software security code binding, The Record reported. The outlet cites an estimated £1.9 billion cost to the U.K. economy from the 2025 Jaguar Land Rover hack.
For boards, the pledge points toward convergence with Europe. The EU Cyber Resilience Act allows fines of up to €15 million or 2.5% of global turnover, with main obligations from December 2027, and a separate EU overhaul extends strict liability, meaning liability without proof of fault, to software. Officials are expected to keep U.K. rules compatible with the EU's, according to The Record, a shift that would touch vendor contracts, cyber insurance and secure-development budgets.
In the U.S., software liability proposals stalled over how to define the standard of care. The Business Software Alliance, whose members include Microsoft, Oracle and Amazon Web Services, has lobbied against such measures, saying they would stifle innovation, The Record reported.
Context
A Law Commission consultation that opened Oct. 8 proposes treating software and AI systems as "products" under the Consumer Protection Act 1987, a law written for physical goods. The Cyber Security and Resilience Bill, now in the House of Lords, places no obligations on software developers.
The Primary Wire reported Oct. 24, citing HM Treasury, on the pre-Budget plan for £120 million more for the AI Security Institute, which the Budget confirms.
What to Watch
Which department leads the consultation and when it opens in 2027; responses to the Law Commission consultation, which closes Jan. 14; and whether peers amend the Cyber Security and Resilience Bill to reach software makers.
