A new liability question enters UK policy
The UK government's budget, published October 28, commits it to consulting on a question that has mostly been left to ordinary contract law until now: where liability should sit when a cyber breach traces back to an insecure software product rather than to customer negligence or misconfiguration. The commitment itself is a single line buried in the budget documents, stating the government will consider where liability for cyber breaches should sit, but it marks a notable shift away from Britain's long standing reliance on voluntary security codes that vendors could choose to adopt or ignore.
The scope of the eventual consultation, which department will lead it, and precisely when it will formally open are all still undecided at this stage. HM Treasury did not respond to a request for comment on any of these specifics when asked directly. What is already clear, though, is the direction of travel: after years of simply asking vendors to adopt security best practices voluntarily, the government is now visibly willing to examine whether some meaningful portion of that should become enforceable legal obligation instead.
The options on the table
Officials are weighing several distinct paths rather than committing early to any single one. These under consideration include a civil liability regime that would let breached customers or their insurers pursue vendors directly through the courts, entirely new statutory security obligations written directly into law, or some workable combination of both approaches. A comparatively simpler option on the table would expand the existing Product Security and Telecommunications Infrastructure Act, which currently sets only baseline security requirements for consumer smart devices, to cover a considerably broader category of enterprise software as well.
Separately, the UK's Law Commission has proposed broadening the legal definition of a product under the Consumer Protection Act 1987 to explicitly include software and AI systems, a change that would let existing decades old product liability law extend naturally to code without requiring an entirely new piece of legislation to be drafted and passed. Officials are also weighing whether to align any new UK rules closely with the EU's own emerging software cybersecurity regime, specifically to avoid saddling vendors selling into both markets with two incompatible compliance burdens running in parallel.
The security establishment is already making the case
Ollie Whitehouse, the National Cyber Security Centre's chief technology officer, has already staked out a position that undercuts the software industry's traditional objection to liability reform before the consultation has even opened. He has argued publicly that the technical knowledge required to build secure products and services already exists today, meaning the real barrier to safer software is economic incentive rather than any genuine capability gap across the industry. That argument, coming from inside the UK's own national cyber agency rather than from an outside advocacy group, gives the Treasury's eventual consultation considerably more institutional weight than a typical political talking point would carry on its own.
Liam Byrne, who chairs the House of Commons Business and Trade Committee, has used the Jaguar Land Rover cyberattack as the case study that makes the stakes concrete for lawmakers and the public alike, describing it as a cyber shockwave tearing through Britain's industrial heartlands. Framing a single high profile incident as the human and economic cost of insecure industrial software is precisely the kind of narrative that tends to accelerate liability reform once it takes firm hold inside parliamentary committees and budget negotiations.
Industry pushback is predictable and already underway
The Business Software Alliance has already lobbied against liability measures of this kind, arguing they would stifle innovation across the sector, a position the trade group has taken consistently in similar debates playing out in other markets around the world. That argument carries real practical weight for smaller vendors and startups that genuinely lack the balance sheets to absorb significant liability exposure the way larger incumbents generally can, which means the eventual shape of any UK regime will likely include some form of obligation scaled to vendor size rather than a flat liability standard applied uniformly across the entire industry regardless of company size.
The timeline gives industry a reasonable amount of room to organize a coordinated response before anything becomes binding. A Law Commission consultation on the underlying product definition question opened on October 8 and closes January 14. The government's own broader consultation on insecure technology and liability is expected sometime next year. Separately, the EU's Cyber Resilience Act brings its main obligations into force in December 2027, and a related EU product liability overhaul extends strict liability to software on a similar timeline, giving UK policymakers both a working template and genuine deadline pressure to align with.
What this means for enterprise buyers
For CIOs and CTOs who buy software from UK based vendors, or who sell software into the UK market themselves, this consultation is worth tracking closely now rather than waiting until after obligations are finalized and already written into contracts industry wide. Vendor contracts negotiated over the next eighteen months should anticipate that liability allocation for breaches will become a genuinely contestable term during negotiation, not a boilerplate clause either side can simply take for granted the way it has been treated historically. Procurement and legal teams should start asking vendors now how they would respond if liability shifted toward them by statute rather than by negotiated contract.
The deeper signal underneath all of this is that governments are increasingly unwilling to treat software security as a purely private contractual matter negotiated solely between buyer and seller. Once liability becomes statutory rather than negotiated case by case, the underlying economics of vendor risk management change meaningfully for everyone across the entire supply chain, including the enterprises that rely on that same software every day to run their own core operations.
