London wants to study who pays when poorly secured software lets hackers in

Buried in the 166 pages of the UK budget published on October 28 is one line that matters to every software vendor. According to the trade outlet The Record, the Treasury commits to examining “where liability should sit” in the event of a cyberattack. The outlet sees it as the first formal commitment by a British government to ask this question.

In practice, the government is due to launch a consultation in 2027 on poorly secured technology and the allocation of liability. Neither the lead department nor the exact timetable is known at this stage. Nothing is decided: this is a consultation, not yet a law.

Why the United Kingdom is changing its tone

Until now, London has relied on voluntary codes of practice, such as the one from the NCSC (the UK's national cybersecurity center) on software security. Criticism has piled up. In 2025, its chief technology officer Ollie Whitehouse wrote that commercial incentives were not enough to reward secure products. In November 2025, the parliamentary Business and Trade Committee, chaired by Liam Byrne, called for making this code mandatory and backed by penalties.

The cost of attacks also weighs on the debate. The Record points out that the 2025 hack of Jaguar Land Rover reportedly cost the British economy £1.9 billion, according to estimates.

Several options are being discussed: extending the PSTI Act, which has imposed baseline rules on consumer connected devices since 2024, or creating obligations specific to software vendors. In parallel, the Law Commission of England and Wales is consulting until January 14, 2027, on extending the notion of “product” to software and AI systems. It remains to be seen whether the government will choose civil liability, legal obligations for vendors, or both.

The European Union is already ahead

For a vendor selling in Europe, the direction is clear. The European Cyber Resilience Act will impose its main obligations in December 2027, with fines of up to €15 million or 2.5% of worldwide turnover. The revised Product Liability Directive extends strict liability to software, including for defects caused by a missing security update. According to The Record, British officials should make sure their future rules remain compatible with this framework, to spare companies a double compliance effort.

Opposition is already organized. The Business Software Alliance, whose members include Microsoft, Oracle and Amazon Web Services, is speaking out against this kind of measure in the name of innovation. The issue could also strain relations with Washington, where the Trump administration has eased several software security requirements imposed on federal suppliers.

Money for defensive AI

The same budget provides, again according to The Record, £154 million for cybersecurity. It notably funds an AI vulnerability detection center at the NCSC (£70 million). Separately, £40 million is allocated to a unit tasked with detecting rogue AI agents. The AI Security Institute will also receive £120 million over four years.

Next step: the Law Commission's consultation closes on January 14. For French companies preparing for the Cyber Resilience Act, the message is simple: in the European Union, vendors will soon no longer be able to offload security onto their customers, and the United Kingdom is now considering going in the same direction.