UK Software Vendor Liability: Budget Pledges 2027 Consultation

The UK government will consult next year on where liability for cyber breaches should sit, according to budget documents published on Wednesday. It is the first formal step toward UK software vendor liability in a country that has leaned on voluntary codes. For anyone selling or buying software in Britain, the cost of insecure code is starting to move from the breached customer back toward the vendor that shipped it.

What did the UK budget actually commit to?

A consultation, not a law. Budget documents published on Wednesday say only that the government “will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.” That is one bullet point in a 166-page document.

The Record calls it the first formal pledge by a British government to examine where breach liability belongs. Until now the UK has relied on voluntary measures such as the NCSC’s software security code of practice, which a vendor can adopt or ignore at no cost when its product becomes the vector in a breach.

The budget names no lead department, no start date and no legal model: a civil regime that lets victims sue vendors, statutory duties enforced by a regulator, or both. HM Treasury did not respond to a request for comment.

Two processes are now running. The Law Commission’s review asks whether software counts as a product under existing consumer law. The 2027 consultation asks who should carry breach costs, and the budget says it will build on the review.

What would UK software vendor liability cover?

Under current law, not much with any certainty. The Consumer Protection Act 1987 imposes strict liability for defective products, but it was written for physical goods. A defective kettle is plainly a product. A defective firmware update or a hosted AI model sits in a legal gray area.

The Law Commission of England and Wales, in a review sponsored by the government’s business department, proposes extending the Act’s definition of “product” to software and AI systems. Its consultation opened on 8 October 2026 and closes on 14 January 2027.

Strict liability removes the need to prove negligence, but a claimant still has to show a defect, damage and a causal link. That is a lower bar, not an automatic payout, and a different instrument from a regulator fining a vendor.

Scope is still open. Consumer protection law and the PSTI Act both start from consumer products, and neither says whether a future regime would reach B2B software, SaaS, or code embedded in industrial equipment. Open-source maintainers, AI model providers whose models reach users through someone else’s product, and systems integrators should all watch the drafting. Who enforces any new duty, a regulator or the courts, is also undecided.

So is the standard of care, the question that stalled US liability proposals for years. Every mature codebase we test has findings; the law must decide which count as defects. Our read: a workable test will rest on evidence a vendor can produce, such as secure development records, a maintained SBOM, patch timelines, a stated support lifetime, and perhaps a safe harbor for following a recognized code.

Who pushed for vendor liability, and who will fight it?

The NCSC and Parliament pushed, and Jaguar Land Rover supplied the price tag. Last year’s hack of the carmaker is estimated to have cost the British economy £1.9 billion ($2.5 billion), according to figures cited by The Record.

At CyberUK in Birmingham in 2024, NCSC CTO Ollie Whitehouse warned that the market was failing to reward secure products. Last year, after efforts on insecure technology stalled, the agency called for a “strategic policy agenda.” Whitehouse wrote that “in 2025, we know how to build secure products and services” but “the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient.” Incentives are exactly what liability law changes.

Last November the Commons Business and Trade Committee, chaired by Liam Byrne, named the lack of vendor liability among the most pressing risks to Britain’s economic and national security, warned of “a huge increase in the private ownership of public risk” and urged ministers to make the NCSC’s code legally binding, with penalties.

The Cyber Security and Resilience Bill, now before the House of Lords, stops short. It places duties on critical-infrastructure operators and their suppliers, not software developers, though its impact assessment concedes an “information asymmetry between vendors and buyers.”

Resistance is predictable. The Business Software Alliance, whose members include Microsoft, Oracle and Amazon Web Services, has lobbied against such measures as a brake on innovation. The largest vendors are US-based, and the Trump administration has rolled back several Biden-era secure-software requirements for federal suppliers.

How would a CRA-compatible regime change software contracts?

It would move security updates and defect evidence out of pentest recommendations and into enforceable terms. Officials are expected to keep any UK regime compatible with EU rules so businesses do not pay to comply twice, which makes Brussels the best preview available.

The Cyber Resilience Act’s main obligations take effect in December 2027, when regulators can fine manufacturers of insecure products up to €15 million or 2.5% of global turnover, whichever is higher. The EU’s overhauled product liability rules, which member states must adopt by December, extend strict liability to software, including defects caused by missing security updates. Abandoning a product early can count as a defect.

Britain’s nearest existing tool is the Product Security and Telecommunications Infrastructure (PSTI) Act, which since 2024 has imposed basic security requirements on makers of consumer smart devices. Expanding it is one option: the cheapest path politically, and the thinnest in substance.

Teams selling into both markets can start from the evidence model in our EU Cyber Resilience Act penetration testing scope, which tracks obligations that apply from December 2027 whatever London decides.

Where do AI systems and agents sit in the liability chain?

Inside it, if the Law Commission’s proposal survives, because it names AI systems alongside software. The hard part is defining the product when an agent causes harm: the model, the orchestration layer, the tools it was handed, or the deployment that gave those tools production credentials.

In our AI agent penetration testing work, the failure mode is rarely a model acting maliciously. It is a prompt injection reaching an agent with far more tool scope than its task needs and no approval gate on the action that matters. That defect belongs to whoever wired the tools, often the buyer or an integrator.

The budget funds detection here, not accountability. A £40 million ($53 million) National Agentic Security Unit will detect, investigate and respond to rogue AI agents, building “world-first capabilities to detect and respond to misaligned agentic activity,” with no named host agency or NCSC link. The AI Security Institute, moved to the Cabinet Office in July, gets £120 million ($159 million) over four years for frontier-model testing. Neither line says who pays when an agent misbehaves.

Buyers can prepare the evidence anyway. If logs cannot reconstruct each model decision and tool call, nobody can prove where a defect sat. An AI supply chain security audit that records model provenance, plugin sources and fine-tune data produces the file you would want in a dispute.

What does the £154 million in cyber funding buy?

Mostly state-run detection. The budget adds £154 million ($205 million) of new cyber-defense money, much of it announced by the Treasury beforehand. The largest line, £70 million ($93 million), funds a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC that will use AI to find vulnerabilities across critical infrastructure and the wider economy. The budget does not say how it differs from the NCSC’s existing Early Warning service, and an NCSC spokesperson declined to comment.

Another £60 million ($79 million) funds the first phase of the NCSC Cyber Shield, announced in April, which uses agentic AI to find and fix weaknesses in government networks and critical national infrastructure. The remaining £24 million or so goes to technology in local authorities, hospitals and schools.

The AI emphasis has a trigger. In the week before the budget, critical PHP flaws discovered using AI forced websites offline, according to The Record, which did not name the CVEs. The NCSC told organizations to patch affected systems or consider taking them offline.

For scale, the estimated JLR loss is about 12 times the whole package. Scanning finds the hole; liability decides who pays for shipping it. Ownership is split too: the Law Commission review sits with the business department, cyber policy with the Department for Culture, Media and Sport, and cyber minister Baroness Lloyd holds posts in both.

What should security and business leaders decide now?

Whether to respond to the Law Commission before 14 January 2027, and how to start collecting the evidence any liability regime will run on.

• Respond to the Law Commission. The legal definition of “product” is being drafted now.
• Rewrite supplier questionnaires. Ask for a maintained SBOM, a PSIRT contact, a vulnerability-reporting route, a support end date, signed releases and a documented update process, not a “secure by design” claim.
• Price support periods. If you are the vendor, a long update obligation is a cost line. Budget it before December 2027.
• Preserve defect evidence during incidents. Keep the exact build and dependency inventory, advisory and patch timestamps, support terms, update logs and exploitation logs. That record separates a vendor defect from your own exposure.

Practitioner’s note. After an event like the PHP incident, confirm which hosts actually run the affected branch and check the advisory’s version and configuration conditions before declaring an outage or a breach. A future liability claim will turn on that distinction, so document it as you go.

FAQ

Will the UK make software companies liable for cyber breaches?

Not yet. Budget documents published on Wednesday commit only to a 2027 consultation on where breach liability should sit, and the legal model is undecided.

When does the Law Commission product liability consultation close?

On 14 January 2027. It proposes adding software and AI systems to the Consumer Protection Act 1987 definition of product.

What fines does the EU Cyber Resilience Act allow?

Up to €15 million or 2.5% of global turnover, whichever is higher, once its main obligations take effect in December 2027.

How much did the Jaguar Land Rover hack cost the UK economy?

An estimated £1.9 billion ($2.5 billion), according to figures cited by The Record, about 12 times the budget's £154 million in new cyber funding.

If your product ships an AI agent with real tool access, the liability question starts with which permissions you granted and what your logs can prove. Our agentic AI threat modeling maps those trust boundaries before a regulator or a claimant does.