UK to consult on holding software firms liable for cyber breaches
Original title: UK to look at making software companies liable for cyber breaches
The consultation is promised for next year and will build on a Law Commission review of product liability that runs until January 14.
Budget documents say the British government will consult next year on tackling insecure technology at source and on where liability for cyber breaches should sit. The pledge follows NCSC pressure and an estimated £1.9 billion economic cost from last year's Jaguar Land Rover hack. Officials are expected to weigh compatibility with EU software rules; the Cyber Security and Resilience Bill still does not impose duties on software developers. HM Treasury did not comment, and the lead department, start date and whether rules would be civil, statutory or both remain open.
Unconfirmed: The government has not said which department will lead, when the consultation starts, or whether liability would be civil, statutory, or both.
- The Law Commission consultation opened on October 8 and closes on January 14.
- It would treat software and AI systems as products under the Consumer Protection Act 1987.
- The budget also commits £154 million in new funding for cyber defenses.
- The EU Cyber Resilience Act's main obligations take effect in December 2027.
- The Business Software Alliance, including Microsoft, Oracle and AWS, has lobbied against vendor liability.
From the original article
5 min read at therecord.mediaThe new U. K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has relied on voluntary codes to encourage software vendors to improve security.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.