UK Budget to Consult on Cyber Breach Liability

The UK government will consult next year on whether the companies that make insecure technology should carry more of the cost when it is breached. In the Budget 2026 document published on 28 October, HM Treasury said: “Building on the Law Commission’s product liability consultation, the government will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.”

It is a promise to ask the question, not a new law. But it sits alongside a set of funded cyber measures, including £70 million for a new vulnerability centre at the National Cyber Security Centre (NCSC) and £40 million for a unit to deal with AI agents that go rogue.

In brief

The government will consult next year on where liability for cyber breaches should sit.
The Budget sets out £154 million for cyber defences, including a £70 million NCSC vulnerability centre and £60 million for a national Cyber Shield.
A new £40 million National Agentic Security Unit will respond to “rogue agentic incidents”.
The AI Security Institute gets an additional £120 million.

What the Budget commits

The cyber lines sit in a section on security and resilience, where the Treasury says it will invest “around £500 million to build the secure foundations for an AI-enabled economy”. The document lists “£154 million to strengthen cyber defences and £40 million to establish a National Agentic Security Unit to investigate and respond to rogue agentic incidents”.

The £154 million breaks down into three parts. A new £70 million National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC is meant “to strengthen the UK’s ability to understand and reduce national cyber exposure”, and the Budget says it “will deploy AI tools to identify cyber vulnerabilities across our critical infrastructure and the wider economy”. An extra £24 million expands the public sector AI defence programme, to “harden the public sector technology estate” across councils, hospitals and schools. And £60 million funds the first phase of a national Cyber Shield “to develop agentic cyber defence capabilities”, including a £25 million AI and Cyber Security Challenge Fund and scoping for a regulatory deployment sandbox.

The new agentic security unit will “detect, investigate and respond to cases of rogue agentic systems”, combining monitoring and incident response with new operational capabilities. HM Treasury’s Budget news story calls it “a world-first national capability”. The Budget also confirms an additional £120 million for the AI Security Institute (AISI) and a new AI Cyber Security Centre of Excellence in Manchester.

Most of the cyber money was trailed four days earlier, when the Treasury announced the AI package that TSN covered as a £165 million AI biosecurity drive with £120 million for AISI. The liability pledge is the new part.

Why liability is the harder fix

Money for defenders treats the symptoms of insecure software. Liability goes after the cause. At present, when a product ships with a flaw that attackers exploit, the cost usually falls on the organisation that bought it, not the company that made it. The government’s own security agency has made the point: The Record quotes NCSC chief technology officer Ollie Whitehouse saying last year that “we know how to build secure products and services”, but that the commercial incentives to do so “are not sufficient”.

The Record reports that the pledge is a single bullet point in a 166-page document, and that it leaves open which department will lead, when the consultation will happen, and whether any change would come through civil liability or new statutory duties. The Treasury did not respond to its questions. It also notes that the Cyber Security and Resilience Bill, now in the House of Lords, stops short of placing obligations on software developers.

The Law Commission consultation the Budget refers to opened on 8 October and runs to 14 January, according to The Record. It proposes widening the meaning of “product” in the Consumer Protection Act 1987 to cover software and AI. The EU has already moved: The Record says its Cyber Resilience Act allows fines of up to €15 million or 2.5% of turnover, with the main obligations applying from December 2027. UK firms that sell into Europe will face those rules either way, which may make alignment easier to argue for.

Recent events show what is at stake. A flaw in PHP recently took 32 UK government services offline, and The Record cites an estimated £1.9 billion cost from the Jaguar Land Rover hack.

Questions the Budget leaves open

There are practical gaps too. The Record notes that the NCSC already scans UK-hosted systems and alerts organisations through its Early Warning and Proactive Notifications services, and the Budget does not say how the NERV Centre will differ; an NCSC spokesperson declined to comment. The Record also reports that the Budget does not say which agency will host the agentic security unit, or how it will work with similar NCSC projects.

Using AI agents for defence brings its own risks. Tools that scan and act on critical infrastructure need clear rules on human oversight, which is why the sandbox matters, and so far it is only being scoped. The UK’s wider push for “trusted AI”, seen in the UK Space Agency’s AI roadmap, relies on the same kind of assurance.

The consultation is likely to be contested. The Record reports that the Business Software Alliance, whose members include Microsoft, Oracle and Amazon Web Services, has lobbied against such measures, arguing they would stifle innovation. Its value will depend on whether ministers put concrete options on the table, such as statutory duties for developers, rather than another round of voluntary codes.