UK Government Plans to Examine Making Tech Vendors Liable for Insecure Products

The British government has committed to consult on how to hold technology companies liable for cyber breaches caused by insecure products. The pledge appeared in budget documents published on Wednesday. It could be a landmark change for a country that has long relied on voluntary codes to encourage software vendors to improve security. The budget says the government will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.

The move comes amid growing concern over the economic cost of cyberattacks. Last year's hack of Jaguar Land Rover alone is estimated to have cost the British economy £1.9 billion ($2.5 billion). The work will build on an ongoing review of product liability law by the Law Commission of England and Wales. One option likely to be considered is expanding the Product Security and Telecommunications Infrastructure (PSTI) Act, which since 2024 has set basic security requirements for makers of consumer smart devices. Officials are also expected to keep any new rules compatible with the European Union's software cybersecurity regime.

Many questions remain open, including which department will lead the consultation, when it will start, and whether it will involve civil liability, legal obligations on vendors, or both. HM Treasury did not respond to a request for comment. The pledge follows years of pressure from the National Cyber Security Centre, including its chief technology officer Ollie Whitehouse, who warned in 2024 that the market was failing to reward companies for building secure products.