UK to look at making software companies liable for cyber breaches
Comments on “UK to look at making software companies liable for cyber breaches”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
The UK budget commits the government to consult next year on where liability for cyber breaches from insecure technology should sit, building on a Law Commission review that would extend product law to software and AI. Scope, lead department and whether it means civil liability or statutory duties remain unspecified. The EU is already moving on fines and strict liability for software, and vendor groups are expected to resist. The budget also allocates £154 million for AI-based cyber defenses, including £70 million for an NCSC vulnerability centre.
Why it ranked
No. 16 of 110 with a score of 0.62. The panel rated it highest on new information (0.88) and audience breadth (0.73), lowest on technical depth (0.28). Placed No. 16, No. 38 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Policy story on software liability for cyber breaches, a notable shift affecting software vendors. Mostly news reporting with cited sources; limited technical depth and actionable detail for builders.
- AI judgeJudge 3gpt-5.6-luna
- A timely, well-supported report on a potentially consequential UK shift toward software liability, with relevant EU and US context and substantial cyber-defense funding. Technical implementation detail is limited, and several policy details remain unresolved.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.62total under rubric v2.3
- Significance0.67
- Reader interest0.70
- Audience breadth0.73
- Practical relevance0.56
- Substantiated0.63
- Technical depth0.28
- New information0.88
- Counts against: Promotional0.05
- Counts against: Overclaim0.17
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.73 | 0.55 | 0.72 | 0.67 | 0.18 | +0.24 | +0.160 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.67 | 0.60 | 0.82 | 0.70 | 0.22 | +0.26 | +0.181 |
| Audience breadthHow many people who build technology does it concern? | 0.88 | 0.60 | 0.72 | 0.73 | 0.28 | +0.13 | +0.095 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.58 | 0.45 | 0.65 | 0.56 | 0.20 | +0.22 | +0.124 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.53 | 0.60 | 0.76 | 0.63 | 0.23 | +0.05 | +0.032 |
| Technical depthHow technically substantive is it? | 0.32 | 0.15 | 0.38 | 0.28 | 0.23 | +0.05 | +0.014 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.91 | 0.80 | 0.94 | 0.88 | 0.14 | +0.05 | +0.044 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.05 | 0.03 | 0.05 | 0.03 | −0.19 | −0.009 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.24 | 0.20 | 0.08 | 0.17 | 0.16 | −0.11 | −0.019 |
| Sum of contributions | +0.622 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.622 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/16/"><img src="https://rubric.hrih.si/badge/2026-10-29/16.svg" alt="Ranked #16 on Rubric, 29 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 2 matches source · 4 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
The hack of Jaguar Land Rover is estimated to have cost the British economy £1.9 billion ($2.5 billion).
The cited source says the same thing.
The article says “Last year's hack of Jaguar Land Rover alone isestimated to have cost the British economy £1.9 billion ($2.5 billion”
The source says “estimated to have cost the British economy £1.9 billion ($2.5 billion), according to a monitoring group”
Source cited by the article: therecord.media/jaguar-land-rover-cyberattack-economic-impact
No source givenFirst, only or fastest
The pledge to consult on cyber breach liability is the first formal pledge by a British government to examine where liability for cyber breaches should sit.
The article gives no link or citation for it.
The article says “it marks the first formal pledge by a British government to examine where liability for cyber breaches should sit”
The source says No source to compare with.
Couldn’t checkDate
The NCSC publicly called for a "strategic policy agenda" last year after efforts to address insecure technology had stalled.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the cyber and signals intelligence agency GCHQ. The agencycalled publicly for a “strategic policy agenda” last year, after efforts to address insecure technology had stalled”
The source says No passage could be compared.
Source cited by the article: therecord.media/ncsc-pushes-uk-government-create-strategic-cyber-policy-agenda
Matches sourceCausal conclusion
In the United States, proposals to make software makers liable for flawed code stalled for years amid disagreements over how to define the proper standard of care.
The cited source says the same thing.
The article says “proposals to make software makers liable for flawed codestalled for years amid disagreements over how to define the proper standard of care”
The source says “One of the biggest hurdles is establishing a “standard of care,” a minimum security threshold that companies could meet to avoid lawsuits”
Source cited by the article: therecord.media/cybersecurity-software-liability-standards-white-house-struggle
Couldn’t checkVersion
The Cyber Security and Resilience Bill was introduced to Parliament in November and is now before the House of Lords; it does not impose obligations on software developers, focusing on critical infrastructure operators and their suppliers.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “In its current form, the legislation stops short of imposing obligations on software developers, concentrating instead on operators of critical infrastructure and their suppliers”
The source says No passage could be compared.
Source cited by the article: therecord.media/british-gov-cybersecurity-law
No source givenNumber
The EU Cyber Resilience Act allows fines of up to €15 million or 2.5% of global turnover, whichever is higher, with main obligations taking effect in December 2027.
The article gives no link or citation for it.
The article says “allows regulators to fine manufacturers of insecure products up to €15 million or 2.5% of global turnover, whichever is higher, with its main obligations taking effect in December 2027”
The source says No source to compare with.
No source givenDate
The Law Commission consultation opened on October 8 and runs until January 14, proposing to broaden the definition of a "product" under the Consumer Protection Act 1987 to include software and AI systems.
The article gives no link or citation for it.
The article says “the Law Commission consultation referenced in the budget opened on October 8 and runs until January 14”
The source says No source to compare with.
No source givenNumber
The budget commits £154 million in new cyber defense funding, including £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC.
The article gives no link or citation for it.
The article says “the budget commits £154 million ($205 million) in new funding for cyber defenses”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.