UK to look at making software companies liable for cyber breaches

The UK budget commits the government to consult next year on where liability for cyber breaches from insecure technology should sit, building on a Law Commission review that would extend product law to software and AI. Scope, lead department and whether it means civil liability or statutory duties remain unspecified. The EU is already moving on fines and strict liability for software, and vendor groups are expected to resist. The budget also allocates £154 million for AI-based cyber defenses, including £70 million for an NCSC vulnerability centre.