decrypted · 28 october 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

The Budget's one-line promise on software liability

Buried in today's Budget is one bullet point that matters more to UK cyber security than the money around it. The government says it "will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit", according to The Record. It is a promise to ask a question, not to change a law, but it is the first formal British pledge of its kind.

What was actually promised

The pledge builds on a Law Commission review of product liability, whose consultation closes on 14 January 2027. That review provisionally proposes widening "product" to include software and AI systems, under the regime that already governs faulty goods, with final recommendations expected in late 2027. No lead department or start date has been named, and it is unclear whether the result would be civil liability, new duties on vendors, or both. HM Treasury did not respond to The Record's request for comment.

The lock that opens with any key

Imagine a manufacturer sells a lock that opens with any key from the same range. After a burglary, the customer carries the loss, the claim and the explanation to the regulator; the manufacturer faces an awkward release note. The NCSC, the National Cyber Security Centre and part of GCHQ, calls this "information asymmetry between vendors and buyers" in its impact assessment for the Cyber Security and Resilience Bill, The Record reports: sellers know far more about their product's weaknesses than buyers can check. That bill, now in the Lords, puts no obligations on software developers.

Secure by Design is a purchasing question

This is the design lesson in plain form. Secure by Design asks vendors to remove whole classes of flaw before shipping, but a voluntary code gives them little commercial reason to pay for it. Liability makes the party best placed to prevent a flaw pay when it is not prevented. The Business Software Alliance, whose members include Microsoft, Oracle and AWS, has lobbied against such measures, arguing they would stifle innovation. The EU is not waiting: its Cyber Resilience Act allows fines of up to €15m or 2.5% of global turnover, with main obligations from December 2027.

What to do before anyone consults

Nothing changes in law today, so the useful work is contractual. Ask suppliers, in writing, who pays when their flaw becomes your breach. Check whether licences cap liability at a year's fees. Ask for a named patch window and a security contact. Note who refuses to answer; that is your risk register. The cost is a few awkward procurement conversations. The alternative is the pattern after the Jaguar Land Rover attack, which The Record says is estimated to have cost the UK economy £1.9bn: private suppliers' flaws, public bills.

Also this week

Everest claims PwC. The Everest extortion group listed PwC on its leak site on 22 October. It claims to have taken 590 gigabytes, including regional learning records, software components, and staff names, emails, phone numbers and addresses. Treat all of that as a claim: the reporting does not verify it. PwC has said the incident involved a third-party vendor platform hosting employee learning records, that the site held no client data, sensitive personal information or financial records, and that its own network and operations were unaffected. It has not confirmed how much was accessed and declined to comment on the 590 gigabyte figure. The design question is the one in the lead: the least glamorous supplier often holds your staff's data, and your contract with it is the only control you have. Start a supplier inventory: who holds your learning, payroll and HR data on your behalf?

Britain's AI security money. On 24 October the government set out around £600m for AI security, ahead of the Budget. It includes an extra £120m for the AI Security Institute, £100m for an AI biosecurity laboratory backed by up to £200m of model credits from OpenAI and Anthropic, and £130m for a National Cyber Shield and a vulnerability-hunting centre at the NCSC, which is also to expand in Manchester. The Record notes the Budget does not explain how that £70m centre differs from the NCSC's existing early warning services. Finding flaws faster is welcome, but it only helps if someone fixes them, and that rests with the people running the software, not the people finding the bugs. Opinion, not advice: a detection budget without a remediation budget is half a plan.

Sources

If you want help turning supplier contracts into real security commitments, get in touch.