Cyber risk is now a constant threat to business. The liability risk has been known for some time; there have been various cases, often concerned with personal data breaches, which have reached the High Court. These include the litigation following the Morrisons hack and Warren v DSG. The English Court has confirmed that the victim of a cyberattack has not misused the data of the data subject and that the guilty party is the attacker; however, that does not mean a company that is attacked has no risks or liabilities. Your business needs to be able to demonstrate it took reasonable measures to secure data and prevent unauthorised access. If it cannot, then it may not enjoy the full protection of its insurance. The greatest challenge now is trying to stay ahead of the attackers.
In October 2026, Anthropic published a paper that illustrates the unintended security threats that emerge with rapid advances in AI capabilities. This only adds to the need for vigilance and regular review of your cyber security.
The paper notes, inter alia:
“The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).”
The self-replication capability described in the paper has not been evidenced externally in reported hacks, but it could soon become a serious issue to address. The power of AI to support hackers is becoming clearer, with reports of recent cyberattacks against nine South Korean banks by a Chinese man relying on an AI agent and Anthropic’s Claude Code. We all hear about the opportunity for greater productivity from people using AI agents, but sadly this also applies to bad actors hacking more.
In light of this, there is a need to understand the liability for the hack you cannot stop. Earlier in 2026, the UK Jurisdiction Taskforce (UKJT) published its Legal Statement on Liability for AI Harms under the law of England and Wales. English law does not need bespoke laws on AI to deal with these issues; the UKJT confirmed this with its statements. English law has established legal concepts in contract, negligence, product liability, misrepresentation, and defamation which provide the answers to most foreseen AI-related issues. English common law’s flexibility has always coped with technological developments, as we saw when telex and email first appeared and raised questions of contract acceptance.
Areas of legal uncertainty
However, there are areas of legal uncertainty. The UKJT found three key characteristics that create legal uncertainty:
- An unpredictable relationship between inputs and outputs;
- Opacity in the system’s reasoning process; and
- Limited user control over outputs.
As a business, reducing your risk requires active steps to keep your systems and staff training up to date, and the rest is best addressed via contractual provisions. You need to ensure that your contracts suitably allocate AI-related risks, especially in your supply chain. You also need to ensure contracts with employees and contractors consider these risks, and with employees you need to ensure you have suitable policies in place.
You need to think about whether your staff are using AI, and if their use creates risks. For guidance on risks, see our previous Keynote here.
Takeaways
The developments of the past year have shown that you now need to think about whether your staff are using suitable AI tools or not, whether there is suitable due diligence before using the tools, and whether there was testing and evaluation before adopting an AI tool. Human oversight is extremely important and whether it is suitably done so that humans remain ‘in the loop’.
The UKJT has suggested employers may be vicariously liable for AI-related wrongdoing by employees who use AI negligently. One of the most significant risks now is knowing what employees are using and if they are using it appropriately.
More changes may be coming on liability, as the Law Commission continues its review of product liability rules. A new review launched in October 2026, and the Commission wants to consider if the law needs updating for the digital age; the review focuses on Part 1 of the Consumer Protection Act 1987, which was designed to make it easier for people injured by defective products to claim compensation. However, that law was for a world dominated by physical goods. Since then, products have become more complex, increasingly digital and often interconnected. In today’s world, you need to ensure that your contractual position has accounted for AI and digital liability risks.
If you have questions or concerns about the risk of AI, please contact James Tumbridge and Robert Peake.
For further information please contact:
