The 2026 cyber strategy dropped the 2023 push for software liability

What the document says

President Trump's Cyber Strategy for America, dated March 2026, is a six-page document organised around six policy pillars: shaping adversary behaviour, promoting what it calls common-sense regulation, modernising federal networks, securing critical infrastructure, sustaining superiority in critical and emerging technologies, and building workforce talent and capacity. Reviewed directly, the document itself states it replaces the prior administration's approach and emphasises speed, deterrence and reducing regulatory burden on industry. Its regulation pillar states an intent to streamline cyber and data regulations, reduce compliance burdens, and address liability, without proposing a specific liability framework for software makers.

That is a marked change from the 2023 National Cybersecurity Strategy it replaces, a thirty-five-page document built around five pillars. That earlier strategy's Strategic Objective 3.3, titled Shift Liability for Insecure Software Products and Services, explicitly called on the Administration to work with Congress on legislation making software makers liable when they fail a duty of care, paired with a safe harbor for companies following secure-development practices. The 2026 strategy contains no equivalent objective; its liability language runs in the opposite direction, toward reducing compliance obligations rather than creating a new one.

Confidence and limits

Both documents were read in full, so their length, structure and the presence or absence of a liability-shifting objective are established directly. Legal commentary, including analysis from the law firm Covington, corroborates that the 2026 strategy is markedly shorter and more high-level than its predecessor, though that commentary was not the source for the liability comparison, which this entry drew from the two texts directly.

Why it mattered

A national strategy does not itself create law, and the 2023 objective never produced federal software liability legislation either. What changed is the executive branch's stated direction of travel: the 2023 document treated market failure in software security as something Congress should correct with a liability shift, while the 2026 document frames liability only as something to streamline away from industry. Readers should not treat either document as describing current law; both describe intent, and the 2023 objective was still unrealised legislation when the 2026 strategy superseded it.

Defensive takeaway

Continue to evaluate vendor contracts, warranties and secure-development commitments on their existing contractual and regulatory terms, since neither strategy document changes what a court or regulator can currently hold a software maker to.

• Does your vendor risk assessment rely on an assumption that federal software liability reform is imminent, and if so, is that assumption still supported?
• Has your organisation reviewed the 2026 strategy's six pillars for anything that changes your sector's specific regulatory exposure?
• Are you tracking software liability proposals in Congress directly, rather than through either administration's strategy document?

Comparing the two documents side by side shows a strategy that grew shorter and less prescriptive, and a specific objective, shifting liability onto software makers, that did not survive the transition from one administration's framing to the next.