This guide is written for solicitors, trainees and law students in England and Wales.
State immunity is the rule that a foreign state cannot be sued in the English courts unless the claim falls within one of the exceptions in the State Immunity Act 1978. This explainer sets out the scheme of the Act, works through the exceptions practitioners actually use, and explains where the line now sits after the Supreme Court’s decision on spyware and section 5 in Bahrain v Shehabi.
Who is this guide for?
Litigators contemplating proceedings against a foreign state or state entity, whether in commercial, employment, personal injury or human rights contexts, and those defending them. It assumes no prior public international law, because in practice these points surface without warning: a supplier discovers its counterparty is state-owned, an employee sues an embassy, or a claimant injured by state conduct asks whether the English courts can hear the claim at all.
How does the State Immunity Act 1978 work?
Section 1 confers a general immunity from the jurisdiction of the United Kingdom’s courts on every foreign state, and the court must give effect to it even if the state does not appear. Everything else in Part I is an exception, and the claimant bears the burden of bringing the case within one. The exceptions most often engaged are section 2 (submission to the jurisdiction, including by prior written agreement), section 3 (commercial transactions and contracts to be performed wholly or partly in the UK), section 4 (certain contracts of employment), section 5 (death, personal injury and damage to tangible property caused by an act or omission in the UK), and section 9 (agreements to arbitrate). Separate rules in section 12 govern service through the Foreign, Commonwealth and Development Office, with timescales that surprise anyone who has not used them, and sections 13 and 14 restrict enforcement and extend immunity to separate entities exercising sovereign authority. Procedure matters as much as substance here, and our guide to serving out of the jurisdiction covers the mechanics that sit alongside the Act.
What did Bahrain v Shehabi decide about section 5?
In Bahrain v Shehabi [2026] UKSC 25 the Supreme Court held, by three to two, that section 5 removes immunity where a state’s agents, acting entirely from abroad, remotely install spyware on computers located in the United Kingdom and thereby cause psychiatric injury here. The majority read the provision as requiring only a legally causative act in the UK, treated Parliament’s omission of the presence requirement found in the European Convention on State Immunity as deliberate, and dismissed as artificial the argument that remote manipulation of a computer in England is merely the effect of an act done abroad. The dissent of Lord Leggatt and Lord Burrows located an act where the actor is, which would have preserved immunity, and the division between those two conceptions of where conduct happens will be argued over wherever similarly worded exceptions exist. Two limits deserve emphasis. The decision was reached on assumed facts as a preliminary issue, so the underlying allegations remain untried, and section 5 still requires personal injury or damage to tangible property, so purely economic or privacy harms do not engage it.
Working through an immunity question
- Characterise the defendant first: the state itself, a separate entity under section 14, or an individual official, since different rules attach to each.
- Fix the claim within a specific exception before issue, pleading the facts that engage it, because immunity is considered at the threshold.
- For section 5, identify precisely which legally causative act occurred in the UK; after Shehabi, presence of the state’s agent is unnecessary but a domestic act remains essential.
- Diarise service under section 12 realistically: transmission through the FCDO to the foreign ministry routinely takes months, and time for acknowledgment runs from receipt plus two months.
- Plan enforcement at the outset, since winning against a state and recovering from one are different problems, and section 13 protects most sovereign assets.
Common mistakes
The classic errors cluster at the edges of the exceptions. Claimants assume a commercial-looking counterparty cannot be immune, without checking section 14’s control and sovereign authority tests. Pleaders rely on section 5 for distress or data misuse without an injury recognised by English law, when the section demands personal injury in the clinical sense. Parties treat immunity from suit and immunity from enforcement as one question, and discover after judgment that the second is the harder. And practitioners still attempt ordinary service on embassies, which the Act does not permit and which restarts the clock at the point they can least afford it.
Shehabi makes England the first jurisdiction whose highest court has denied a state immunity for remote spyware operations, and the reasoning reaches any remotely executed state conduct that causes physical or psychiatric injury here. Claims that would have failed at the threshold two months ago are now arguable, and states and their insurers are re-pricing that exposure.
Official sources
The statutory scheme is the State Immunity Act 1978, and the judgment in Shehabi is on the Supreme Court’s website.
Date last updated: 14 August 2026.