"Their response could and should have been more effective," judge Nicholas Loraine-Smith said in his conclusions after a series of hearings that began in January.
"The response by the police was at best shambolic, at worst cowardly," he said, adding that the hotel guards were not armed and had no walkie-talkies.
But he said there was no "neglect" by the tour operator TUI because the victims were "not in a dependent position" and said there was "nothing that the hotel might have done before the attack".
"The simple but tragic truth in this case is that a gunman armed with a gun and grenades went to that hotel intending to kill as many tourists as he could," the judge said.
Also Read
The British inquest, which is in fact a series of individual inquests into the circumstances of death of each British citizen, is not a trial but the ruling could be used in civil lawsuits.
"We will now be preparing to commence civil proceedings against TUI," said lawyer Kylie Hutchinson, whose firm represents most of the victims' families.
"It is now crucial that the whole travel industry learns from what happened in Sousse to reduce the risk of similar catastrophic incidents in the future."
TUI managing director Nick Longman said outside court that everyone had been left "shocked and devastated" by the attack.
"I would like to again extend our deepest sympathy. We are so very sorry for the pain and loss those affected have suffered."
Disclaimer: No Business Standard Journalist was involved in creation of this content