On 11 November 2026, The Record reported that fourteen governments in the Pall Mall Process had adopted the first guidelines for companies that develop, sell or finance commercial cyber intrusion capabilities (CCICs). The UK and France lead the effort. Signatories named in the coverage include the US, Germany, Italy and Japan. The guidelines were endorsed at the initiative's third conference, attended by 43 countries. They are voluntary and carry no penalties.
The strongest case for tougher rules
The argument for binding rules is serious. The French Foreign Ministry says access to capabilities once reserved for a few specialised agencies has widened, so that "any actor can now buy 'off the shelf' the ability to silently penetrate a phone." It says these tools have also been implicated in surveillance of journalists, political officials, activists and businesses. Freedom House cites its Freedom on the Net research that 49 governments are suspected of having access to sophisticated spyware or data-extraction technology. It also finds that at least 19 of the 48 governments it identifies as perpetrators of transnational repression use commercial spyware.
A critic could fairly say that voluntary guidelines have a poor record when the commercial incentive points the other way. A vendor with a lucrative client has little reason to walk away because a document asks it to "consider" remedies for victims.
What the guidelines actually ask
According to The Record, the text asks firms that develop, sell or finance CCICs to do four things:
- vet their customers;
- put technical safeguards against misuse in place;
- maintain systems for monitoring and reporting abuse;
- halt sales and support when serious misuse is a credible risk.
They are endorsed by governments rather than by industry bodies. The French ministry stresses they "do not create new international legal obligations," but adds that a voluntary code "is not, however, an optional code." The UK Foreign Office frames the aim as disincentivising irresponsible activity across the CCIC market, improving transparency for regulators, vendors and customers, and giving clarity to businesses operating within or at the edge of the industry.
Why a voluntary approach is defensible
The category is hard to regulate with a blunt instrument. The UK's National Cyber Security Centre defines CCICs broadly: vulnerability research, exploit development, malware creation, command and control, hacking-as-a-service and access-as-a-service. Much of that overlaps with legitimate defensive work. Security researchers who find and disclose vulnerabilities, penetration-testing firms and law-enforcement contractors all use similar skills and tooling. A broad statutory ban or a licensing regime written around "intrusion capability" would risk criminalising the security research that makes the open internet safer.
The process also took industry input. The UK government and France ran a consultation on industry good practice, which closed on 16 January 2026. A clear, shared norm that separates responsible vendors from irresponsible ones helps compliant firms, because it gives their investors, insurers and government customers something to point to.
Where the guidelines are weakest
The weakness is enforcement. The guidelines carry no penalties, and The Record expects pressure to come from the governments that buy these tools and license their export. That puts the burden on the states themselves, and states are often the customers.
The predecessor document shows the risk. The Code of Practice for States, launched in Paris on 4 April 2025, commits supporters to action on the development, facilitation, purchase and use of CCICs. It is voluntary and non-binding. The NCSC says it has been signed by 27 states. The Record notes that the 2024 London launch drew big tech and cybersecurity firms but not the controversial businesses whose products were linked to abuse. Freedom House warned that the Code relies on nationally determined principles, with proportionality, necessity and nondiscrimination given only as examples states "could include."
The numbers also show limited reach. Fourteen governments endorsed the new guidelines, while 27 states have supported the earlier Code and 43 attended the conference. Governments that have not signed are not bound even by the soft commitments.
What would make it work
The voluntary approach can succeed only if signatories tie it to levers they already control, which they can do without new legislation.
- Export licensing: licensing authorities can ask exporters to show customer vetting and misuse-monitoring systems. Compliance would then become a condition of selling, not a courtesy.
- Public procurement: governments that buy offensive tools can require vendors to meet the guidelines. They can also refuse to buy from firms that continue selling into credible abuse.
- Financial and investor screening: the guidelines cover firms that finance CCICs. Investors and lenders can build the same due-diligence questions into their own decisions.
- Transparency: public reporting by buyers and vendors would let journalists and researchers check whether sales actually stop when abuse is credible.
The approach has precedent in how voluntary norms in other fields became de facto standards once procurement and licensing adopted them. It stays proportionate because it targets sales to credible abusers, not the underlying research.
Bottom line
The Pall Mall guidelines are not a solution to commercial spyware abuse, and their authors do not claim to be. The French ministry says work will continue as automation, artificial intelligence and new business models raise fresh questions. The right test is concrete: whether signatory governments deny export licences, withhold contracts, or call out vendors that sell to proven abusers. If they do, a voluntary text will have changed behaviour without criminalising security research. If they do not, it will join a growing shelf of well-meant documents that left the market as it was.