Governments set voluntary rules for commercial cyber intrusion vendors

Fourteen governments participating in the Pall Mall Process have adopted their first guidelines for companies that develop, sell or finance commercial cyber intrusion capabilities. The initiative, led by the United Kingdom and France, is intended to address abuses associated with the spread of tools such as commercial spyware.

The guidelines ask businesses to vet customers, put technical safeguards in place to reduce misuse, and maintain systems for monitoring and reporting suspected abuses. They also say companies should stop sales and support when there is a credible risk of serious misuse. Businesses are asked to consider remedies for people whose human rights have been violated.

These measures are voluntary: the guidelines do not establish new international legal obligations, and they set no penalties for non-compliance. The French Foreign Ministry said the standards do not rule out uses that states consider legitimate for national security, defense, tackling organized crime or cybersecurity. The British Foreign Office described the goal as discouraging irresponsible market activity, improving transparency and clarifying expectations for businesses operating in or around the industry.

Vendor oversight is central

For enterprise security and procurement teams, the guidelines highlight the risks of dealing with vendors whose products can enable covert access to devices and systems. They put customer screening and post-sale monitoring on the list of expected responsible practices, rather than treating due diligence as a one-time check before a contract is signed.

The French ministry acknowledged that commercial intrusion tools have been used in intelligence work and against organized crime. It also warned that such capabilities have been implicated in surveillance targeting journalists, political officials, activists and businesses. The ministry said access to capabilities once associated with a small number of specialized government agencies has expanded, making commercially available tools a concern beyond government procurement.

The guidelines are directed at companies that develop, sell or finance these capabilities. They do not prescribe a specific technical control, customer-vetting process or reporting mechanism. Nor do they create a formal enforcement body. The British government said pressure to comply is expected to come from governments that purchase the tools or license their export.

Participation and enforcement remain challenges

The guidelines were endorsed at the Pall Mall Process’s third conference, which brought together representatives from 43 countries. Fewer than half endorsed the new standards. The United Kingdom, France, the United States, Germany, Italy and Japan were among the signatories. The reason other conference participants did not endorse the guidelines was not clear.

The initiative has faced questions about whether voluntary commitments can change how intrusion tools are traded and used. Its launch in London in 2024 attracted technology and cybersecurity companies, but not the controversial businesses whose products had been linked to abuses. Participants also raised concerns the following year about the process’s capacity to influence the market. Some criticized the United Kingdom and France over an apparent tension between restricting other states’ access to such tools and supporting their own spyware industries.

The previous conference produced a code of practice for governments, rather than an agreement focused on company conduct. Twenty-seven countries have since signed that government code. The new guidelines extend the initiative’s stated expectations to commercial actors, but their voluntary status leaves implementation dependent on company decisions and government leverage through purchasing and export licensing.

What organizations can take from the guidelines

Organizations assessing vendors in this market can use the standards as a reference point when asking how a supplier screens customers, detects misuse and responds to credible reports of harm. The guidelines do not guarantee that an endorsed company follows those practices, and they do not provide a certification or compliance regime. Buyers and regulators will still need to assess vendor controls and accountability directly.

Participants plan to continue work as artificial intelligence, automation and new business models raise further questions for governments and companies. Whether the guidelines influence commercial behavior will depend on how vendors implement them and whether governments use their purchasing and export-licensing roles to reinforce the commitments.