Fourteen governments have adopted the first international guidelines for companies that build, sell or finance commercial spyware and other hacking tools, in a UK and French-led effort to bring the industry under agreed standards. The Pall Mall Process Industry Guidelines were launched in Paris on 11 November at the initiative's third conference, where representatives of 43 countries gathered.

The guidelines are voluntary and carry no penalties. They set out what firms should do on human rights due diligence, vetting customers, disclosing beneficial ownership and ending contracts where tools are misused, covering what diplomats call commercial cyber intrusion capabilities, including spyware, exploits and hacking services.

Fourteen endorsers, with big names absent

The endorsing states are Austria, the Bahamas, Costa Rica, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Poland, Slovakia, Switzerland, the United Kingdom and the United States. Fewer than half of the countries at the conference signed up, and the UK Foreign Office said the aim was to discourage irresponsible activity in the market, improve transparency for regulators, vendors and customers, and give businesses clarity about their obligations.

The guidelines complement a Code of Practice for States launched in April 2025, which now has 27 supporters. The Pall Mall Process began in February 2024, when the UK and France convened states, companies, academics and civil society at Lancaster House in London to tackle the trade in tools that can break into phones and networks. France's foreign ministry stressed the new text was voluntary in nature, so its effect will depend on governments writing the standards into purchasing and export decisions.

Sources: GOV.UK, TechTimes