GRC

UK and France set first rules for spyware firms, 14 states sign up

The UK and France launch the Pall Mall Process industry guidelines for spyware and hacking-tool firms. What the voluntary code asks and who it affects.

Graphic of a set of scales with the headline 'First conduct rules for commercial hacking firms'

Britain and France have published the first conduct guidelines for companies that build, broker, sell or fund commercial hacking tools, and 14 governments have endorsed them. The code is voluntary and carries no penalties, but it sets a written benchmark that UK buyers, investors and export regulators can now hold vendors to.

What happened

On Wednesday 11 November 2026 the UK and French governments launched the Pall Mall Process Guidelines for Industry at the third Pall Mall Process conference, held in Paris. The Foreign, Commonwealth and Development Office published the text on GOV.UK the same day. It is the first set of expectations aimed squarely at the commercial cyber intrusion capability (CCIC) market, a term that covers spyware, exploits, access-as-a-service and the companies that trade in them.

Delegations from 43 countries attended, but only 14 endorsed the guidelines: Austria, the Bahamas, Costa Rica, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Poland, Slovakia, Switzerland, the United Kingdom and the United States. That is roughly half the number that signed last year’s Code of Practice for States.

France’s foreign ministry described the text as “the first global standard of responsible conduct” for the sector. It also stressed that the guidelines create no new international legal obligations. The FCDO says the aims are to discourage irresponsible behaviour across the CCIC market, give regulators, vendors and customers more transparency, and tell businesses on the edges of the industry where they stand.

The detail

The guidelines rest on the four Pall Mall pillars: accountability, precision, oversight and transparency. In practice they read like a demanding compliance framework. Firms are asked to:

  • Comply with law and standards. That means registering with national business registries, disclosing beneficial ownership to authorities on request, obtaining export licences where required and applying controls such as ISO/IEC 27001, 27002 and 15408. The text also warns that rebranding or moving jurisdiction does not, by itself, cut a firm’s link to its past conduct.
  • Run continuous due diligence. This covers suppliers (including a software bill of materials where relevant), customers and end users, and staff. Staff screening includes conflicts of interest, links to sanctioned entities for senior staff, and periodic re-vetting of people with access to sensitive capabilities.
  • Manage risk technically and contractually. The code asks for compartmentalised research and exploit development teams, need-to-know access, contracts that ban onward transfer and resale, and clauses that allow suspension and termination. Staff should be barred from selling or operating tools privately, or from doing outside exploit work without permission.
  • Monitor and oversee. This means immutable internal logs of who accessed or changed a capability, resourcing to track external threat intelligence and allegations of abuse, independent oversight where feasible, and a published channel for reporting misuse.
  • Stop when necessary. Sales, transfers and support should be suspended where assessments show a serious risk of misuse, or evidence that abuse has already happened.

On victims, the wording is softer. Firms should “consider” offering remediation or redress where they have caused or contributed to human rights harms.

One point matters to most readers of this site. Paragraph 15 expressly excludes work done solely for defensive resilience, academic research, digital forensics or security testing, and it names penetration testing, bug bounty programmes and coordinated vulnerability disclosure.

Checklist of the main expectations in the Pall Mall Process Guidelines for Industry, including due diligence, access controls, monitoring, halting sales and the exclusion for security testing

Why it matters for UK organisations

Few UK companies sell spyware, but this still matters for three reasons.

First, the definitions are broad. The text describes an ecosystem that includes researchers, brokers, resellers, sales agents, operators, venture capital, private equity and family offices. UK firms that fund offensive security start-ups, resell exploit or access products, or broker vulnerability information now have a government-endorsed yardstick for their due diligence.

Second, the code has no penalties, so its force will come from buyers and export licensing. Reporting by The Record and others suggests that pressure from governments that purchase these tools and approve their export is the real enforcement route. In the UK that points at public sector procurement and the strategic export controls regime. Vendors hoping to sell to UK government customers should assume the guidelines will start appearing in tender questions and contract clauses.

Third, the carve-out is useful but conditional. It covers activity carried out solely for testing, research or disclosure. A consultancy that runs CHECK or CREST engagements and also sells exploit capability or access on the side falls outside the exclusion for that second line of business. The code’s suggested staff clauses, which restrict outside exploit development, may also start appearing in employment contracts across the sector.

Expert view

I welcome the explicit exclusion of penetration testing, bug bounty and coordinated disclosure. Testers have long worried that spyware rules would catch ordinary testing, and putting the exclusion in the definitions is the right call.

Many of the controls are also simply good security hygiene. Compartmentalised teams, immutable access logs, re-vetting of privileged staff and contractual limits on onward transfer are what I would expect any firm holding dangerous capability to have. When we test organisations, weak logging of who touched what is one of the most common gaps we find.

The weaknesses are just as clear. A voluntary code that fewer than half the attending states would endorse, with remedies left optional, will not change the behaviour of the vendors most associated with abuse. The Record noted criticism that Britain and France want to limit other states’ access to these tools while supporting their own industries. Civil society groups, including Amnesty International and Freedom House, had pushed for firmer limits before the text was finalised. Whether the code means anything will depend on whether the UK actually writes it into procurement and export decisions.

What to do now

  1. Check whether you are in scope. If your organisation funds, resells, brokers or develops intrusion capability, even as a sideline, map that activity against the definitions in Part 3 of the guidelines.
  2. Document your defensive status. Testing firms should record in policy that their work is solely for testing, research or disclosure, and keep scoping and authorisation records that prove it.
  3. Review contracts and staff terms. Look at clauses on outside exploit development, personal sale of tools and onward transfer of anything you deliver to clients.
  4. Tighten access logging. Immutable logs and least-privilege access to sensitive tooling support the user access control theme in Cyber Essentials, and they will help in any due diligence review.
  5. Add questions to supplier due diligence. If you buy offensive services, threat intelligence access or forensic tooling, ask about ownership, export licensing and customer vetting.
  6. Watch procurement and export guidance. Any UK move to reference the guidelines in tenders or licensing decisions is the point at which they gain teeth.

Bottom line

The Pall Mall industry guidelines are the first written standard for the commercial hacking trade, and the UK helped write them. They bind no one, and only 14 of 43 states signed up. Even so, they give UK buyers, investors and regulators a reference point, and they put a welcome protection for legitimate testing work in writing. Their real effect will be decided in UK procurement and export licensing.

Sources

Related Posts