UK and France Issue Pall Mall Industry Guidelines

The United Kingdom and France have issued voluntary, non-binding industry guidelines for companies that develop, sell, finance or use commercial cyber intrusion capabilities, the tools often discussed as commercial spyware. According to a GOV.UK publication by the Foreign, Commonwealth & Development Office, dated 11 November 2026, the Pall Mall Process Guidelines for Industry were launched by the two governments at the third Pall Mall Process Conference in Paris that day.

A French joint communiqué of the same date, circulated via Public, gives the conference dates as 10 and 11 November 2026 and describes the text as guidelines “for the cyber intrusion industry.” The original page on diplomatie.gouv.fr was not located for this report; the communiqué is cited from that Public distribution, and the recommendations below are taken from the official English guidelines document on GOV.UK, not from secondary accounts of the French text.

The FCDO says the guidelines are “complementary to the Code of Practice for States” issued in April 2025, and that they are “informed by the 4 guiding pillars” of the process: accountability, precision, oversight and transparency. The Pall Mall Process itself was launched in February 2024. “Through the Industry Guidelines, we aim to disincentivise irresponsible activity across the market for CCICs; improve transparency for regulators, vendors and customers; and provide clarity for businesses operating both within and peripherally to the industry,” the FCDO writes.

GOV.UK lists 14 endorsing countries: Austria, the Bahamas, Costa Rica, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Poland, Slovakia, Switzerland, the United Kingdom and the United States of America. That official list is the count used here.

The official file is also careful about what a CCIC is, and about who is in the industry. Commercial cyber intrusion capabilities are defined as the tools, products, platforms or professional services, “including commercial spyware,” that enable access to, or operations inside, information and communication systems. The industry, as defined, includes product developers and vendors, intermediaries such as brokers and resellers, integrators, operational-support firms, and investors or financiers. The guidelines are aimed at that ecosystem. They are “not intended to cover entities, activities, tools or services developed or undertaken solely for defensive cyber security resilience, academic, digital forensic analysis or security testing purposes,” including penetration testing, bug bounties and coordinated vulnerability disclosure.

Irresponsible use, for the purposes of the process, “should be understood as including use in ways that threaten security, respect for human rights and fundamental freedoms or the stability of cyberspace,” without appropriate safeguards, or in a manner inconsistent with applicable international law, including international human rights law. The text also says CCICs “should not be used to target individuals or groups based on any discriminatory grounds.” Investors and financiers are told that the entities they fund should act in accordance with the guidelines and with the UN Guiding Principles on Business and Human Rights. Those are recommendations, like the rest of the file, but they are the official ones, and they go further than a slogan about “vetting customers.”

That scope is the honest centre of the document. It is a text for a market, including the money behind the market, and it is written so as to leave purely defensive security work outside the definition. The April 2025 Code of Practice for States remains the companion piece: that earlier instrument was addressed to governments as regulators, buyers and users of these tools. The November 2026 guidelines try to do the same job for the companies that build, sell, integrate, resell or fund them. One is not a substitute for the other, and the FCDO presents them as complementary.

The guidelines also have to be read as a floor, not as a finished regulatory system. Fourteen states have put their names on the GOV.UK list. The text asks those states to support the application of the guidelines in their own jurisdictions, in line with national law, but it leaves enforcement to those jurisdictions and to the commercial pressure that government buyers can apply. There is no sanctions annex, and no international complaints body is created by the file. The force of the recommendations will be visible only if vendors change their customer-vetting and termination clauses, and if the states that already purchase commercial intrusion tools treat those clauses as a condition of doing business.

The Pall Mall Process guidelines ask firms to vet customers and to stop support when serious abuse is already a risk

The document itself opens by “strongly encourag[ing] private entities operating in the Commercial Cyber Intrusion Capability (CCIC) industry to adhere to these voluntary and non-binding ‘Industry Guidelines’.” The text is written as recommendations for industry, endorsed by states, and is without prejudice to existing duties under national or international law. It creates no new international legal obligations of its own.

The practical section is more specific than a press summary. Firms are asked to establish risk-assessment processes “to inform vetting” of potential vendors, suppliers and contractors, of potential customers, and of staff (paragraph 18.d), and to treat due diligence as “a continuous process” with contractual refusal and termination clauses (18.e). Paragraph 18.f says relevant commercial operations should be “suspended” and that sales, transfer and support should be halted when a “credible and substantiated” risk assessment shows “a serious risk of irresponsible use,” or that “irresponsible use, or serious abuse, or violations of human rights have already taken place.”

Monitoring and reporting sit in part 20. Companies are asked to watch external indicators, including threat intelligence and public allegations, to publish a way for affected people to report irresponsible use, and to take the allegation seriously enough to investigate. On remedies, the text is weaker and should be quoted that way: the industry “should consider taking steps to provide remediation and/or judicial and non-judicial redress” for people affected by harms it has caused or contributed to (20.c.iv). The document does not attach penalties for ignoring the guidelines.

A voluntary industry code is only as strong as the states that buy the tools

The point of this text is accountability for a market that has already been used to abuse journalists, opposition figures and human-rights defenders. TSN has covered that harm in specific cases, including Citizen Lab’s finding that Pegasus spyware was used against Belgrade’s university rector days before Serbia’s elections and its separate report tying Candiru spyware on Al Jazeera devices to targeted ads. Those are the kinds of commercial-intrusion cases the Pall Mall Process says it is trying to shrink. The Candiru report is cited here in the body only.

The guidelines also sit beside existing domestic oversight of state capabilities. In the United Kingdom, the Investigatory Powers Commissioner’s Office has already reported that GCHQ could not account for thousands of items of removable media, a reminder that intrusion tools, whether commercial or official, depend on record-keeping and supervision if they are to be used within the law. The April 2025 State Code and these industry guidelines are diplomatic instruments. They sit alongside that kind of inspection, rather than standing in for it.

What the 11 November launch does not do is turn a voluntary text into an enforcement regime. Fourteen countries have endorsed it on GOV.UK. The recommendations on vetting, on stopping sales and support when serious abuse is already a risk, and on monitoring allegations are now on the record, in official language. Whether vendors change their contracts, and whether the states that buy CCICs treat those clauses as a condition of purchase, is the test that this document cannot answer for itself.

Sources

Foreign, Commonwealth & Development Office, “The Pall Mall Process Guidelines for Industry,” 11 November 2026, including the official English guidelines file. https://www.gov.uk/government/publications/the-pall-mall-process-guidelines-for-industry
French Ministry for Europe and Foreign Affairs, joint communiqué, “Les lignes directrices à l’intention de l’industrie de l’intrusion cyber,” 11 November 2026, as circulated via Public (the diplomatie.gouv.fr original was not located for this report). https://www.pubt.io/view/624CD6B1713083013F6418292BF16B48AD01C9C9
Pall Mall Process, Industry Guidelines (English official file on GOV.UK). https://assets.publishing.service.gov.uk/media/6af30bcab83b3cae0d0a216e/Pall_Mall_-Industry_Guidelines__EN.odt