On 11 November 2026, governments taking part in the Pall Mall Process adopted the first guidelines aimed at the businesses that develop, sell or finance commercial cyber intrusion capabilities, the industry usually described as commercial spyware or hacking-for-hire. The details below come from The Record’s report of the announcement, which quotes the French Foreign Ministry and the British Foreign Office, and from a GOV.UK summary page published the same day that lists the endorsing countries. We did not find the full guidelines document, so what we say about its content is second-hand and limited to what The Record describes.
What was adopted
According to The Record, fourteen governments adopted the guidelines at the process’s third conference, which 43 countries attended. The text is non-binding and is endorsed by governments, not by industry bodies. It asks companies that develop, sell or finance these capabilities to vet customers, build technical safeguards against misuse, and keep systems for monitoring and reporting abuse. It asks them to halt sales and support when serious misuse is a credible risk, and to “consider” remedies for victims of human rights abuses. The report states there are no penalties for non-compliance and that pressure “is expected to come from governments which buy the tools and license their export”.
The French ministry’s own description, as quoted, is careful: the guidelines “are voluntary in nature” and “do not create new international legal obligations and do not call into question uses that states consider legitimate” in four named fields: national security, defence, the fight against organised crime and cybersecurity. The ministry also says, as relayed by The Record, that a voluntary code “is not, however, an optional code”.
The GOV.UK page lists the fourteen endorsing countries: Austria, Bahamas, Costa Rica, France, Germany, Italy, Japan, Luxembourg, Netherlands, Poland, Slovakia, Switzerland, the United Kingdom and the United States. It says the guidelines were “informed by substantial consultation and negotiation” with states, industry, academia and civil society.
How we got here
The UK government’s November 2025 announcement shows the sequence. The process launched at Lancaster House in February 2024. In April 2025 it agreed a Code of Practice for States, which that page says is supported by “over 27” countries; The Record’s 2026 report says twenty-seven countries have since signed it. The UK and France then said they would develop complementary industry guidelines and ran a private consultation to gather views from industry and other stakeholders. The 11 November text is the product of that second track, as far as we can tell from these sources. We have not seen the consultation responses and do not know how they shaped the final wording.
Our read
What follows is our assessment, not reporting.
The guidelines matter mainly as a procurement lever. A voluntary code with no penalties changes nothing for a vendor that does not want to be changed. It changes something for a vendor that wants to keep selling to governments that endorsed it. The Record says pressure is expected to come from buyers and export licensing; that purchasing and licensing are the realistic mechanism is our judgement. If it works, it works through contract clauses and licence conditions, not through the text alone.
Fourteen is a small number. The Record says fewer than half of the participating states endorsed the guidelines and that it is not clear why the others did not. That gap is the story to watch. The numbers do not line up cleanly in the source: The Record says 43 countries attended and twenty-seven signed the earlier code, yet it says it is unclear why “the remaining 15” did not endorse the new one, and 43 minus 14 is 29 while 27 minus 14 is 13. We do not know which base The Record used. We do not know whether the non-endorsing states objected to specific provisions, wanted more time, or have domestic industries they are reluctant to constrain. The same report notes that earlier criticism of the process included the point that Britain and France were seeking to restrict other states’ access to these tools while backing their own industries. We offer no view on whether that criticism is fair; it is a reason the missing endorsements deserve explanation.
The carve-out is doing a lot of work. The statement that the guidelines do not question uses states consider legitimate is both what makes broad participation possible and what limits the effect. The Record reports that these tools have been implicated in surveillance of journalists, political officials, activists and businesses; that is an allegation it relays from the ministry. Our inference, not a sourced finding, is that many such customers consider their own use legitimate. A standard that defers to each state’s own definition of legitimacy asks vendors to judge their customers’ purposes without giving them a shared test. The guidelines’ call for vetting and for halting sales on credible misuse risk points at that problem, but we cannot assess how specific the text is on thresholds because we have not read it.
We do not expect an immediate change in the threat. Nothing in the sources we read suggests a change to the capabilities in circulation or their pricing, but no source addresses defenders directly, so this is our expectation. Organisations whose staff are likely targets, such as journalists, officials and civil society groups, probably face much the same exposure now as before. Our general advice, not drawn from the guidelines, is to keep to platform vendors’ own guidance: current OS patching, lockdown-style modes where available, and incident reporting channels.
What to watch
- The full text. Whether the guidelines define misuse thresholds, name reporting obligations to anyone, or set expectations for investors and financiers as well as sellers.
- The non-endorsers. The fourteen are now listed; the open question is why the other attending states are absent, and whether any join later.
- Vendor responses. Whether any commercial intrusion vendor publicly commits to the guidelines. The reporting we read does not mention any company response, and we did not search for one.
- Export licensing. Whether endorsing states tie licences to adherence. This is the lever The Record identifies, and we found no evidence yet, as of 12 November in the three sources above, of any state announcing such a link.
Limits of this piece
We have one news report for the content of the guidelines and two government pages for the signatory list and background. We did not read the full guidelines document, the French ministry’s statement in full, or the Foreign Office statement, and quotes from them are as relayed by The Record. Our assessments are opinion and may change when the text is available.