"Through the Industry Guidelines, we aim to disincentivise irresponsible activity across the market for CCICs; improve transparency for regulators, vendors and customers; and provide clarity for businesses operating both within and peripherally to the industry," the U.K. and French foreign ministries said after the guidelines were finalized Wednesday.
The Pall Mall Process and U.S. endorsement
This week the United States signed on to a set of voluntary industry guidelines developed under the Pall Mall Process for commercial cyber intrusion capabilities (CCICs), such as spyware. The industry guidelines are the second step in the U.K.- and France-led initiative, following last year’s code aimed at states. The U.K. and French foreign ministries framed the effort as intended to improve market behaviour, transparency and clarity for businesses.
Four pillars and concrete recommendations
The finalized guidelines rest on four main pillars: compliance with regulations and norms, due diligence, risk management and monitoring of compliance. They include practical recommendations aimed at vendors and customers alike, such as complying with export controls, creating a risk assessment process, implementing technical controls on access — including encryption — and continuously observing who can use the capabilities.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCivil society response: Access Now and the Business and Human Rights Centre
Advocates and rights groups greeted the guidelines as a compromise that did not go as far as they wanted. Natalia Krapiva, senior tech‑legal counsel for Access Now, said, "The guidelines clearly reflect the fact that they are the product of multiple stakeholders with often contradicting views: states, industry, academia, ethical hackers, and civil society."
Krapiva added that "civil society has advocated for more robust standards and measures, including mandatory technical kill switches, more transparency and stronger due diligence requirements," and that Access Now will "continue working with the Pall Mall Process to ensure that these guidelines help limit the uncontrolled proliferation and misuse of cyber intrusion tools, including spyware."
Gayatri Khandhadai, head of technology and human rights at the Business and Human Rights Centre, argued the outcome "falls short of what is truly needed to hold this industry to account." She outlined steps she believes states must take, saying, "States must raise the bar if they are serious about implementing concrete change. That means setting clear limits on use, attaching binding conditions to public procurement, extending scrutiny across the supply chain, guaranteeing victim notification and remedy, and moving from voluntary guidance to enforceable law."
Agenda items: artificial intelligence and implementation mechanisms
Delegates at the meetings finalized the industry guidelines while also discussing how artificial intelligence might affect the Pall Mall Process. Allison Pytlak, senior fellow and director of the cyber program at the Stimson Center, said that negotiation shifted earlier drafts — which she described as having a heavier focus on national security and proliferation — toward a better balance with human rights in the final version. She also framed the guidelines as creating a "very clear space to really zoom in on this problem," while warning that the process will need to produce results to sustain momentum.
Pytlak highlighted a practical gap that remains: national-level activity is happening, "but there isn’t any kind of clear and coherent way to track that." She said the next agenda item is implementation: both the state code and the industry guidelines need a clearer mechanism for reporting and feedback, and "that’s got to be concretized a little bit better."
How vendors, states, and victims are responding
- Vendors: The guidelines expect vendors and their customers to adopt technical access controls (for example, encryption), carry out risk assessments, and comply with export controls and monitoring obligations laid out under the four pillars.
- States: Governments participating in the Pall Mall Process already produced a separate code for states last year; the current focus shifts to how those codes and the new industry guidelines will be implemented at national level, and whether mechanisms will be created to track and report progress.
- Victims and rights advocates: Civil society groups continue to press for stronger measures, such as mandatory kill switches, victim notification and remedies, and legally binding procurement conditions — actions they said are necessary beyond the voluntary guidance.
The industry guidelines mark a diplomatic and policy milestone: a multinational attempt to define voluntary norms for commercial cyber intrusion tools. But the record from this week’s meetings is explicit about the work that remains. Negotiators flagged artificial intelligence as an emerging variable; civil society demanded stronger, binding measures; and practitioners warned that national-level implementation currently lacks a coherent tracking or reporting mechanism. The immediate next test will be whether the Pall Mall Process can turn a negotiated compromise into concrete, verifiable steps — and who will be accountable for doing so.
