U.S. Joins Voluntary International Guidelines for Commercial Cyber Tools

The United States has joined voluntary industry guidelines developed through the Pall Mall Process, a U.K.- and France-led initiative focused on commercial cyber intrusion capabilities (CCICs), including spyware. The industry guidelines are the initiative’s second step, following a code for nations issued the previous year. The U.K. and French foreign ministries said the guidelines aim to “disincentivise irresponsible activity” in the CCIC market, improve transparency for regulators, vendors, and customers, and provide clarity for companies operating within or adjacent to the industry. For government contractors, the announcement is a market and risk signal—not a new procurement action.

The guidelines rest on four pillars: compliance with regulations and norms, due diligence, risk management, and monitoring of compliance. Their recommendations include following applicable export controls, establishing a risk-assessment process, using technical access controls such as encryption, and continuously observing who can use these capabilities. These practices are relevant to agencies and suppliers that develop, sell, integrate, or handle commercial cyber tools. However, the framework is voluntary: it does not establish a mandatory compliance deadline, binding solicitation language, or a new regulatory requirement.

The outcome reflects competing perspectives among states, industry, academia, ethical hackers, and civil society. **Natalia Krapiva**, senior tech-legal counsel at **Access Now**, said civil society had advocated for stronger measures, including mandatory technical kill switches, greater transparency, and more robust due-diligence requirements. She added that advocates would continue working with the process to limit the uncontrolled proliferation and misuse of cyber intrusion tools, including spyware. **Gayatri Khandhadai** of the **Business and Human Rights Centre** likewise argued that the guidelines fall short of what is needed to hold the industry accountable, pointing to concerns about companies’ adherence to international human rights responsibilities and the U.N. Guiding Principles on Business and Human Rights.

For procurement and market planning, the central distinction is between voluntary guidance and enforceable acquisition conditions. Khandhadai called for clear limits on use, binding conditions in public procurement, supply-chain scrutiny, victim notification and remedy, and a shift from voluntary guidance to enforceable law. Those are advocacy positions, not requirements created by this announcement. Nonetheless, agencies and contractors can use the guidelines to review supplier due diligence, export-control practices, access safeguards, and monitoring, while tracking whether governments later translate the framework into regulations or solicitation terms. The source identifies no solicitation, award, contract, funding amount, or implementation and reporting mechanism; those mechanisms remain unresolved.

• The United States joined voluntary Pall Mall Process industry guidelines for commercial cyber intrusion capabilities, including spyware.
• The initiative is led by the United Kingdom and France; the industry guidelines follow a code for nations released the previous year.
• Four pillars guide the framework: regulatory and norms compliance, due diligence, risk management, and compliance monitoring.
• Recommendations include complying with export controls, conducting risk assessments, applying technical access controls such as encryption, and monitoring who can use cyber capabilities.
• The guidelines do not create binding procurement requirements, a mandatory deadline, or a new regulation.
• Access Now’s Natalia Krapiva cited calls for mandatory technical kill switches, stronger transparency, and more robust due diligence.
• The Business and Human Rights Centre called for binding public-procurement conditions, supply-chain scrutiny, victim notification and remedy, and enforceable law; these remain advocacy proposals.
• Agencies and contractors can assess supplier diligence, export-control processes, access safeguards, and monitoring now, while distinguishing voluntary guidance from binding terms.
• No solicitation, contract, award, funding opportunity, or resolved implementation and reporting mechanism is identified; this is a risk-planning signal rather than an immediate bid opportunity.