Governments Adopt Guidelines for Commercial Hacking Firms
Fourteen governments endorsed non-binding guidelines aimed at curbing abuses tied to commercial cyber intrusion capabilities.
Updated on Nov. 11, 2026 in Cybersecurity
Live Poll
Should governments require companies selling phone-hacking tools to face penalties for misuse?
Fourteen governments participating in the Pall Mall Process adopted first guidelines for commercial hacking businesses on Wednesday. The non-binding measures, endorsed by governments rather than industry groups, carry no penalties for non-compliance.
Why it matters
The guidelines seek to discourage irresponsible activity across the market for commercial cyber intrusion capabilities and improve transparency for regulators, vendors and customers. Fewer than half of the 43 countries attending the third conference signed on to endorse them.
The guidelines ask businesses to vet customers, establish technical safeguards against misuse, and maintain systems for monitoring and reporting abuses, with companies asked to halt sales and support when serious misuse is a credible risk. Their non-binding status means compliance rests entirely on voluntary adherence rather than technical enforcement mechanisms.
The players
Pall Mall Process
A multistakeholder initiative launched in London in 2024 to address the proliferation of commercial cyber intrusion capabilities, co-led by the United Kingdom and France.
United Kingdom
A co-leader of the Pall Mall Process and a signatory to the new guidelines, with a long-standing role in international cybersecurity policy.
France
A co-leader of the Pall Mall Process and a signatory to the new guidelines, active in European and international cyber governance.
The details
The guidelines, adopted at the Pall Mall Process conference, target abuses associated with commercial cyber intrusion capabilities (CCICs). Businesses are also asked to consider remedies for victims of human rights abuses, and the framework does not impose penalties for non-compliance.
Timeline
Pall Mall Process launched in London in 2024.
Last year, the conference produced the first code of practice for governments.
Wednesday, November 11, 2026: fourteen governments adopted the commercial hacking guidelines.
The Tech Race
The business guidelines extend the Pall Mall Process code of practice for governments, which 27 countries have signed since last year's conference, by applying the same voluntary approach to the firms that build and sell commercial hacking tools. Because the framework is non-binding, its effect depends on whether governments that buy and license these tools choose to enforce it.
For users, the guidelines do not change how commercial hacking tools behave today, since they carry no penalties and depend on voluntary compliance by businesses. Their practical effect will show up only if participating governments make licensing and export decisions that enforce the vetting and misuse-halting measures.
The takeaway
Voluntary frameworks can set expectations for the commercial hacking industry, but their real weight depends on whether governments that buy these tools are willing to enforce them.
Further reading
For broader context on threats and policy in this area, explore Cybersecurity coverage on Wisevoter.
Source note: This article includes information reported by Therecord.
Live Poll
Should governments require companies selling phone-hacking tools to face penalties for misuse?
