14 Governments Adopt First Voluntary Conduct Guidelines for Commercial Spyware Firms Under Pall Mall Process
The Pall Mall Process has now produced two voluntary codes in two years — one for governments in 2025, one for industry in 2026 — without a compliance mechanism in either.
If signatory governments do not translate the guidelines into export control conditions within their existing licensing regimes, the code functions as a reputational floor for firms that were already operating responsibly, while leaving the market for tools linked to journalist and activist surveillance structurally unchanged.
The French Foreign Ministry's framing of this as 'the first global standard' will be tested the next time a Pall Mall signatory approves an export to a government with a documented surveillance record.
Enforcement pressure falls entirely on government procurement and export licensing desks, not on any international body, which means the guidelines bind only the firms whose home governments signed — leaving vendors in the 29 non-signatory states at the conference free to operate without even the reputational cost of non-compliance.
The US, UK, France, Germany, Italy, and Japan collectively represent the largest buyers and exporters of commercial intrusion tools, so their coordinated signal to domestic vendors on customer vetting and misuse reporting is the mechanism with real market weight. The next test is whether any signatory government denies an export license citing these guidelines — that would be the first observable enforcement act.
Which specific commercial spyware vendors attended the third conference, and did any of the firms previously linked to abuses — NSO Group, Intellexa, or Paragon — participate or endorse the guidelines?
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.