Fourteen governments have endorsed new Pall Mall Process guidelines for businesses operating in the commercial cyber intrusion market. The UK and France launched the recommendations in Paris on November 11, extending the initiative’s work from government conduct to industry practices.
According to the UK Foreign, Commonwealth & Development Office, the guidelines aim to discourage irresponsible activity and improve transparency for regulators, suppliers and customers. Endorsing countries include the United States, Germany, Japan and Italy, alongside the UK and France.
The framework follows four principles: accountability, precision, oversight and transparency. It addresses a market spanning companies that develop, sell and use commercial cyber intrusion capabilities, with recommendations intended to clarify responsible business behaviour.
The industry guidelines complement the Code of Practice for States introduced in April 2025. The process began in February 2024; UK ministers subsequently described the industry negotiations as establishing voluntary expectations for participating businesses.
For buyers and suppliers, the publication can serve as a reference when reviewing business relationships and safeguards against misuse. Government endorsement alone does not demonstrate that an individual vendor follows the recommendations.
