The UK and France released voluntary guidelines for companies that make and sell commercial hacking tools, such as spyware. The UK government said they were launched at a conference in Paris on 11 November 2026. CyberScoop reported that the United States signed on this week. The guidelines rest on four pillars: following rules and norms, due diligence, managing risk and monitoring compliance. CyberScoop says they advise firms to follow export controls, assess risks, limit access with tools such as encryption, and keep watching who can use the products.
The guidelines are not law. Rights groups told CyberScoop they fall short. Natalia Krapiva of Access Now said civil society wanted mandatory technical kill switches, more openness and stricter checks. Gayatri Khandhadai of the Business and Human Rights Centre said the outcome is not enough and called for enforceable law. Allison Pytlak of the Stimson Center said the final text gives human rights more weight than earlier drafts. How the rules will be put into practice is not yet settled. CyberScoop names only the United States as a signatory.
Teams that build or buy security software get a clearer view of what governments expect from this market: export checks, due diligence and controlled access. Because the guidelines are voluntary, any effect depends on firms and states choosing to apply them.