The Pall Mall Process Code of Practice for States
This Code of Practice for States was launched at the Second meeting of the Pall Mall Process hosted by the UK and France in Paris 3 to 4 April 2025.
Documents
Details
The UK and France launched the Pall Mall Process in February 2024. This brought together representatives from states, companies and civil society groups who signed the Pall Mall Declaration. This declaration is a non-binding set of guidelines agreeing on the need to progress international action to reduce this shared threat, around the 4 guiding pillars:
- accountability
- precision
- oversight
- transparency
This marked the beginning of the Pall Mall Process – an iterative and ongoing process which aims to establish a framework for responsible behaviour across the market. This includes clear guidelines for those developing, selling and using commercial cyber intrusion tools.
In Autumn 2024 the UK and France ran a consultation, inviting views from stakeholders on good practices relating to constraining irresponsible activity across the cyber intrusion market. We collated the responses around broad themes, and published a summary report.
This multi-stakeholder report was used as the basis for the negotiations for the voluntary and non-binding Code of Practice for States, which the UK and France and others have signalled their support for at this conference.
This multi-stakeholder report was used as the basis for the negotiations for the voluntary and non-binding Code of Practice for States, which the UK, France, and others have signalled their support for at this conference.
The Code of Practice for States sets out commitments for state action in relation to the development, facilitation, purchase, and use of commercial cyber intrusion capabilities (CCICs), against the 4 pillars underpinning the Pall Mall Process. It establishes a set of good practice policy and regulatory recommendations to help ensure states’ use of CCICs in a responsible manner.
This represents an important first step towards the action to shape broader CCIC market, with recommendations across states role as regulators, customers, and responsible users of these tools.
View more:
Updates to this page
-
The Republic of Korea is now a formal supporter of the Code of Practice. Some states' names have been amended to reflect their formal titles.
-
Finland is now a supporter of the Code of Practice.
-
Romania and the United States are now supporters of the Code of Practice.
-
First published.