EU's New Export Due Diligence Guidelines: Keeping Tabs On Cyber-Surveillance Technology

In 2021, the EU adopted an updated version of the EU Dual-Use Regulation, which establishes common standards for the control of dual-use item exports by EU member states. Among its new provisions, Regulation (EU) 2021/821 introduced, in its Article 5, a "catch-all control" for cyber-surveillance items.

That catch all provision requires exporters to obtain approval when they know or suspect that their cyber-surveillance items could be used in connection with human rights violations, even if these items are not specifically covered by existing export controls. Items like telecommunication interception systems (5A001.f.), internet surveillance systems (5A001.j.), intrusion software (4A005, 4D004), and forensic tools (5A004.b., 5D002.a.3.b., 5D002.c.3.b.) are examples of technologies falling under these controls.