CDT Europe Urges EU to Close Gaps in Spyware Export Rules

What CDT Europe is asking for

According to CDT Europe, the revised Dual-Use regulation of 2021 was an important step toward stopping surveillance technologies developed and exported from Europe from facilitating human-rights abuses. Yet the organisation says serious questions remain about whether the framework can work in practice. Its submission calls for stronger implementation of existing safeguards and for fixes to structural weaknesses in the legal framework.

The submission builds on CDT Europe's research, From Export Control to Unknown Exports: How the EU's Dual-Use Regime Falls Short on Tackling Spyware. The study looked at how the Regulation is applied in France, Germany, Italy and the Netherlands. It identified significant differences in national licensing practices, fragmented due-diligence expectations, limited post-export monitoring and insufficient transparency over surveillance exports.

CDT Europe stresses that the human-rights protections introduced in 2021, particularly through Article 5, must be preserved and strengthened.

Definitions, due diligence and licence refusals

The first of five priorities concerns the definition of cyber-surveillance items in Article 2(20), which covers technologies specially designed to enable covert surveillance. CDT Europe says these requirements can limit the reach of the Regulation's safeguards for non-listed technologies. The Commission's 2024 Guidelines add interpretation and examples, but in the group's view they cannot overcome limits built into the legal definition. As surveillance capabilities become more integrated into broader systems, the EU must assess whether the framework captures technologies posing serious human-rights risks.

The second priority is Article 5's catch-all mechanism. Article 5 (1) lets authorities require authorisation for non-listed cyber-surveillance items that are or may be intended for internal repression or serious violations of human rights or international humanitarian law. CDT Europe says this depends on Member States having the information, technical expertise and resources to spot high-risk transactions. Article 5 (2) relies on exporters notifying authorities, which raises what the group calls a fundamental concern: how far a framework meant to prevent abuses should depend on commercial surveillance vendors identifying and disclosing risks in their own deals. Exporter due diligence, it argues, cannot substitute for independent regulatory scrutiny.

CDT Europe also says the 2024 Guidelines stress transaction screening, intended end use, destination risks and red flags, but do not set systematic obligations to verify how technologies are actually used after export. It calls for effective post-export end-use monitoring and mechanisms to respond to credible allegations of misuse.

The third priority is clarity on when human-rights risks must lead to refusal of an export licence. Article 15 requires Member States to take relevant considerations into account, including those in the EU Common Position on military technology exports, but CDT Europe says it does not establish a general, explicit obligation to refuse a licence once a defined threshold of serious risk is met. The Common Position's binding denial criteria do not extend to all non-listed cyber-surveillance items controlled under Article 5. The group points to the European Parliament's 2023 PEGA recommendations, which called for amending Article 15, and urges the Commission to revisit them.

Intra-EU transfers and transparency

The fourth priority targets transfers within the EU. CDT Europe says the Regulation controls exports to third countries but sets no equivalent general authorisation requirement for transfers of spyware and related technologies between Member States. Licensing for intra-EU transfers is limited to a small subset of sensitive goods listed in Annex IV, such as cryptanalytic tools, most nuclear-related items, stealth-related technology and items related to missiles and chemical warfare. Cyber-surveillance items are not on that list, despite being high-risk for public security, according to the group.

The organisation links this gap to mounting evidence of spyware abuse within the Union and to complex corporate structures. Vendors may operate through subsidiaries, affiliates and intermediaries across several jurisdictions, making it hard to trace how technologies move and who is responsible, and the Regulation requires no mandatory disclosure of exporters' corporate structures. CDT Europe says this can create opportunities for regulatory arbitrage. It asks the Commission to assess proportionate safeguards for intra-EU transfers and stronger requirements for licensing authorities to obtain and share information on the companies involved.

The fifth priority is making export-control decisions more transparent and accountable. The published text breaks off while explaining this point, but CDT Europe states that insufficient transparency makes it difficult to assess whether the Regulation's human-rights safeguards work.

What it means

The submission feeds into the Commission's evaluation of the Regulation, so its proposals are recommendations rather than binding changes. For the spyware industry and national licensing authorities, the message from CDT Europe is that the current rules leave room for uneven enforcement, reliance on vendors' self-assessment and weak oversight of how exported tools are used.