To: Commissioner Maroš Šefčovič, European Union Commissioner for Trade and Economic Security
Re: Response to the open public consultation on the evaluation of the 2021 Dual-Use Regulation
Dear Commissioner Šefčovič,
We, the undersigned human rights organizations, are writing in response to the European Commission’s open public consultation and call for evidence, as part of its evaluation of the 2021 Dual-Use Regulation (EU Regulation 2021/821). The undersigned organizations wish to express concern at the increasing number of harmful exports of surveillance technology by EU member states to destinations where there is a real risk they will be used to violate rights. We call on the European Commission to use this evaluation as an opportunity to strengthen export controls for listed and unlisted cybersurveillance items, as defined by the Regulation, in order to fulfil its promise to prevent the export of these technologies to countries where they could be used to perpetrate or contribute to human rights violations.
In doing so, we call on the European Commission to include in its evaluation of the Regulation an assessment of the Commission’s own implementation of the Regulation as relates to cybersurveillance items, which is largely carried out through two guidelines, Commission Recommendations 2024/214 and 2024/2659, published in January and October 2024, respectively. While the 2021 Dual-Use Regulation does not go far enough to prevent harmful exports of surveillance technology, the European Commission's implementation of the Regulation through the terms of these two guidelines documents, which detail the implementation of many provisions of the Regulation as relates to the export of surveillance technology, as well as the fragmented implementation of the Regulation across Member States, further compound these issues.
At the time the 2021 recast of the Dual-Use Regulation was adopted, civil society organizations, many of which are signatories to this letter, raised concerns that it did not go far enough in preventing EU member states from exporting surveillance technology that risks human rights violations. When the Regulation came into effect in September 2021, many of those same organizations noted that language outlining human rights considerations, definitions establishing the types of surveillance technologies to be regulated, and due diligence language for private companies would all do little to control harmful exports.
EU and member state data since then shows abundant exports of surveillance technology to countries where a considerable risk exists of the technology being used for internal repression and other human rights violations.
Commission Guidelines Undercut the Regulation
The 2021 Dual-Use Regulation requires the Commission to develop guidelines “for best practices to support practical application of controls,” and “to ensure the efficiency of the Union export control regime and the consistency of its implementation,” as well as to periodically update those guidelines to support the application of the Regulation.
The two guideline documents so far published, while legally nonbinding, are the vehicles through which the Commission has interpreted key elements of EU Regulation 2021/821 and set out how EU member states should apply the regulation. They outline key issues for member states to consider as relates to the processing of export licenses for surveillance technology: human rights considerations, due diligence practices, transparency requirements, as well as decisions over which categories of technology require an export license.
The 2021 Dual-Use Regulation established three important regulatory and transparency norms in the EU specific to these export licenses:
- Using a definition that centers a technology’s potential for harm, the new regulation expanded what types of cybersurveillance exports are regulated, including through a provision known as the “catch-all” clause for surveillance technologies that would not normally require an export license.
- Making explicit the need for exporting EU countries to consider the human rights record of recipient countries when considering an export license application, based on criteria included in the EU Common Position.
- Creating a public reporting responsibility for the European Commission, requiring the Commission to collect data from EU member states on the exports of certain types of surveillance technologies, with the potential to provide essential information for EU exporters, civil society and the general public about exports of surveillance technology.
While Regulation 2021/821 requires these elements, the guideline documents published by the European Commission in 2024 to assist member states in ensuring their exports comply with it have exacerbated the following problems:
- Commission Recommendation 2024/2659, which provides guidelines that define the specific types of surveillance technology that are categorized and controlled by the Regulation only address human rights and due diligence provisions of export licensing as relates to unlisted cybersurveillance items that are captured by the catch-all clause. The human rights considerations related to the export of listed technology is not addressed, increasing the risk that surveillance technology could be exported to destinations where there is a real risk it will be used for internal repression or human rights violations.
- Commission Recommendation 2024/214, which provides guidelines on transparency reporting significantly limits the member state reporting and the related transparency requirements related to exports of surveillance technology that are mandated by the 2021 Dual-Use Regulation, which severely limits the information available to civil society, journalists, exporters and the general public about exports of surveillance technology.
Recommendations
There is growing evidence that digital surveillance technology continues to be exported from the EU to countries where it has been used to violate human rights. This evaluation should prioritize protecting the positive aspects of the 2021 Recast and further strengthening enforcement through better guidance. The European Commission should prioritize revising its guidelines to strengthen the human rights standards, due diligence provisions, and transparency reporting to protect against harmful exports of surveillance technology, following the letter and spirit of the 2021 Dual-Use regulation.
We urge the Commission to consider the following:
Strengthen human rights standards for surveillance exports
The 2021 Dual-Use Regulation states that export regulators should consider the risk of surveillance exports being used in connection with internal repression and other human rights violations. Similarly, the Council Common Position 2008/944/CFSP states that Member states shall deny export licenses for dual-use technology where there is a risk it might be used for internal repression.
- The Commission should issue updated or revised guidelines that further strengthen these protections for both listed and unlisted surveillance technology, as well as clarify accountability measures for states if they chose to provide a license while red flags have been raised.
Align demands for meaningful human rights due diligence
- The Commission should revise sections of Commission Recommendations 2024/214 and 2024/2659, that relate to respecting human rights obligations in the context of dual-use licensing and due diligence, so they align with due diligence standards as defined in the Corporate Sustainability Due Diligence Directive (CSDDD - (EU) 2024/1760). The revised guidelines should also define criteria to apply to all applications to export cybersurveillance technology, listed or not, from EU member states and clarify which are mandatory under EU Regulations.
- To ensure a level-playing field, updated guidelines should incentivize all EU member state exporters of surveillance technology (regardless of whether or not they are under the scope of the CSDDD) to undertake a meaningful due diligence process that includes a thorough assessment of the risk that their product would be used to facilitate or contribute to violations of international human rights and humanitarian law and recommend that the process and findings be published.
- This revision should also require exporters to expressly notify member states of listed cybersurveillance items if they identify risk or find evidence of possible misuse through their due diligence process and clarify accountability measures for state if they chose to provide a license while red flags have been raised.
Ensure surveillance technology controlled under the Regulation is up to date
- The Commission should carry out a periodic and transparent review of what it designates as “cyber-surveillance items,” based on data reported from member states, and including input from civil society organizations, security researchers, private industry and national export regulators.
- Taking into account the developing technological and regulatory landscape around surveillance technologies, the Commission should clarify the alignment of the Dual-Use regulation with other relevant Union legislation, such as the EU’s Artificial Intelligence Regulation (AI Act). Notably, technology that is prohibited in the EU and/or whose use is found to be incompatible with human rights should not be exported outside the bloc.
Expand protections of the catch-all clause
- The "catch-all clause," as currently established by Article 5 of the 2021 Dual-Use Regulation and as implemented by Commission Recommendation 2024/2659, places too much reliance on exporter-triggered due diligence under Article 5(2), while the proactive authority-led mechanism under Article 5(1) remains insufficiently operationalized and its use is not transparent. The Commission should publish stronger and dedicated guidance enabling competent authorities to proactively identify and scrutinize non-listed cyber-surveillance exports, while the evaluation should also assess whether Article 5(2)’s exporter-knowledge threshold is too high and whether the optional nature of Article 5(3) creates inconsistent protection across Member States.
Provide real transparency over exports
- The Commission should update guidelines on transparency reporting on exports of dual use surveillance technology (Recommendation 2024/214) with input from stakeholders. At a minimum the guidelines should:
- Require member states to report the number of license applications for both listed and unlisted technology, with at least the following information per application: the exporter name, a description of the end user and destination, the value of the license, and whether the license was granted or denied and the reasons why.
- Establish explicitly that the reported information described above is proactively made public and can be provided in response to transparency requests, and that the information is not subject to article 4 exemptions under EU Regulation 1049/2001.
Push for remedy at a member state level
- The Commission should provide guidance to member states to ensure that exporting countries establish mechanisms to provide effective remedy for human rights violations committed using the transferred technology. These guidelines should detail requirements for internal compliance programs and due diligence that is expected from exporters under the Dual-Use Regulation based on the United Nations Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises.
Signatories:
- Access Now
- Amnesty International
- Centre for Democracy and Technology Europe
- Committee to Protect Journalists (CPJ)
- Data Rights
- Human Rights Watch
- Privacy International
- SMEX
- 7amleh - The Arab Center for the Advancement of Social Media.
From Export Control to Unknown Exports: How the EU’s Dual-Use Regime Falls Short on Tackling Spyware, December 4, 2025, https://cdt.org/insights/cdt-europe-report-eu-export-controls-are-failing-to-address-the-spread-of-spyware/
Human rights organizations call to strengthen the European Commission position on dual-use recast, June 9, 2020, https://www.accessnow.org/press-release/human-rights-organizations-call-to-strengthen-the-european-commission-position-on-dual-use-recast/.
New EU Dual Use Regulation agreement ‘a missed opportunity’ to stop exports of surveillance tools to repressive regimes, March 25, 2021, https://www.amnesty.org/en/latest/news/2021/03/new-eu-dual-use-regulation-agreement-a-missed-opportunity-to-stop-exports-of-surveillance-tools-to-repressive-regimes
EU: Robustly Implement New Export Rules for Surveillance Tech, September 8, 2021, https://www.hrw.org/news/2021/09/08/eu-robustly-implement-new-export-rules-surveillance-tech.
“Looking the Other Way: EU Failure to Prevent Surveillance Exports to Rights Violators, May 12, 2026, https://www.hrw.org/report/2026/05/12/looking-the-other-way/eu-failure-to-prevent-surveillance-exports-to-rights.
Preamble (20,34), Article 26(1), Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (recast)
