Regulating Dual-Use Technologies: Assessing the Effectiveness of EU Export Controls in Protecting Human Rights
Updated: Sep 17
The rise of dual-use technologies, including spyware, artificial intelligence, and cyber-surveillance tools, created new opportunities for human rights violations within and beyond the European Union (EU). These technologies are particularly challenging to regulate because, while designed for legitimate civilian purposes, they can also be used by repressive regimes and terrorists to enable surveillance, repression, and other violations of fundamental human rights. This raises an important question: to what extent is EU export control law, specifically Regulation (EU) 2021/821, effective in preventing human rights violations arising from the misuse of dual-use goods? Regulation 2021/821 establishes a legal framework for controlling the export of dual-use items and has to some extent strengthened the protection of human rights within the EU’s foreign policy. However, its effectiveness remains limited by the rapid development of emerging technologies, fragmented enforcement across Member States, and the Regulation’s ambiguous definitions of cyber-surveillance and cybersecurity-related technologies. Overall, while the EU has established an important legal framework, there are still challenges in ensuring that it works effectively in practice.
The former EU dual-use regulation, Regulation 428/2009, primarily focused on preventing the spread of Weapons of Mass destruction (WMD) and controlling the exports of military-related dual-use goods. It relied on international export control regimes, such as the Wassenaar Arrangement, to determine which technologies required export licences. At the time, cyber-surveillance technologies were largely absent from international control lists. Therefore, many European surveillance technologies that were developed after this regulation were not monitored and could legally be exported even when there was clear evidence that they were being used to violate human rights. For example, in the early 2010s, numerous investigations led to the discovery of European-made surveillance technologies exported to governments such as Egypt, Bahrain, Ethiopia, Myanmar, and the United Arab Emirates, where they were allegedly used for repression and torture. In 2016, the European Commission proposed a new revision of the Regulation, which recognised that exports of cyber-surveillance technology could severely threaten privacy, freedom of expression, freedom of association, and the right to life. After negotiations between the Commission, Parliament, and the European Council, Regulation 2021/821 entered into force on 9 September 2021.
One of the most significant innovations of the new Regulation was its shift from a primarily security-based approach to a broader approach that also included a focus on human security. The recast recognises that dual-use technologies can threaten individuals’ fundamental rights even when they do not pose a threat to national security. Accordingly, it broadens the objectives of export controls to recognise that certain technologies may be used to facilitate human rights violations. This is particularly visible in Annex I, which contains a range of newly added items, reflecting the changing scope of dual-use export controls. The Regulation also incorporates human rights considerations into its recitals and its substantive provisions, portraying a shift towards including human security into the EU’s export-control system.
The recast also provides updated guidelines in relation to the Regulation, including on export authorisations and licences. Export authorisations are required for dual-use items listed in Annex I and, in some cases, for items that are not listed but fall under the Regulation’s ‘catch-all’ provisions. Dual-use items can be divided into three categories: items listed in Annex I, items included on Member States’ national control lists, and items that are not listed but are subject to ‘catch-all’ controls. Chapter III of the Regulation, which includes Articles 12, 13, 14, 15, and 16, sets out several types of authorisations, including individual, global, national general, and Union general export authorisations. Individual and global authorisations are granted by national authorities and require exporters to provide information about the destination, end user, and intended use of the goods. Union general export authorisations allow exporters to export certain items to approved destinations as long as the required conditions are met. Finally, national general authorisations are issued by individual EU states and allow certain dual-use items to be exported to specified destinations without requiring an individual licence for each export. Importantly, authorisations are granted by national export control authorities rather than the European Commission. This means that Member States are responsible for assessing applications and can refuse, suspend, or revoke authorisations.
These new legal measures are becoming increasingly important as emerging technologies are changing the relationship between export controls and human rights protection. Human Rights Watch identifies cyber-surveillance technology as a key example of how dual-use goods can be used to facilitate human rights abuses. Software originally developed for lawful interception, counter-terrorism, or law enforcement purposes has repeatedly been used by governments to monitor journalists, human rights defenders, and political opponents. Rather than being limited to legitimate policing purposes, these technologies can undermine democratic institutions and expose individuals to physical harm.
The EU’s position in this market further increases the risk. Human Rights Watch notes that most EU Member States host at least one surveillance technology company, meaning that the EU is not only regulating the export of dual-use technologies but is also a source of technologies that can be used for repression abroad. For example, the German company Gamma International’s FinFisher spyware, which was marketed as a lawful-interception tool, was reportedly used by governments in Egypt, Bahrain, and Myanmar in 2013. In 2014, Human Rights Watch documented the use of the Italy-based Hacking Team’s Remote Control System by the Ethiopian government. More recently, in 2021, four executives of the French company then known as Amesys were indicted in France for alleged complicity in acts of torture linked to the use of its surveillance technology in Libya and Egypt. These cases show the difficulty of regulating technologies that may appear legitimate at the point of export but can later be used for repressive purposes.
These examples also highlight a broader problem with the concept of ‘dual use’ related to cyber-surveillance technologies. Whether a technology has both civilian and military or security applications does not, by itself, determine whether its use is legitimate. The same technology can be used for legitimate purposes or to commit human rights abuses, which makes information on the end user particularly important. In fact, spyware has been misused not only by governments with poor human rights records, but also in established democracies, including Spain and Greece. Therefore, the focus should be placed on the end use, end user, and destination of the technology. These factors are ultimately more important in determining whether an export will contribute to human rights abuses.
AI technologies present a similar challenge. As SIPRI argues, the same AI software can be used for civilian, military, or security purposes. Moreover, features such as pattern recognition, prediction, and decision-making do not determine how the system will ultimately be used. Instead, the risk often depends on its application, which can change after export without the developer’s knowledge or consent. This creates a challenge for traditional export controls, which often rely on identifying specific technical characteristics at the point of export. The problem is particularly clear with general-purpose AI systems, which are designed for a wide range of applications and are often sold as commercial products. All in all, export controls cannot rely solely on the characteristics of a dual-use technology, but must also take into account its end use, end user, and destination.
Regulation 2021/821 seeks to address these challenges by moving beyond Annex I to safeguard human rights. Firstly, Article 4 provides the Regulation’s ‘catch-all’ template, indicating that authorisation is required for items that are not listed in Annex I but are intended for WMD-related purposes or other unauthorised military end-uses. This can be triggered when the competent authority informs the exporter under Article 4(1), or when the exporter is aware of the intended use under Article 4(2). Article 5 applies this catch-all mechanism to non-listed cyber-surveillance items where there is a risk of internal repression or human rights violations. As SIPRI attests, Article 5 also places greater responsibility on exporters. Rather than relying only on national authorities to identify these risks, exporters are expected to carry out due diligence by considering the end user and intended use of their products. If this due diligence shows that a non-listed item may be intended for internal repression or human rights violations, the exporter must notify the competent authorities. The Article also provides for information sharing between Member States and the protection of sensitive information.
Article 9, rather than being triggered by a specific concern about an item’s intended use, allows Member States to unilaterally prohibit or control the export of unlisted items on broader human rights grounds. This includes a transparency requirement, in which Member States must notify the Commission and other Member States of the measure and its reasons, while the Commission maintains an updated list of national controls. Finally, Article 10 extends national controls across the EU by requiring authorisation when another Member State raises concerns about an item on its national control list. Therefore, it links national controls to a case-specific notification system, while requiring Member States to share authorisation requirements with the Commission and other Member States. This helps prevent exporters from avoiding national restrictions by sending exports through another Member State.
Transparency remains a key theme throughout the Regulation. Article 15, for example, requires Member States to consider the ‘intended end use’ of the product, taking into account ‘all relevant considerations’. Human rights concerns also appear indirectly through Article 15(1)(c), which refers to the EU’s Common Position 2008/944/CFSP on arms exports. This framework includes respect for human rights in the country of final destination as a key criterion, even though it applies to conventional weapons rather than dual-use items. Article 26(2) also improves transparency by requiring the Commission to publish an annual report on authorisations and prohibitions, broken down by item type and destination. For cyber-surveillance items, the reporting requirements are more detailed, including information on issuing Member States and destinations, reflecting concerns about the human rights risks of spyware exports. Overall, these provisions show that transparency and human rights are built into the Regulation, yet their effectiveness ultimately depends on how consistently exporters follow these guidelines.
In practice, the Regulation presents several weaknesses. The first is that technological development remains faster than the legal framework used to regulate it. AI and cyber-surveillance technologies are constantly changing, making it difficult for export controls to keep up with new forms of technology. Although Article 5 aims to control non-listed cyber-surveillance items, its effectiveness depends heavily on exporters identifying and reporting potential risks. Although the notification duty itself is legally binding, the weakness lies in how this awareness is established. The Commission’s due diligence guidelines are a non-binding Recommendation, so exporters are encouraged, but not legally required, to follow a specific due diligence process. Human Rights Watch notes that national authorities mainly completed general compliance procedures rather than detailed pre-export checks, while several major exporting states provided little information on how these checks were carried out. Similarly, interviews conducted by the Centre for Democracy and Technology Europe found that formal notifications requiring authorisation were rare. This suggests that while Article 5 creates a binding mechanism for controlling unlisted cyber-surveillance exports, its effectiveness is limited by the non-binding due diligence process that is supposed to identify the risks in the first place.
The second weakness is the fragmented enforcement of EU rules. Although Regulation 2021/821 applies across all Member States, export controls are enforced by national authorities rather than by a central EU body. Export licence applications are assessed by different authorities across the 27 Member States, which can lead to differences in how the same laws are interpreted and applied. Research by the Centre for Democracy and Technology Europe found several differences between Member States in reporting licensing data and human rights assessments. While some states publish relatively detailed export information, others provide little or no systematic public reporting, while information sharing between Member States also remains incomplete. This fragmented enforcement makes it harder for the Regulation to create a consistent EU-wide approach to protecting human rights regarding dual-use exports.
A third weakness is the difficulty of defining what counts as a ‘cyber-surveillance item’ under the Regulation and the use of legally ambiguous terms more generally. The European Commission’s 2024 guidance defines these items as technologies mainly designed to secretly monitor individuals through the collection or analysis of data from information and communication systems. However, as has been established earlier in this paper, many digital technologies have both legitimate commercial uses and potential surveillance capabilities, making it difficult for exporters to determine whether an item falls under Article 5 and requires an export authorisation. This leads back to the research by the Centre for Democracy and Technology Europe, which suggests that Article 5 has been used to a limited extent in practice. If Article 5 is rarely triggered, its ability to prevent the export of cyber-surveillance technologies that may be used to facilitate human rights abuses is significantly limited.
Several reforms could address these issues. The effectiveness of EU export controls ultimately depends on international cooperation. The EU should therefore continue strengthening its ties with partners participating in multilateral export control regimes, particularly the Wassenaar Arrangement. Greater transatlantic coordination between the European Union, the United States, the United Kingdom, Canada, Japan, and South Korea would also promote positive change. Moreover, stronger cooperation would make export controls more effective by reducing differences between state interpretations, particularly through transparency reports. Accordingly, exporters should be required to submit regular standardized reports demonstrating that exported technologies continue to be used consistently with the legal conditions under which export licences were granted. The EU should also introduce more innovative mechanisms for updating Annex I, allowing new technologies to be reviewed more rapidly.
EU export controls and regulation should consequently be understood as important but incomplete tools of human rights protection. Their legal significance lies in the EU’s recognition that technologies developed for legitimate civilian purposes can also become instruments of serious human rights violations. Ultimately, their effectiveness will depend on whether the EU can turn these laws into effective enforcement that keeps up with rapid technological change.
