This report is based on research conducted between November 2024 and February 2026. Human Rights Watch sent freedom of information requests to export license authorities in each of the 27 EU member states, as well as to the European Commission, asking for licensing data as reported by member states to the European Commission for the preparation of the annual report called for by article 26 of the recast Dual-Use Regulation. The language of these requests followed the language of the 2021 Dual-Use Recast, requesting information on export licensing of cybersurveillance items, including the number of applications received by item, destination, and the decision taken on those applications.
Depending on the country, freedom of information requests went to interior ministries, foreign ministries, or other institutions specifically responsible for dual-use export licensing. In most cases where export authorities initially denied access to the requested information, Human Rights Watch exhausted the available national appeals mechanisms for this data.
Human Rights Watch is publishing the data received here, as it was sent by the relevant authorities. Metadata and any personal information have been removed from the documents.
Documents in the "EU annual reports" folder are the annual reports published by the European Commission in the context of its Regulation 2021/821 reporting obligations.
We will continue to request export data from European Union member states and from the European Commission, and will update here as more data becomes available.
The report "Looking the Other Way: EU Failure to Prevent Surveillance Exports to Rights Violators" is available here.
If you have any questions or corrections, would like templates to send your own FOI requests for this or similar data, or have documents to add, please email me, or message me on Bluesky.