Overview
- The European Commission proposed revisions to the Cybersecurity Act that would make exclusion of high-risk suppliers mandatory across 18 critical sectors, extending well beyond telecoms.
- Mobile operators would have up to 36 months to remove key components from listed vendors once an EU high-risk list is published, with timelines for fixed and satellite networks to follow.
- Restrictions would activate only after a formal assessment initiated by the Commission or at least three member states, and measures must be backed by market and impact analyses.
- The text does not name companies or countries, yet it is widely viewed as targeting Chinese firms such as Huawei and ZTE based on prior EU guidance and actions.
- China’s foreign ministry and Huawei criticized the plan as protectionist, while European telecom groups warned of multi‑billion euro costs as the proposal heads to Parliament and member states for approval.