The European Commission, under the leadership of new executive vice-president Henna Virkkunen, presented on Tuesday a draft amendment to the Cyber Security Act, which turns the previously voluntary approach into tough legal requirements. For European telecoms and technology businesses, this marks the start of a costly race against time. The main target of the new regulations – although no name is mentioned in the document – are Chinese tech giants such as Huawei and ZTE.
Brussels is proposing a radical expansion of the definition of critical infrastructure. The new framework will cover as many as eighteen key areas, going far beyond just telecommunications. The list includes energy management systems, water infrastructure, cloud computing, as well as sensitive sectors such as medical devices, drones or space technology, among others. The mechanism for action is absolute: if, after a formal risk assessment initiated by the Commission or at least three Member States, a provider is deemed ‘high risk’, mobile operators will be given 36 months to completely remove its key components from their networks.
For the telecoms industry, this is a wake-up call. The Connect Europe association, which represents the continent’s largest operators, is already warning of billions of euros in compliance costs that could slow down investment in modern networks. EU officials argue, however, that the price of ‘technological sovereignty’ is necessary to pay in the face of rising ransomware attacks and espionage threats. Europe is clearly correcting its course, moving closer to the position of the United States, which has already blocked the approval of new equipment from Huawei and ZTE in 2022.
Beijing’s reaction was immediate. A spokesperson for the Chinese Foreign Ministry called on the EU to abandon the protectionist path and Huawei, in a sharp statement, accused the Commission of violating World Trade Organisation (WTO) rules. The Chinese conglomerate stresses that the evaluation of suppliers should be based on hard technical evidence and not on country of origin. Despite these protests, the political climate in Europe is thickening. Germany, hitherto reticent, has already set up an expert commission to review trade relations with China and has excluded Chinese components from future 6G networks.
Before entering into force, the draft must go through negotiations with national governments and the European Parliament. However, given the current geopolitical climate, European business should already be preparing scenarios to diversify their supply chains without waiting for the final signature of the law.
