EU governments have removed a proposed 36-month deadline for mobile operators to phase out equipment from suppliers deemed high risk. The replacement timetable now depends on a list of practical considerations. The decision sits inside the Brussels apparatus: the European Commission proposed the measure, governments amended it, and EU lawmakers must still negotiate the revised Cybersecurity Act before it can become law.
The September 22 document, seen by Reuters, says the phase-out period should depend on the identified level of risk, product and infrastructure lifecycles, equipment replacement cycles, interoperability requirements, and whether suitable alternatives are available. The fixed deadline is gone. The state’s power to determine which suppliers count as high risk remains at the centre of the proposal.
Security by decree, timetable by negotiation
In January, the European Commission proposed phasing out components and equipment from high-risk suppliers in critical sectors as part of an overhaul of the EU Cybersecurity Act. The measure would mainly affect Huawei and other Chinese technology companies. Europe has tightened scrutiny of Chinese technology following cyber and ransomware attacks, amid growing concerns about foreign espionage. Those are the stated grounds for scrutiny; Huawei denies its equipment poses a security risk.
The deadline has now given way to factors that leave room for a longer transition. The document sets no new final date. It says the timetable should reflect risk levels, replacement cycles, infrastructure lifecycles, interoperability, and the availability of alternatives. Governments’ amendment changes the proposed pace, but it doesn't change the underlying plan to phase out equipment from suppliers deemed high risk.
The proposal isn't law yet. EU countries must negotiate it and any amendments with EU lawmakers before the revised Cybersecurity Act can take effect. Brussels sets the proposal in motion; governments alter its terms; lawmakers still have a role. For operators, the immediate question is how long replacement will take and who pays.
Billions at stake for telecom companies
The industry has warned that replacing the equipment could cost as much as €40 billion ($45 billion). In a joint letter earlier this month, Deutsche Telekom Chief Executive Timotheus Höttges and 16 industry peers said costs of up to €40 billion risk draining capital needed for fibre, 5G, and 6G investments.
That's the corporate argument presented to governments: money used to replace equipment, they say, is money unavailable for other network investment. Their letter puts the price tag squarely into the policy debate, while the proposed rules place the final choice of suppliers within a state-led security framework. The document offers no new cost figure and no account of who would absorb the expense beyond the companies’ warning about capital.
A February research note by Strand Consult said the largest share of equipment due to be replaced over the next five years is in Germany, Italy, and Spain. It said Deutsche Telekom and Vodafone were heavily reliant on Huawei equipment in some markets. That dependence makes the unresolved timetable more than a Brussels drafting detail: it sets the conditions under which operators in those markets would have to replace equipment.
For now, governments have removed one clock without removing the plan. The revised act still has to pass through negotiations with EU lawmakers, and the document leaves the phase-out period tied to risk assessments, infrastructure, and supply alternatives. The companies warn of a bill reaching €40 billion. The institutions will decide the rules.