Europe’s largest telecommunications companies won a major concession in the cybersecurity fight. EU governments quietly dropped a strict 36-month deadline to phase out equipment from high-risk suppliers, replacing it with a flexible schedule tied to risk, product lifecycles and the availability of alternatives. Documented in a September 22 proposal, the shift signals that industry concerns—not public security timelines—will partly set the pace of Europe’s effort to reduce reliance on Chinese technology.
The change reflects a familiar EU conflict: protecting critical infrastructure from foreign espionage while managing the costs of rapid technological change. Replacing Huawei and other Chinese-supplied equipment could cost as much as €40 billion ($45 billion), according to industry estimates that have shaped negotiations from the outset. Europe’s telecom sector faces real complexity.
The Industry Pressure
Earlier this month, Deutsche Telekom Chief Executive Timotheus Höttges and 16 industry peers sent a joint letter warning that €40 billion in replacement costs would drain capital needed for fiber, 5G and 6G investments. Their argument carries weight in Brussels. Germany, Italy and Spain face the biggest equipment replacement burden over the next five years, while Deutsche Telekom and Vodafone rely heavily on Huawei equipment in some markets. When incumbent operators—the backbone of European digital infrastructure—say they can’t afford a timeline, governments listen.
In January, the European Commission proposed the original 36-month phase-out as part of a broader overhaul of the EU Cybersecurity Act. The measure aimed to reduce Europe’s exposure to espionage and ransomware attacks, which have grown more serious in recent years. Huawei denies its equipment poses a security risk, but European intelligence and security officials have expressed deep concern that Beijing could exploit hardware backdoors for surveillance or sabotage.
The Democratic Gap
What’s striking isn’t the industry pressure itself—that’s normal in Brussels—but the lack of comparable weight on the other side. Where are consumers, civil society organizations and data protection advocates in this negotiation? Reuters revealed the document; the public didn’t debate it. The European Commission’s proposal passed through government channels with little public scrutiny. By the time governments removed the deadline, they’d already struck the deal.
This matters because the Cybersecurity Act will set standards for critical infrastructure across the continent. EU countries still must negotiate the Commission’s proposal and any amendments with EU lawmakers before the revised act becomes law. Parliament can intervene, insisting on timelines that balance legitimate industry concerns with legitimate security needs. But that debate hasn’t happened, and the momentum has already shifted toward accommodation.
Why This Matters:
The EU’s cybersecurity framework is meant to protect all Europeans—not just telecom shareholders. Flexible timelines sound reasonable in theory, but they risk turning into indefinite delays. If “depends on factors” means companies get to choose the pace, Europe faces the worst outcome: continued exposure to foreign espionage and no capital invested in domestic alternatives. A genuine European digital strategy would set a clear deadline and fund the transition through EU infrastructure investment, turning a security cost into a strategic opportunity. Instead, we’re seeing Brussels and telecoms negotiate while the public interest sits in the footnotes. Parliament needs to reclaim this file before the Cybersecurity Act becomes law.