EU governments have quietly abandoned a rigid 36-month deadline for removing high-risk telecom equipment, replacing it with a flexible timeline tied to risk assessments, product lifecycles and market alternatives. A government paper dated September 22 documents the shift. It marks a significant concession to Europe’s telecom industry and raises questions about whether Brussels can carry out security policy without crippling infrastructure investment across the continent.
In January, the European Commission proposed phasing out components and equipment from high-risk suppliers in critical sectors as part of a broader overhaul of the EU Cybersecurity Act. The measure targets Huawei and other Chinese technology companies, reflecting Europe’s tighter scrutiny of Chinese technology after cyber and ransomware attacks and amid mounting concerns about foreign espionage. Huawei denies that its equipment poses a security risk.
The Cost Calculus
Industry resistance has come quickly and forcefully. Deutsche Telekom Chief Executive Timotheus Höttges and 16 industry peers warned jointly in mid-September that replacement costs could reach €40 billion—a sum that would divert capital desperately needed for fibre, 5G and 6G infrastructure. That’s no compliance fee. It’s a structural constraint on Europe’s digital competitiveness.
The costs fall unevenly across the continent. A February Strand Consult analysis found that Germany, Italy and Spain would bear the largest share of replacement costs over the next five years, while Deutsche Telekom and Vodafone hold particularly high concentrations of Huawei equipment in some markets. These aren’t hypothetical vulnerabilities. They’re real network dependencies, and operators can’t unwind them overnight.
Sovereignty and Pragmatism
The government shift toward flexible timelines reflects a basic truth: Brussels sometimes proposes security measures without fully accounting for the economic and technical realities member states must manage. A uniform 36-month mandate would force telecom operators to compress replacement cycles, sacrifice investment in newer technologies, or do both. Under the revised approach, the phase-out period depends on “identified level of risk, product and infrastructure lifecycles, equipment replacement cycles, interoperability requirements and the availability of suitable alternatives.” EU governments are acknowledging that national telecom operators, answerable to their own regulators and shareholders, are better placed than Brussels to manage the transition.
This is subsidiarity at work. The Commission sets the security objective; member states and their operators carry it out within economic and technical constraints.
The revised approach isn’t a security compromise. It recognizes that effective policy must align Brussels’ security ambitions with member states’ ability to put them into practice. Chinese surveillance risks are real. So is the risk of choking off European telecom infrastructure investment as the continent falls behind the United States and China in 5G and 6G deployment.
EU countries must now negotiate the Commission’s original proposal and any amendments with EU lawmakers before the revised Cybersecurity Act can become law. Those talks will determine whether Europe can secure its networks without sacrificing competitiveness—or settle for a compromise that satisfies neither objective.
Why This Matters:
Europe’s telecom operators face two legitimate demands: security and investment. A rigid phase-out timeline would force them to choose between the two. The move toward flexibility suggests Brussels is learning that effective regulation must balance security imperatives with member states’ fiscal and operational capacity to implement them. Whether that flexibility survives EU parliamentary negotiations remains uncertain. Still, the core principle—that member states should retain meaningful discretion over critical infrastructure transitions—reflects sound governance. Europe’s digital future depends on networks that stay secure and keep improving. A mandate that makes operators choose between those goals serves neither.