EU governments have removed the proposed 36-month deadline for mobile operators to phase out equipment from suppliers deemed high risk, potentially giving telecom companies more time to replace it. A document dated September 22 says the period should depend on several factors, not one fixed timetable.
A flexible replacement timetable
The document lists the identified level of risk, product and infrastructure lifecycles, equipment replacement cycles, interoperability requirements and the availability of suitable alternatives as factors for setting the period. In practice, that means the circumstances of each phase-out would shape the schedule, rather than operators having to finish replacements within 36 months.
The European Commission proposed the phase-out in January as part of an overhaul of the EU Cybersecurity Act. The measure would apply to components and equipment from suppliers deemed high risk in critical sectors, and would mainly affect Huawei and other Chinese technology companies.
The EU has tightened scrutiny of Chinese technology following cyber and ransomware attacks, alongside growing concerns about foreign espionage. Huawei denies its equipment poses a security risk.
Costs and investment concerns
Telecom companies have warned that replacing the equipment could cost as much as €40 billion ($45 billion). In a joint letter earlier this month, Deutsche Telekom Chief Executive Timotheus Höttges and 16 industry peers said costs of up to €40 billion risk draining capital needed for fibre, 5G and 6G investments.
Their letter set out the industry’s concern about the financial effect of replacing equipment from suppliers classed as high risk. The September 22 document says the proposed phase-out concerns equipment already used in networks, while operators would need suitable alternatives and would have to account for replacement cycles and infrastructure lifecycles.
A February research note by Strand Consult said the largest share of equipment due to be replaced over the next five years is in Germany, Italy and Spain. It also said Deutsche Telekom and Vodafone rely heavily on Huawei equipment in some markets.
Proposal still under negotiation
EU governments must negotiate the Commission’s proposal and any amendments with EU lawmakers before the revised Cybersecurity Act can become law. The document removes the proposed 36-month deadline, but the legislative process hasn’t concluded.
There’s no single replacement period for all operators. Instead, the September 22 document says the timetable should reflect the level of risk identified, how long products and infrastructure are used, equipment replacement cycles, interoperability requirements and whether suitable alternatives are available.
The Commission’s January proposal would place the phase-out within a broader overhaul of the EU Cybersecurity Act. The companies most affected would be Huawei and other Chinese technology suppliers. Industry says costs could reach €40 billion, and the source report was filed from Brussels on Sept. 29.