EU governments have dropped a proposed 36-month deadline for mobile operators to phase out equipment from suppliers deemed high risk. Instead, replacement schedules would depend on risk assessments and technical conditions, giving European telecom companies more time; the revised rules still require negotiations with EU lawmakers.
A Flexible Phase-Out
A document dated September 22, seen by Reuters, says several factors should determine the phase-out period, rather than a fixed deadline. These include the identified level of risk, product and infrastructure lifecycles, equipment replacement cycles, interoperability requirements and the availability of suitable alternatives.
The document concerns the European Commission’s proposed overhaul of the EU Cybersecurity Act. In January, the Commission proposed phasing out components and equipment from high-risk suppliers in critical sectors. Huawei and other Chinese technology companies would bear the main impact.
The revised approach puts the timetable at the heart of negotiations between EU governments and lawmakers. Countries must negotiate the Commission’s proposal and any amendments with EU lawmakers before the revised Cybersecurity Act can become law. The document gives no replacement date. It lists criteria that would shape how much time operators get.
Security and Costs
Europe has tightened scrutiny of Chinese technology after cyber and ransomware attacks, as concerns about foreign espionage grow. Huawei denies that its equipment poses a security risk.
Replacing the equipment carries major financial consequences for operators. The industry has warned that the work could cost as much as €40 billion ($45 billion). Earlier this month, Deutsche Telekom Chief Executive Timotheus Höttges and 16 industry peers warned in a joint letter that costs of up to €40 billion risk draining capital needed for fibre, 5G and 6G investments.
That warning puts the security timetable alongside planned investment in communications infrastructure. The governments’ document lists infrastructure and product lifecycles, replacement cycles and the availability of alternatives as factors in setting the phase-out period. The Commission’s proposal targets equipment from suppliers designated high risk in critical sectors.
Where Equipment Is Concentrated
A February research note by Strand Consult said Germany, Italy and Spain hold the largest share of equipment due to be replaced over the next five years. According to the note, Deutsche Telekom and Vodafone rely heavily on Huawei equipment in some markets.
The proposed flexibility reaches operators and markets facing substantial equipment replacement requirements, but no final timetable for those companies appears in the article. The document’s criteria include the availability of suitable alternatives and whether operators can replace equipment while meeting interoperability requirements.
EU governments have removed the fixed 36-month deadline, but they haven't finished the legislative process. The Commission’s proposed Cybersecurity Act overhaul and any amendments still need negotiation with EU lawmakers before the measure can become law. The report was filed from Brussels on Sept. 29.