EU Governments Propose Flexible Timeline for Telecoms to Replace High-Risk Network Gear

European mobile operators may get more time to phase out network equipment from suppliers deemed high-risk, such as China's Huawei. A proposal from EU governments, seen by Reuters, suggests removing a fixed deadline in favor of a more flexible approach following industry concerns over massive replacement costs.

A Shift from a Fixed Deadline

The European Commission originally proposed a 36-month phase-out period in January as part of an overhaul of the EU Cybersecurity Act. This was driven by heightened scrutiny of Chinese technology and concerns over potential foreign espionage.

However, in a document dated September 22, EU governments removed that specific deadline. The new proposal suggests the phase-out period should instead be determined by several factors, including:

• The identified level of risk
• Product and infrastructure lifecycles
• Interoperability requirements
• The availability of suitable alternative suppliers

Industry Cost Concerns

Ad

The policy shift follows significant pushback from the telecommunications sector. In a recent joint letter, Deutsche Telekom CEO Timotheus Höttges and 16 other industry executives warned that replacement costs could reach as high as €40 billion ($45 billion).

They argued that such an expense would drain capital essential for critical investments in next-generation 5G and 6G networks, as well as fiber infrastructure. The move to phase out high-risk vendors primarily affects Chinese technology companies like Huawei, which denies its equipment poses a security risk.

Market Impact and Next Steps

According to a February research note from Strand Consult, operators in Germany, Italy, and Spain have the largest share of equipment slated for replacement. The report highlighted that Deutsche Telekom and Vodafone are heavily reliant on Huawei equipment in some of their markets.

The proposal is not yet final. EU member countries must now negotiate the amendments with EU lawmakers before the revised Cybersecurity Act can be enacted into law.