EU considers whether there's Huawei of axing Chinese kit from networks within 3 years
- Reference: 1769002941
- News link: https://www.theregister.co.uk/2026/01/21/eu_mulls_deadline_of_3_years/
- Source link:
Europe faces increasingly sophisticated hybrid attacks on every area of its infrastructure, the EC claims. The [1]revised Cybersecurity Act looks to address this with union-level risk assessments, combined with targeted mitigation measures that will include bans on IT components from "high-risk suppliers."
The suggested timeframe for this could leave member states with as little as three years to remove non-compliant kit.
[2]
This is seen as the Commission finally cracking down on member states that have for years declined to take any kind of action against suppliers deemed to be a potential security risk, and imposing Europe-wide rules regarding which companies and products should not be trusted.
[3]
[4]
In mid-2023, former European Commissioner Thierry Breton said telecoms equipment from firms including Huawei and ZTE [5]should be banned throughout the EU amid fears the tech could contain backdors, allowing Beijing to remotely access it for espionage purposes or to disrupt networks. Plan were announced to remove the gear from the Commission's internal networks.
In the same year it emerged that Huawei had [6]supplied nearly 60 percent of the telco equipment used in Germany's 5G networks. The megacorp hit back after [7]EU officials labelled it as a "high-risk supplier."
[8]
Huawei has always strongly denied its products represent a security threat, although critics counter that Chinese law requires its citizens and organizations to serve as [9]covert operatives on behalf of the state if ordered to do so.
The EC wants several key things baked into the revised Cybersecurity Act: a framework to address the supply chain security challenges in critical infrastructure, and to simplify the Europe-wide cybersecurity certification framework.
It also wants to strengthen the European Union Agency for Cybersecurity (ENISA), and reduce "unnecessary administrative burdens" relating to implementation of the NIS2 cybersecurity directive (only two member states met the [10]deadline to transpose it into national law .)
[11]
As for 5G networks, the EC says the legislation "provides for a phase-out of high-risk suppliers from mobile networks," and will mean that conformity assessment bodies will not be allowed to certify products or services from these suppliers.
This isn't just about telecoms, the new Cybersecurity Act along with the upcoming Cloud and AI development act (CADA) will address sovereignty aspects and non-technical risks, according to the EC.
The proposed legislation makes no mention of specific companies such as Huawei, but the China-based tech biz has supplied infrastructure to telecoms networks in pretty much every EU country because it was an early investor in 5G technology and standards.
A spokesperson for Huawei told The Register : "A legislative proposal to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU's basic legal principles of fairness, non-discrimination, and proportionality, as well as its WTO obligations.
"We will closely monitor the subsequent development of the legislative process and reserve all rights to safeguard our legitimate interests."
Huawei said it will continue to provide products and services as a legally operating company in Europe.
The proposed Cybersecurity Act says that a timeframe for phasing out components provided by high-risk suppliers from communications networks "shall not exceed 36 months from the publication of the list of high-risk suppliers."
This seems ambitious and compliance is not certain. The UK, for example, mandated in 2020 for the [12]removal of Huawei technology from the country's 5G networks by the end of 2027. BT, the former state-owned telecoms giant, admitted in 2024 it had [13]missed the 2023 deadline for removing Huawei kit from its network core.
[14]EU boss Breton: There's no Huawei that Chinese comms kit is safe to use in Europe
[15]It's official: UK telcos legally obligated to remove Huawei kit
[16]EU boss Breton: There's no Huawei that Chinese comms kit is safe to use in Europe
[17]UK: From 5G in Tiree to the Isles of Ebony, carry me on the waves… Sail Huawei, sail Huawei, sail Huawei
Britain's decision to rip and replace Huawei kit was also cited as a factor in why [18]UK mobile networks are ranked among the worst in Europe for quality of service, as this diverted cash from being spent on expanding and improving the country's 5G networks.
Gary Barlet, Public Sector CTO at cybersecurity biz Illumio, warned the EC's latest move could also lead to fragmentation in the global telecoms ecosystem.
"While efforts to achieve tech sovereignty and protect critical environments are understandable, an overly isolationist approach could create challenges," Barlet told The Register . "Fragmentation often limits collaboration and slows innovation, making it harder to build robust, future-ready networks." ®
Get our [19]Tech Resources
[1] https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-eu-cybersecurity-act
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXEGOBDWmm5mFOdf0fxAxwAAA5M&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXEGOBDWmm5mFOdf0fxAxwAAA5M&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXEGOBDWmm5mFOdf0fxAxwAAA5M&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/06/16/breton_calls_for_eu_huawei_bans/
[6] https://www.theregister.com/2023/03/09/germany_5g_huawei/
[7] https://www.theregister.com/2023/10/16/huawei_ec_security_risk/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXEGOBDWmm5mFOdf0fxAxwAAA5M&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2023/03/27/china_crisis_is_a_tiktoking/
[10] https://www.theregister.com/2024/10/24/nis2_compliance_checklist/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXEGOBDWmm5mFOdf0fxAxwAAA5M&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2022/10/13/uk_telcos_huawei_ban/
[13] https://www.theregister.com/2024/01/02/bt_missed_deadline_for_removing/
[14] https://www.theregister.com/2023/06/16/breton_calls_for_eu_huawei_bans/
[15] https://www.theregister.com/2022/10/13/uk_telcos_huawei_ban/
[16] https://www.theregister.com/2023/06/16/breton_calls_for_eu_huawei_bans/
[17] https://www.theregister.com/2020/01/28/uk_says_yes_to_limited_huawei_non_core/
[18] https://www.theregister.com/2025/03/25/london_poor_5g_research/
[19] https://whitepapers.theregister.com/
Yeah, I'd be more inclined to encourage decoupling/diversification from USA controlled services.
I'm sure US/CN/etc. have plenty of ways to spy/interfere irrespective of equipment origin, but cloud/hosted services are far more susceptible to a criminal tyrant's whims.
I take the point that US kit is also suspect, however how much US stuff is used in critical places, and how much is Ericsson / Nokia?
Indeed. The biggest threat to Europe is the USA.
Both politically and in network insecurity. The number one step should be to kick out ALL Cisco equipment for their proven backdoors and ever growing list of vulnerabilities. Next should be the USA cloud Trojans, slurping up Europe's data for the benefit of the USA.
Cognative dissonence
"A legislative proposal to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU's basic legal principles of fairness, non-discrimination, and proportionality, as well as its WTO obligations.
The oppressive law in China requiring companies to be spies if needed and Chinas willingness to spy on journalists and activists when abroad are facts, inconvenient for Huawei but facts none the less. Pointing out America is no better and asking why play favourites or not even trying to argue Ethics from such a compromised position and simply saying we have the best tech what will you do without it are fine reposts. Why make a flawed argument when there are better alternatives? In the post truth Trump, Xi era I guess it does not matter.
To answer the question of what to do post this: invest in developing EU and EU aligned rare earth sources, use open RAND, move deterministic workloads to smaller simpler systems not larger more complex ones and use AI only where ROI is proven. Probably too much like common sense to hope for, ho hum
Re: Cognative dissonence
>> Why make a flawed argument when there are better alternatives?
Because it is not a flawed argument to point out hypocrisy.
No mention of pulling US kit? It sounds as if they're not keeping up.