EU Governments Drop Fixed Deadline for Phasing Out High-Risk Telecom Equipment

EU governments have proposed removing a fixed deadline for mobile telecom operators to phase out equipment from suppliers classified as high risk, easing a requirement that the European Commission had put forward in January.

The Commission's original plan, part of an overhaul of the EU Cybersecurity Act, called for components and equipment from high-risk vendors to be phased out of critical sectors, with a 36-month window for mobile operators. The measure would primarily affect Huawei and other Chinese technology companies, amid heightened European scrutiny of Chinese technology following cyber and ransomware attacks and concerns over foreign espionage.

Under a document dated September 22, EU governments have deleted the deadline from the Commission's proposal. Instead, the phase-out period would be determined by factors including the level of risk identified, product and infrastructure lifecycles, equipment replacement cycles, interoperability requirements and the availability of suitable alternatives.

Huawei has denied that its equipment poses a security risk.

The revised Cybersecurity Act still requires negotiation between EU countries, the Commission and EU lawmakers before it can become law.

Industry pushback has centred on cost. In a joint letter earlier this month, Deutsche Telekom Chief Executive Timotheus Höttges and 16 industry peers said replacement costs of up to €40 billion ($45 billion) risk draining capital needed for fibre, 5G and 6G investments. A February research note by Strand Consult found that the largest share of equipment due to be replaced over the next five years is in Germany, Italy and Spain, with Deutsche Telekom and Vodafone heavily reliant on Huawei equipment in some markets.