European cybersecurity policy and standards updates for telecom supply chains and AI systems

The European Commission proposed a new Cybersecurity Package that would tighten security requirements for telecommunications networks by mandating the removal of high-risk suppliers from sensitive ICT and mobile network infrastructure and by strengthening EU-wide defenses against state-backed and cybercrime threats targeting critical infrastructure. The proposal would move beyond the uneven, voluntary adoption of the EU’s 2020 5G Security Toolbox by giving the Commission greater authority to coordinate EU-wide risk assessments, support restrictions or bans on certain equipment, and drive joint risk assessments across the EU’s 18 critical sectors, including consideration of suppliers’ countries of origin and national security implications.

Separately, ETSI published ETSI EN 304 223, a new European standard defining baseline cybersecurity requirements for AI models and systems (including deep neural networks and generative AI) intended for real-world deployment. The standard frames AI as a distinct security domain and addresses AI-specific risks such as data poisoning, model obfuscation, and indirect prompt injection, organizing requirements across five lifecycle phases: secure design, development, deployment, maintenance, and end-of-life; it is positioned as a shared baseline for vendors, integrators, and operators across the AI supply chain.