EU Cybersecurity Act Revision Targeting High-Risk Telecom and IT Suppliers

The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen union-level supply-chain risk management for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from “high-risk suppliers.” Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially as little as three years—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure.

The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as Huawei and ZTE in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.