Loading story…
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen union-level supply-chain risk management for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from “high-risk suppliers.” Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially as little as three years—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure.
The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as Huawei and ZTE in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Huawei said excluding suppliers based on country of origin rather than technical evidence would violate EU legal principles and WTO obligations, and stated it would continue operating legally in Europe. The response came as the Commission's proposed reforms were reported publicly.
As part of the same review, the Commission proposed that member states could be required to remove non-compliant communications-network components within a maximum of 36 months after an EU high-risk supplier list is published. The measure is widely seen as targeting vendors such as Huawei and ZTE where some member states have been reluctant to impose restrictions.
The European Commission sought a revision of the EU Cybersecurity Act to address supply-chain and national security risks from IT and telecom equipment sourced from third countries. The proposal includes EU-level risk assessments, mitigation measures, and the possibility of banning components from suppliers designated as high risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission proposed revisions to the **EU Cybersecurity Act** aimed at strengthening EU-wide cybersecurity certification, tightening **ICT supply-chain risk management**, and improving protections for critical infrastructure, including measures affecting European **mobile telecommunications networks**. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors. The proposed direction has also triggered geopolitical and industry pushback tied to potential **supply-chain restrictions**: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as **Huawei** if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026
The European Commission proposed a new **Cybersecurity Package** that would tighten security requirements for telecommunications networks by mandating the removal of **high-risk suppliers** from sensitive ICT and mobile network infrastructure and by strengthening EU-wide defenses against state-backed and cybercrime threats targeting critical infrastructure. The proposal would move beyond the uneven, voluntary adoption of the EU’s 2020 *5G Security Toolbox* by giving the Commission greater authority to coordinate **EU-wide risk assessments**, support restrictions or bans on certain equipment, and drive joint risk assessments across the EU’s **18 critical sectors**, including consideration of suppliers’ countries of origin and national security implications. Separately, ETSI published **ETSI EN 304 223**, a new European standard defining baseline cybersecurity requirements for **AI models and systems** (including deep neural networks and generative AI) intended for real-world deployment. The standard frames AI as a distinct security domain and addresses AI-specific risks such as **data poisoning**, **model obfuscation**, and **indirect prompt injection**, organizing requirements across five lifecycle phases: secure design, development, deployment, maintenance, and end-of-life; it is positioned as a shared baseline for vendors, integrators, and operators across the AI supply chain.
Jun 29, 2026