EU Moves to Tighten Cybersecurity Certification and ICT Supply-Chain Rules

The European Commission proposed revisions to the EU Cybersecurity Act aimed at strengthening EU-wide cybersecurity certification, tightening ICT supply-chain risk management, and improving protections for critical infrastructure, including measures affecting European mobile telecommunications networks. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors.

The proposed direction has also triggered geopolitical and industry pushback tied to potential supply-chain restrictions: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as Huawei if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.