Loading story…
European Union efforts to remove so-called high-risk telecom suppliers including Huawei and ZTE from regional networks could cost far more than previously projected, with industry estimates putting direct replacement expenses at €30 billion to €40 billion. That figure, cited in reporting on a GSMA analysis, is well above earlier European Commission estimates of roughly €10 billion to €13 billion over three years, as Brussels presses operators to replace Chinese-supplied equipment across mobile, fixed, and transport networks.
The analysis also warned that reduced vendor competition could add another €8.5 billion in costs between 2027 and 2030, as excluding Chinese suppliers may strengthen the market position of Ericsson and Nokia and drive up equipment prices. The higher estimates were disputed by critics including ECIPE analyst Hosuk Lee-Makiyama, who said the GSMA figures were too broad and failed to account for hardware that would have been replaced during normal upgrade cycles.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The EU was reported to be again pressuring telecom operators to remove equipment from Chinese suppliers such as Huawei and ZTE within three years. The effort is aimed at eliminating high-risk vendors from European telecommunications networks.
A GSMA-cited analysis estimated that removing high-risk suppliers such as Huawei from EU telecommunications networks would cost €30 billion to €40 billion in direct replacement costs. The analysis also projected an additional €8.5 billion in costs between 2027 and 2030 due to reduced vendor competition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Major European operators including Orange, Deutsche Telekom, and Telefónica have urged EU lawmakers to revise the proposed Digital Networks Act and associated cybersecurity measures that could bar telecom suppliers designated as high risk, a category expected to include Huawei and ZTE. The proposal would reportedly give operators three years to remove affected Chinese equipment from their networks; Sweden, Latvia, France, and Germany have already taken or are planning steps to phase out the vendors. Seventeen telecom CEOs warned that mandatory replacement could cost as much as **€40 billion**, diverting funding from fibre, gigabit connectivity, 5G, 6G, satellite, and submarine-cable investment. The operators called for proportionate, risk-based mitigations rather than blanket infrastructure removal, arguing that the draft framework does not adequately support investment and innovation in European connectivity.
Sep 16, 2026
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen **union-level supply-chain risk management** for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from **“high-risk suppliers.”** Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially **as little as three years**—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure. The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as **Huawei** and **ZTE** in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Jun 29, 2026
The European Commission proposed revisions to the **EU Cybersecurity Act** aimed at strengthening EU-wide cybersecurity certification, tightening **ICT supply-chain risk management**, and improving protections for critical infrastructure, including measures affecting European **mobile telecommunications networks**. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors. The proposed direction has also triggered geopolitical and industry pushback tied to potential **supply-chain restrictions**: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as **Huawei** if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.
Jun 29, 2026