The European Commission has formally recommended that its 27 member states exclude Huawei and ZTE from all connectivity infrastructure, not just 5G mobile networks, and is now moving to make that restriction legally binding through a draft cybersecurity law.
Background
The Commission first asked member states to keep the two Chinese vendors out of 5G networks in 2020 via the 5G Cybersecurity Toolbox. That request was voluntary. Six years later, on 4 May 2026, the Commission issued a similar recommendation, this time broadening the scope to "connectivity infrastructure" — covering fixed networks, fibre-optic and submarine cables, and satellite networks, in addition to mobile networks.
Why the voluntary approach failed
By February 2024, only 11 of the then-27 member states had taken concrete 5G security measures targeting Huawei and ZTE, according to Euronews. By January 2026, that number had risen to just 13. Germany was the most visible holdout: Huawei equipment was estimated to be in roughly 60 percent of German 5G sites as of late 2024. Several Eastern European member states were similarly reluctant. The Commission's frustration with this pattern is the proximate cause of the legislative push.
What the new law would do
On 20 January 2026, EU Executive Vice-President for Tech Sovereignty Henna Virkkunen presented a cybersecurity package designed to convert the voluntary recommendation into binding obligations. Under the proposed law:
- Components from designated high-risk suppliers would have to be removed from key network infrastructure within 36 months of the rules taking effect.
- Member states ignoring the obligation would face infringement procedures and possible financial penalties.
- The binding regime will extend to fixed networks, fibre-optic and submarine cables, and satellite networks, with phase-out periods to be announced later.
"It didn't work on a voluntary basis," Virkkunen said at the time.
China's response
Beijing has called the cybersecurity package "discriminatory" and threatened to retaliate against European companies operating in the Chinese market. The threat carries weight because major European industrial groups — particularly in autos, luxury goods, and machinery — depend on the Chinese market asymmetrically. Sweden's experience is instructive: after Sweden banned Huawei and ZTE from its 5G network in October 2020, Ericsson's China revenue fell 46 percent the following year and has not recovered.
Tradeoffs
The economic cost of removing tens of billions of euros' worth of installed Huawei and ZTE equipment from European networks is substantial. Germany, the EU's largest market, faces the highest replacement costs. Member states with strong domestic vendors — France with Nokia's Alcatel-Lucent,