European Union governments are seeking a more flexible timetable for removing equipment supplied by companies deemed high-risk from mobile networks, stepping back from the European Commission’s proposed fixed three-year deadline as operators warn about the cost of replacing existing infrastructure.

A Council negotiating document dated 22 September removes the Commission’s proposed 36-month phase-out period for mobile operators and instead says replacement periods should take account of identified security risk, product and infrastructure lifecycles, normal replacement cycles, interoperability requirements, and whether suitable alternatives are available.

The text remains part of negotiations over a revision of the EU Cybersecurity Act rather than settled legislation. Member states and the European Parliament still have to negotiate the final regulation, so neither the Commission’s original deadline nor the Council’s more flexible approach should be treated as the final rule.

The January proposal is intended to give the EU stronger powers to address supply chain risks associated with third-country technology suppliers. Although the framework is not written solely around one company, restrictions on high-risk suppliers would most obviously affect operators using equipment from Chinese vendors including Huawei, which has consistently rejected claims that its equipment creates a security threat.

Security policy collides with replacement economics

The dispute is partly about how quickly telecommunications infrastructure can realistically be rebuilt. Mobile networks contain radio equipment, antennas, software, management systems, and core-network components installed over multiple investment cycles, so replacing a supplier does not resemble swapping an ordinary enterprise software licence.

European operators have argued that accelerated replacement could cost as much as €40 billion, according to a joint industry letter cited in reporting on the Council proposal. Telecom groups say money diverted into removing existing equipment would otherwise be available for fibre, 5G, and future 6G investment.

That argument does not remove the underlying security question. The Commission proposed revising the Cybersecurity Act specifically to strengthen ICT supply chain security and reduce risks associated with third-country suppliers that raise cybersecurity concerns, moving the issue beyond earlier voluntary guidance towards a more binding European framework.

The Council’s approach would retain the possibility of requiring replacement while making timing dependent on technical and market conditions. That gives national authorities more room to align security requirements with planned equipment renewal, although it could also produce slower or less uniform outcomes if member states assess risk and replacement practicality differently.

Germany, Italy, and Spain are among the markets where significant quantities of equipment may need to be replaced over the coming years, while large operators including Deutsche Telekom and Vodafone have exposure to Huawei technology in parts of their networks. The scale of that installed base turns supplier policy into a capital-allocation issue as well as a cyber-risk decision.

Europe is rebuilding networks while planning the next ones

The debate arrives while Brussels is rewriting the wider regulatory framework around telecoms. The proposed Digital Networks Act is intended to harmonise parts of the connectivity market, encourage investment, extend spectrum certainty, and support the transition towards newer network infrastructure.

Techopia examined the industry’s pushback earlier this month when European telecom executives pressed Brussels over network investment, spectrum, and supplier-security rules. The latest Council text shows governments grappling directly with one of the industry’s central complaints: infrastructure security requirements compete for the same capital needed to modernise networks.

Replacement timing also affects competition in the equipment market. Operators need alternative suppliers capable of integrating with existing networks, meeting performance and security requirements, and providing enough equipment at the necessary scale. A mandatory deadline can increase urgency for diversification, while a longer transition gives operators more opportunity to align replacement with ordinary investment cycles.

Conversely, flexible deadlines can prolong dependence on equipment that policymakers have already classified as problematic. The risk calculation therefore sits between two imperfect options: move rapidly and absorb greater cost and operational disruption, or stretch replacement over a longer period while accepting continued exposure during the transition.

The Council draft attempts to make that decision conditional rather than uniform by considering product lifecycles, interoperability, risk, and alternative supply. Whether the Parliament accepts that approach will determine how much discretion remains when the regulation moves towards final agreement.

The Commission’s wider Cybersecurity Act proposal also covers certification of digital products and services and stronger responsibilities for the EU Agency for Cybersecurity, so the high-risk supplier provisions form one part of a broader attempt to strengthen European cyber resilience.

For telecom operators, however, the phase-out timetable is where policy turns directly into network engineering and capital expenditure. Europe wants stronger control over technology supply chains while simultaneously asking operators to invest in fibre, 5G, and the foundations of 6G, and the final legislation will have to determine how quickly those objectives can be pursued at the same time.