🏛️ The European Commission has proposed a new cybersecurity legislative package aimed at protecting telecommunications networks and reducing exposure to high-risk suppliers in critical infrastructure.
The move follows years of uneven adoption of the EU’s voluntary 5G Security Toolbox (introduced in 2020). While no vendors are named, prior discussions highlighted concerns around suppliers with foreign state influence.
What’s changing?
The proposal would allow the Commission to:
- 📊 Coordinate EU-wide cybersecurity risk assessments
- 🚫 Support restrictions or bans on sensitive network equipment
- 🏗️ Jointly assess risks across 18 critical sectors
- 🛡️ Improve resilience against state-backed actors and cybercrime groups
🗣️ Henna Virkkunen, EU Commissioner for Tech:
“Cybersecurity threats are not just technical challenges — they are strategic risks to our democracy, economy, and way of life.”
Revised Cybersecurity Act highlights
- Mandatory removal of high-risk foreign suppliers from mobile networks
- Simplified ICT certification via voluntary EU schemes
- Expanded powers for ENISA to:
- Issue early threat alerts
- Operate a single incident-reporting entry point
- Support ransomware response with Europol and national CSIRTs
- Creation of EU-wide cybersecurity skills certifications and a Cybersecurity Skills Academy
⏳ Once approved by the European Parliament and Council, the legislation would take effect immediately, with member states given one year to implement it into national law.
Bottom Line
For EU enterprises, this legislation signals a shift from reactive cybersecurity to strategic, sovereignty-driven risk management.
Cybersecurity is no longer just an IT concern — it is becoming a core element of compliance, resilience, and business continuity across Europe.
