High-Risk Telecom Vendors: What the EU Phase-Out Means for Procurement Teams

High-risk telecom vendors are the suppliers the EU wants removed from its mobile networks, and procurement teams that buy network equipment or services in Europe now have a proposal to plan around. The European Commission published it on January 20, 2026, as part of a revised Cybersecurity Act. As of November 4, 2026, it is a proposal only. Nothing has been adopted, and the dates in it may change.

Parliament is still preparing its position, and member states are negotiating theirs in the Council. A Council draft dated September 22 reportedly drops the proposal’s fixed 36-month deadline for mobile networks. This guide is written for procurement, sourcing and vendor risk teams at telecom operators, and at companies in the other sectors the proposal could reach. It explains what to do about high-risk telecom vendors before the text is final.

Uncertainty about the final text is a reason to prepare, not to wait. Asset inventories, supplier ownership data, contract terms, and budget ranges do not depend on it. The US has already shown, with its own rip-and-replace program, how slowly the work goes once the order is given.

The sections below cover the background, what the proposal requires, which networks are in scope, the procurement impact, lessons from the UK and US, ownership tracking for vendors, and a 2027 action plan. This is general information, not legal advice.

Background: From the 5G Toolbox to a Proposed Cybersecurity Act

In the EU proposal, a high-risk telecom vendor is a supplier of network equipment or services that the Commission would list as high-risk because it is established in, or controlled from, a third country the Commission has designated as a serious supply chain risk. No country or company has been designated yet. The legal text says “high-risk suppliers”; this guide uses “high-risk vendors” and “high-risk telecom vendors” for the same companies.

The EU’s first answer was voluntary. The 5G Security Toolbox, introduced in 2020, encouraged member states to limit their reliance on high-risk vendors. Euronews reports that it saw “uneven application,” and Tech Commissioner Henna Virkkunen has repeatedly warned that voluntary measures have not gone far enough.

The January 2026 proposal, called the Cybersecurity Act 2, would replace the current Cybersecurity Act (Regulation (EU) 2019/881) and make the approach mandatory. For mobile networks, the Commission says it would “require mobile operators to remove high-risk suppliers from 5G networks within three years.” In its Q&A, the Commission adds that conformity assessment bodies cannot certify products or services from those suppliers.

The proposal names no high-risk telecom vendors. Euronews notes that it builds on longstanding concerns about Chinese technology groups, notably Huawei and ZTE, particularly in mobile networks. A Huawei spokesperson said the plan “violates the EU’s basic legal principles of fairness, non-discrimination, and proportionality.”

Regulatory change of this kind lands on procurement from several directions at once, which is why it belongs inside a wider approach to supply chain and spend risk and not in a one-off project.

Where the Proposal Stands on November 4, 2026

The table shows where each body stands on high-risk vendors as of November 4, 2026, based on the source linked in each row.

What the EU Proposal Requires

The proposal works in five steps, and a company that buys from high-risk telecom vendors is directly affected only at the last one. Analyses by Freshfields and Covington describe the mechanism, and the five steps below follow Freshfields’ account, with details on designation, key ICT assets, and restrictions from Covington.

1. Risk assessment. The Commission, or at least three member states, can ask the NIS Cooperation Group to assess a specific ICT supply chain.
2. Designation. The Commission can find that a third country poses serious, structural non-technical supply chain risks. It may then treat that country and “any entities it controls” as high-risk suppliers.
3. Key ICT assets. For most regulated sectors, the Commission identifies key ICT assets by implementing act. For electronic communications networks, they are pre-defined in Annex II.
4. Listing. The Commission maps suppliers by establishment, ownership and control, then publishes a list of high-risk suppliers.
5. Restriction or mitigation. The Commission can bar regulated entities from using components from listed suppliers in key assets, subject to a transition period. Where a full ban would be disproportionate, it can impose lighter measures instead.

The 36-Month Window

For mobile networks, the proposal sets a ceiling on how long operators have to phase out high-risk vendors. Covington reports that the phase-out period “may not exceed 36 months from publication of the high-risk suppliers list,” and Hogan Lovells Cadwalader reads Article 110(3) the same way. For fixed and satellite networks, timelines would be set by Commission implementing acts.

On that reading, the clock starts when the list is published, not when the law is adopted. The 36 months cannot begin until the law is in force and a list exists, and no country or company has been designated yet. This is why the Council’s reported move away from a fixed period matters to anyone planning a budget.

What Is Changing in the Negotiation

The text will change before it becomes law. The table sets the Commission’s proposal against the objections and reported changes found in 2026 sources.

The practical reading is to plan for a mandatory phase-out of some kind, and to treat the length of the window, the basis for listing a supplier and the scope of the rules as open questions.

Mitigation, Penalties and Procurement Exclusion

A phase-out is not the only tool. The Commission could require targeted mitigation measures, such as supplier transparency, limits on third-country remote access and personnel vetting. High-risk vendors would also face limits on participating in public procurement or Union-funded programs involving ICT components for key ICT assets.

Covington reports fines of up to 7% of global annual turnover for the most serious violations. Hogan Lovells Cadwalader adds that regulated companies would have to provide lists of their suppliers on request, permit inspections and provide relevant product information.

Which Components and Networks Are in Scope

Scope has four layers: which networks, which sectors, how deep into the supply chain, and which countries carry the most equipment.

Telecom is expected to come first, which makes high-risk telecom vendors the first practical test of the rules. Hogan Lovells Cadwalader says the Commission has indicated that its assessment of the telecommunications sector will be fast-tracked. Freshfields adds that ongoing risk assessments point to 5G networks, detection equipment, and connected and automated vehicles as likely early focus areas, with cloud computing, medical devices, semiconductors and drones also flagged.

For a US-based company, the sector list matters more than the location of the head office. A US group with EU entities in energy, transport, health, manufacturing, digital infrastructure or digital services should ask counsel whether those entities are regulated under NIS2, because the proposal builds on that directive’s sectors.

How Exposed Is the EU?

Strand Consult, a telecom policy consultancy, estimates that exposure to high-risk vendors across the EU stood at about 30% at the start of 2026, down from about 45% a few years earlier. By country, its estimates run from 24% in Spain to 70% in Austria, with Germany at 58%. It also estimates that more than 95% of EU mobile core networks run on trusted vendors, which points to radio access equipment as the main exposure.

Combining its analysis with Commission figures, Strand Consult says Germany, Italy and Spain make up over 55% of the equipment that would have to be replaced over five years. These are one consultancy’s estimates, and the proposal itself lists no high-risk vendors, so treat the country figures as a guide to where the work would concentrate.

Procurement Impact: Inventory, Replacement Sourcing, Contract Exits and Budget

The proposal turns a security policy on high-risk telecom vendors into four procurement workstreams. Each can start before the text is final, because each answers a question the final text is unlikely to change: what do we own, from whom, under what contract, and what would replacing it cost? For the wider operating context, see APSentra’s page on procurement challenges in Europe.

Inventory

Start with an asset-level inventory. Record each piece of network equipment or software, its supplier entity, the supplier’s ultimate owner, the site, its age, the support contract and the service it carries. Because regulated companies would have to provide lists of their suppliers on request and permit inspections, the inventory should be producible on short notice.

Then go below the first tier. Freshfields warns that a prohibited component may sit several tiers down, inside a product bought from an otherwise unproblematic vendor. Ask first-tier suppliers where key components come from, so that high-risk vendors several tiers down can be found, and record the answer, including “unknown.”

Replacement Sourcing

Replacing high-risk vendors is a market problem as well as a project. In GSMA Intelligence’s July 2026 report, Huawei holds 25.0% and ZTE 7.0% of the current EU mobile network equipment market (page 26). The report does not name the vendors in its text, but its tables show both falling to zero share after exclusion.

GSMA estimates that prices from the remaining vendors would rise by about 24% for mobile, 19% for fixed and 10% for transport equipment (page 16). If all sales from the excluded high-risk vendors went to the largest remaining player, it says mobile prices could rise by 43%. Treat these as a stress test for negotiating positions, not a forecast.

In practice, open talks with at least two remaining vendors before demand peaks, ask for price protection in framework terms, and check whether vendor capacity, including equipment and installation crews, can support your timeline. The US experience in the next section shows why.

Contract Exits

Read every contract with a supplier that is, or could become, one of the high-risk vendors for the terms in the table. Where a contract is silent, the exit will be negotiated at the supplier’s pace. This is an illustrative checklist, not legal advice.

Budget

Published estimates of the cost of replacing high-risk telecom vendors disagree. The table puts them side by side, with the source and scope of each.

The estimates differ because they cover different networks and rest on different data. The Commission’s range works out to about €9 billion to €12 billion for mobile over three years, below GSMA’s €16 billion to €22 billion for the same networks. Read them as scenarios, not as a forecast.

For a budget, carry a low, central and high case, add a line for the write-offs and disruption that the GSMA total excludes, and phase the spending across the replacement window instead of assuming it lands in one year. If your estimate rests on a single vendor quote, add the price effect from the sourcing section as a separate scenario.

Running a Rip-and-Replace Program: Lessons from the UK and US

Two other governments are partway through their own programs to remove high-risk vendors from telecom networks, and what they report shows where the work slows down. The UK source below dates from March 2025, and the US figures from 2026.

The UK: A 2027 Deadline and Little Public Detail

In March 2025, UK Minister Chris Bryant told a Commons committee that “the UK is now on a path towards the complete removal of Huawei from the UK’s 5G networks by the end of 2027,” and added, “we believe we are on track to meet the 2027 deadline.” The same debate covered an Order that defines “turnover” in statute, so that penalties can be set for a provider that does not comply with a designated vendor direction.

Two points carry over. A deadline needs a penalty regime with defined terms. And when asked for operator-by-operator progress, the minister declined, citing security, so a buyer should not expect public progress data from regulators or peers and should track its own.

The US: What the 2026 Data Show

The US Secure and Trusted Communications Networks Reimbursement Program reimburses eligible carriers for removing, replacing and disposing of covered equipment. The table uses the FCC’s Eighth Report to Congress, submitted June 15, 2026.

Delay percentages are shares of the 80 unique status updates in the latest reporting period.

• Fund the gap before you set the date. Approved costs ran $3.08 billion over the original appropriation, which required borrowing authority. Light Reading reports that the FCC later repaid the loan early using proceeds from the June AWS-3 auction.
• Capacity is the bottleneck. Supply chain issues were cited in about 35% of the latest status updates, up from about 17% in the previous report. Light Reading’s examples: a shortage of cells-on-wheels moved one provider’s deadline from August 6, 2026 to February 2, 2027, a certified crew withdrew from another project, and shipping to Alaska delayed gateway equipment.
• Plan the cash flow. Competitive Carriers Association CEO Tim Donovan said some carriers are “having to float some of that” while they wait for final reimbursements.
• Tie extensions to reporting. The FCC conditioned extensions on detailed timelines in quarterly status updates and denied two requests without prejudice on March 31, 2026.
• Expect a long tail. At the June report, 12 of 126 Priority 1 applications had completed closeout, and extensions of two to six months were still being granted in September.

The US program reimburses carriers from a federal fund, and the EU rules would apply differently. Budget owners should check whether any comparable funding exists for the EU phase-out before assuming it does.

Ownership and Country-of-Origin Tracking for Vendors

Under the proposal, where a supplier invoices from is not the test of whether it is one of the high-risk vendors. The Commission may designate a country and “any entities it controls,” and Freshfields reports that entities established or controlled from a designated country automatically qualify as high-risk vendors, with the Commission mapping suppliers by establishment, ownership and control.

Control has a defined meaning. Hogan Lovells Cadwalader reports that Article 2(37) defines it as “the ability to exercise a decisive influence on a legal entity,” exercised directly or indirectly through intermediate entities, and notes that this does not fully align with the control test in EU sanctions law. A sanctions screening result may therefore not answer the same question.

The table lists fields worth adding to the vendor master record. It is an illustrative list, and counsel should decide what counts as control for your suppliers.

Collect the fields at onboarding, refresh them on a fixed cycle and whenever a supplier is acquired or changes ownership, and keep the evidence behind each answer. Suppliers should also expect to be asked: Hogan Lovells Cadwalader reports that regulated companies would face supplier transparency obligations toward competent authorities.

A vendor master record that is shared across entities gives the fields for tracking high-risk vendors one home. APSentra describes this approach on its supplier management page, and compares tools for it in its guide to the best vendor management software.

Action Plan for 2027

Hogan Lovells Cadwalader puts the earliest adoption in the course of 2027, and Freshfields says Parliament-Council talks could begin in early 2027, which it calls a possibility and not a date. The plan below for dealing with high-risk telecom vendors is a suggested sequence, not a legal requirement. Move it as the text moves.

Check the Parliament procedure page and the Council’s press releases monthly. A change to the 36-month window, the basis for listing high-risk vendors or the scope of the rules would show up in those two places first.