EU prepares ICT supply chain toolbox amid tensions over Chinese vendors
The EU’s ICT Supply Chain Toolbox will be presented on September 25, aiming to strengthen security of critical communications infrastructure against high-risk foreign suppliers such as Huawei and ZTE. While designed as guidance, Brussels is considering tying it to the Cybersecurity Act revision, which could make restrictions binding. Member states remain split, with Germany and Sweden moving toward phaseouts, while others like Spain and Hungary resist tougher measures.
The European Union’s long-delayed ICT Supply Chain Toolbox will be presented for the first time at a technical meeting on 25 September. Designed to help member states secure critical communications infrastructure, the toolbox provides guidance for assessing risks linked to foreign ICT suppliers and mitigating vulnerabilities such as cyberattacks, espionage, and supply chain disruptions. Huawei and ZTE remain central to the debate, as several governments weigh how to handle existing contracts with Chinese vendors.
The toolbox builds on the earlier 5G Toolbox but extends its scope across a wider range of ICT systems and components. Drafts suggest it will include criteria for identifying high-risk suppliers, from ownership structures to legal obligations in their home countries, and propose measures such as restricting access to sensitive network parts, strengthening certification requirements, diversifying suppliers, and phasing out high-risk equipment. While currently soft law, the European Commission is considering linking the toolbox to the upcoming revision of the Cybersecurity Act, a step that could turn guidance into binding obligations for operators and regulators.
Member state reactions remain divided. Germany has agreed to phase out Huawei and ZTE from core 5G networks by 2026 and from other components by 2029, while Sweden has gone further by imposing outright bans and requiring removal of existing equipment. Spain, in contrast, has allowed certain contracts with Huawei, drawing concern from Brussels. Other states, including Hungary and Austria, have moved slowly, citing costs and diplomatic concerns. The meeting in September will test whether the EU can bridge these differences and move toward a common approach that balances security, trade, and technological competitiveness.
