EU Security Gaps Persist Amid Fragmented Tech Procurement

The European Union's lack of a unified procurement strategy is creating security vulnerabilities that Chinese technology firms are positioned to exploit, as first reported by The Register in a report from the Royal United Services Institute (RUSI).

Reporting from The Register highlights a significant divide in how member states handle high-risk vendors. For example, Chinese suppliers accounted for an estimated 59% of Germany's 5G RAN in 2024, while Spain's share was estimated at 32% for the same period. While the UK intends to fully remove Chinese technology from its telecoms network by the end of next year, Spain has historically prioritized cost-effectiveness, recently awarding Huawei a contract for storing judicial wiretap recordings.

RUSI notes that these discrepancies persist because the EU lacks an official legal definition of a "high-risk vendor." Furthermore, the EU Toolbox for 5G Security, launched in January 2020, remains voluntary; only 10 of 27 member states have fully implemented it.

To address these gaps, the European Commission proposed amendments to the Cyber Security Act (CSA) that would establish a list of untrusted vendors to be excluded from 18 critical sectors. The Commission has indicated that Huawei and ZTE would be listed if the amendments pass, requiring member states to rip and replace such equipment within 36 months.

RUSI argues these concerns are well-founded, citing Chinese laws that allow the state to demand data, host Chinese Communist Party representatives, and require companies to report vulnerabilities to the government while withholding that information from overseas counterparts. Beyond technical risks, RUSI warns that China's ability to offer more capable products at lower prices creates "unwelcome dependencies" within crucial supply chains.