The cybersecurity bill will define how authorities can assess risk in critical sectors, and how it will decide which suppliers to bar from parts of its market. That would include risks like whether the companies making components are based in countries unfriendly to the EU, particularly China.
Because the risk assessment and measures have already been defined in the telecom sector, it’s possible to make a decision on formally blocking high-risk 5G suppliers. The bill would not “convert” the toolbox — which is voluntary — into a mandatory requirement; instead, the law itself will state that the high-risk vendors should be blocked.
Virkkunen said that there will be a three-year transition period for operators to phase out high-risk suppliers after the law comes into effect. The EU executive estimates that the “economic impact” of phasing out high-risk vendors from the mobile network would be between €3 billion-€4 billion, she said.
EU capitals are “now investing heavily [in]to defense and security, and at the same time, we can’t have that kind of situation [where] we have high-risk vendors in a critical part of our critical infrastructure,” the executive vice president said.
The Commission reckons it’s not yet possible to formally block suppliers in sectors beyond telecoms, because the work to identify risks has not been done in those sectors.
Companies that have previously faced calls for stricter scrutiny include airport security scanner maker Nuctech, surveillance camera maker Hikvision, Huawei’s components that connect solar panels to Europe’s energy grid, and Chinese connected cars makers. Some European governments as well as the EU have also barred their officials from using Chinese-owned social media app TikTok on work phones.