In January 2026, the European Commission unveiled its plan to overhaul the EU's Cybersecurity Act, a proposal now known as CSA2. It's the natural next step in a story that began years earlier with the EU's 2020 "5G Security Toolbox" - a set of voluntary recommendations encouraging Member States to be cautious about certain telecom suppliers. That voluntary approach produced patchy results: by most accounts, fewer than half of EU countries had actually acted on those recommendations. It is worth asking whether the adoption levels were however a failure of design, or a reflection of Member States reaching different conclusions about their risk exposures.
CSA2 is, in large part, the Commission's answer to that inconsistency - turning soft guidance into binding law. As EU Commissioner Henna Virkkunen has put it, the goal is to finally finish the job that member states started on their own. That framing is worth a pause however, as its based on an assumption that hasn’t been put to the test yet – that uniformity across the bloc is itself the correct policy outcome, rather than one competing option among several.
What's Actually Changing
CSA2 does several things at once: it modernises voluntary cybersecurity certification, strengthens the EU's cybersecurity agency (ENISA), and - most notably - introduces something genuinely new: an EU-wide system for assessing and managing risk in technology supply chains.
In practice, the framework involves three distinct stages. First, the EU may conduct coordinated, Union-wide security risk assessments of particular ICT supply chains in critical sectors, identifying key ICT assets, relevant threat actors, risks, vulnerabilities and possible mitigation measures. Separately, where an assessment indicates that a third country may pose a serious and structural non-technical risk to ICT supply chains, the Commission carries out a distinct country-level assessment and may designate that country as posing cybersecurity concerns.
The Commission could then have the ability to map suppliers providing ICT components relevant to the applicable prohibitions and assesses whether they are established in, or controlled by, a designated third country, an entity established there or one of its nationals. Suppliers meeting that nexus may then be included on the Commission’s list of high-risk suppliers.
Once listed, the consequences can be significant. Affected entities, namely entities designated as essential or important under Directive 2022/2555 ( the “NIS2 Directive”) , may be prohibited from using, installing or integrating components from those suppliers in identified key ICT assets and may be required to phase out components already in use, while separate restrictions also apply in areas such as cybersecurity certification, public procurement and Union funding.
Telecom networks are treated especially strictly: ICT components or components that include ICT components from suppliers found to be high-risk would need to be phased out of core network functions, to include mobile, fixed and satellite electronic communication networks, within a set timeframe, generally understood to be around three years from inclusion in the publicized list.
This represents a significant development from the framework established under the 2019 Cybersecurity Act. Under that regime, European cybersecurity certification was principally voluntary, enabling suppliers to demonstrate that particular ICT products, services or processes complied with specified cybersecurity requirements. CSA2 retains that certification framework, while introducing a distinct set of measures aimed at addressing non-technical ICT supply-chain risks.
Those measures can have direct implications for suppliers designated as high-risk. Such suppliers would be excluded from obtaining European cybersecurity certification and, where a high-risk supplier has already obtained a European cybersecurity certificate, the competent authority would be required to withdraw it without undue delay.
The proposal introduces a framework for addressing supply-chain risks that are not limited to the technical characteristics of ICT products or components. In assessing whether a supplier should be designated as high-risk, factors such as its place of establishment, ownership and control may also be relevant.
CSA2 therefore moves the EU cybersecurity framework beyond technical certification and assurance towards a more interventionist model, under which suppliers may be restricted or effectively excluded from critical parts of the EU market on the basis of broader supply-chain risk consideration.
Why Suppliers Are in the Spotlight, and the concept of ‘high-risk’
What makes this framework different from earlier EU cybersecurity rules is what it's actually measuring. Historically, cybersecurity law has focused on technical questions: is this product secure, does it have known vulnerabilities, does it meet certification standards? CSA2 introduces a different kind of question altogether — not about the product, but about who owns or controls the company that made it, and where that company is established. A supplier could, in principle, be found high-risk even if nothing is technically wrong with its products, simply because of where it's headquartered or who ultimately controls it. Since the Commission's decision applies across all 27 member states at once, the stakes for any individual supplier are much higher than under the old, country-by-country approach.
This is really the heart of the matter. Under the current draft, a country can be judged to pose a "structural" risk to supply chains without pointing to any specific technical flaw in a specific product. Suppliers connected to that country -even through indirect ownership or oversight - could then be swept into the high-risk category. There is a route for a supplier to argue its way out of that label, by way of a reasoned request, but legal commentators have suggested the bar for doing so looks quite high in practice. Such a reasoned request must be supported by clear evidence that effective mitigating measures will be implemented to address the identified non-technical risks and to prevent any possible undue influence by designated third countries. The assessment nevertheless remains within the Commission’s discretion, while the criteria for determining what constitutes an “effective” mitigating measure are both critical to the operation of the mechanism and, at present, insufficiently defined.
The practical concern is that two suppliers may offer products that are, from a cybersecurity perspective, genuinely comparable - similarly designed, similarly certified and similarly tested - yet be subject to materially different regulatory treatment because of the jurisdiction in which each supplier is established. In such cases, the decisive factor may shift away from demonstrable technical performance and towards non-technical considerations associated with the supplier’s country of establishment, ownership or control.
A company could invest heavily in secure design, pass every available certification, and still find itself designated high-risk on the strength of its ownership structure alone - while a less rigorously tested competitor from a "safe" jurisdiction sails through untouched. That asymmetry is difficult to justify on security grounds alone, whatever its other merits. The European Telecommunication Standards Institute (ETSI) - representing more than 900 organisations across 64 countries - has raised its own concerns that parts of the proposal could sideline capable contributors to European technical standards regardless of the quality of their work.
There is a serious question as to whether the measures contemplated by CSA2 go beyond what is necessary to achieve the proposal’s stated policy objectives. Although the proposal preserves the ability of Member States to adopt further measures on national security grounds, a Union-level requirement to exclude designated high-risk suppliers may, in practice, materially constrain Member States’ discretion over which suppliers may participate in critical supply chains. This, in turn, raises broader questions of necessity, proportionality and legal certainty, particularly given the degree of decision-making authority concentrated at Commission level.
The potential unwanted effects
There's a practical case for caution here, regardless of where one lands on the broader debate. Industry group GSMA estimates that stripping high-risk equipment out of Europe's mobile, fixed and transport networks could cost somewhere between €30 and €40 billion, and could push up equipment prices by roughly a quarter as fewer suppliers compete for the same business. Costs of that size rarely stay confined to the boardroom: operators facing steeper equipment bills tend to pass at least part of that increase on to their own customers, so the effect is unlikely to remain a B2B matter alone - ordinary consumers could end up paying more for connectivity as a result. Simultaneously, forcing operators to abandon established suppliers all at once tends to concentrate the market around whoever is left, which can quietly recreate the very dependency problem the rule was trying to solve - just shifted from reliance on third-country suppliers to reliance on a shrunken pool of remaining providers who may struggle to absorb that much displaced demand at once.
There is also a practical question of readiness. Regulated entities designated as essential or important under the NIS2 Directive will need sufficient visibility over their own supply chains to identify where components supplied by a newly designated high-risk supplier are deployed and to assess the operational impact of any resulting restrictions or phase-out requirements. For businesses operating complex or multi-tiered supply chains, this exercise is unlikely to be straightforward and may prove both costly and time-consuming.
Add tight replacement deadlines into the mix, and a lot of that cost and disruption looks likely to land on European businesses and consumers - the operators and critical-sector companies the rule is meant to protect - rather than on the suppliers it's aimed at.
None of these costs would necessarily disqualify the policy on their own - resilience sometimes has a price worth paying. But they do suggest that a narrower, evidence-based approach to designating suppliers, rather than a broad country-level sweep, would let regulators target genuine risk without pulling reliable, well-tested suppliers into the same net as genuinely problematic ones. That distinction matters both for cost control and for keeping enough competition in the market to avoid trading one dependency for another.
A More Grounded Way Forward
This is not to suggest that supply-chain risk is not real, or that certain suppliers may not warrant enhanced scrutiny. The concern is rather that a classification framework which places substantial weight on a supplier’s place of establishment, ownership or control, without equivalent emphasis on product-level technical performance, may prove difficult to apply with sufficient consistency and predictability. A more evidence-based approach, giving greater weight to demonstrable technical characteristics and product-specific risk, could strengthen the defensibility of the regime while reducing unnecessary disruption for European businesses required to respond to designation decisions. This is likely to remain an important point of debate as the proposal progresses through the legislative process.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
