European Commission lays the groundwork to ban Huawei from strategic infrastructure

Strasbourg.- The European Commission presented this Tuesday the new cybersecurity law of the European Union that creates the basis to be able to prohibit the participation of the Chinese firms Huawei or ZTE in the development of essential infrastructures. The Executive has considered since 2019 that both companies pose a risk to European security and, given the refusal of some countries, including Spain, to restrict them voluntarily, today proposed a rule to promote their definitive prohibition in key sectors. «Cybersecurity threats are not just technical challenges. They are strategic risks to our democracy, our economy, and our way of life. With the new cybersecurity package, we will have the necessary means to better protect the supply chain of our information technologies,» said Commission Vice-President Henna Virkkunen, in charge of digital policy.

We recommend reading: The European Commission presents a major environmental simplification package

Protection of 5G and 6G Networks

Brussels gives special importance to the protection of 5G and 6G networks, but also identifies ten other areas such as the supply of water and electricity, cloud computing services, surveillance equipment, medical equipment or semiconductors, in which it is advisable to ban access to companies that pose a risk to European security. The regulation does not point to any country or any company that must be prohibited in advance, but it establishes a system to identify the risks faced by the EU and to draw up a list of those actors that must be restricted.

Risk Assessment

The Commission may initiate the risk assessment on its own initiative or because three Member States request it and, once it has included the companies of the problematic countries in the list, the countries will be obliged to ban them in a maximum of three years.

Until now, the Community Executive recommended to countries the exclusion of Huawei and ZTE in the development of telecommunications networks. «I cannot predict in advance what will be on the list, but obviously, the market has not changed», Community sources said.

"The Commission has a clear direction for action," other sources added. The rule contemplates exceptional situations in which a company could be excluded from the list or the possibility of including others, even though their countries do not pose a risk.

You can also read: The European Commission opens an investigation into Google for using online content to feed its AI

European Union Agency for Cybersecurity

Poland, France, and Spain were the three European Union countries that suffered the most cyber incidents last week (97, 14, and 8, respectively), as reported this Tuesday by the European Commission, based on public data from the European Union Agency for Cybersecurity (ENISA). Brussels also underlined that Germany, France, Italy and Spain had to allocate 307 billion euros between 2020 and 2025 to deal with cyber attacks. Therefore, Brussels proposes to reinforce ENISA's role in a standard that the EU countries and the European Parliament will now have to negotiate before it comes into force.