The European Commission itself estimates that replacing 5G equipment supplied by so-called “high-risk” vendors in EU networks will cost between 10.2 billion and 12.9 billion euros over three years. European telecoms groups, by contrast, put the bill as high as 40 billion euros. But one question remains unanswered: who will foot it?
The new Cybersecurity Act (Cybersecurity Act 2.0 – CSA2) was presented by the European Commission on 20 January 2026 and is now going through the usual legislative process at the EU institutions.
Although the text is still being developed, the likely direction is already becoming clear for procurement of technology equipment, contracts and investment by critical infrastructure companies and, above all, telecoms providers.
The implications of the proposed framework are examined in a study by the Cybersecurity and Artificial Intelligence Technologies postgraduate programme at the University of Piraeus, under the academic supervision of Professor Christos Xenakis, in collaboration with the Hellenic Cybersecurity Institute. The question is not whether Europe needs greater digital security, but who will pay the cost that, as things stand, the CSA2 proposal is likely to entail.
One certificate for 27 markets
The CSA2 proposal has some positive features for equipment manufacturers, as it seeks to replace today’s “patchwork” of national requirements with a single European certification framework for information and communications technology (ICT) products and services.
Under the draft, ENISA will develop certification schemes, which the Commission will approve, while various accredited bodies will issue certificates valid across the European market.
Within the product and service areas it covers, the single European certification scheme will leave member states no scope to add their own requirements to the process. In practice, a certified product will gain cheaper access to 27 markets with a single certificate.
Certification will initially be voluntary, while the level of requirements will rise depending on the product and its use. Another innovation is a proposal to allow, for the first time, certification of a company’s overall “maturity” in cybersecurity. In addition, the certification schemes will help companies demonstrate compliance with the Cyber Resilience Act (CRA), although they will not provide full assurance of it.
“Made in…” as a passport
One controversial aspect of the proposal concerns the ICT equipment supply chain. Entities covered by the NIS2 Directive — including telecoms, energy, cloud services, the financial sector and other industries — will be asked to assess their dependence on so-called “high-risk” suppliers and comply with measures to be set out in implementing acts.
The measures could range from transparency requirements and third-party audits to a possible ban on the use of equipment in parts of critical infrastructure. The proposal says the assessment will not be based solely on technical characteristics.
Factors such as ownership, the supplier’s country of origin and its legal environment will also be taken into account, while the Commission wants to be able to designate certain third countries as “high-risk”. The equipment suppliers concerned could be excluded from public contracts and programmes funded by the EU.
The new study describes the framework as vague and open to multiple interpretations. For markets, ambiguity and unresolved scenarios usually lead to investment uncertainty, while fewer available suppliers mean weaker competition and, ultimately, more expensive equipment.
Until now, the choice of suppliers for national digital networks has largely been a national decision. With CSA2, the Commission is seeking authority to make these decisions, restricting member states mainly to a supervisory role — a move the study says raises questions of national sovereignty.
The dilemma for telecoms
The greatest pressure is expected to fall on the telecoms sector. For mobile networks, the proposal allows for the phased replacement of equipment from “high-risk” suppliers within 36 months of publication of the relevant list, even if the equipment is fully operational and meets the technical assessment criteria.
For one specific scenario involving the replacement of 5G equipment, the Commission’s impact assessment puts the cost at between 3.4 billion and 4.3 billion euros a year. A closer reading, however, shows that these figures do not cover the total cost of implementation: installation, staff training, interoperability with existing systems and possible contract renegotiations could multiply the cost.
The industry, however, expects a much higher bill. In a joint statement, the heads of 17 European telecoms groups cite a cost of up to 40 billion euros, referring to a study by GSMA Intelligence.
They also point out that the sector already invests about 64 billion euros a year, while the International Association of Mobile Providers (GSMA) says a further 475 billion euros is needed for Europe to build world-class mobile networks.
This is where the opportunity cost comes in: capital that may have to be diverted to replacing equipment that is working properly — on criteria that are largely non-technical — is expected to be “cut” from investment in 5G, 6G and gigabit networks, subsea cables and other cutting-edge technologies.
Who bears the cost?
The proposal provides no general, guaranteed compensation mechanism for equipment that may have to be withdrawn. The burden therefore falls on providers. The Commission also considers an extreme scenario in which the full cost is passed on to subscribers, adding between 6.5 and 8.3 euros per subscriber a year for three years — a scenario it considers unlikely. That does not mean consumers will be unaffected.
With the sector’s margins already under pressure from competition, any costs not passed on through tariffs are likely to be “cut” from investment plans. End users will bear the cost, if not through their bills, then through slower network and service roll-outs.
The key issues
The impact of the final CSA2 text will depend on a few key areas: the technical and non-technical criteria for assessing equipment suppliers, the scope for choosing equipment on the basis of national criteria, and how the cost is allocated.
No one disputes that Europe needs more secure digital infrastructure. The challenge is to achieve this through measures proportionate to the actual risk and the alternatives available, while providing clear answers to the questions the proposal leaves open. Otherwise, digital security risks coming at the expense of competitiveness and technological progress.
* Professor at the University of Piraeus.