EU's Huawei ban isn't a procurement decision, it's a dependency inventory problem

On May 4, 2026, the European Commission reiterated its recommendation to exclude Huawei and ZTE from critical infrastructure, and the January edition of the Cybersecurity Act (CSA2) will make this mandatory for 18 sectors with a 36-month phase-out period. Cost estimates vary by 3–4 times: EC — €10–13 billion, GSMA — €30–40 billion.

• CSA2 will turn 2020 voluntary recommendations into mandatory law
• Proposed equipment phase-out period is 36 months after entry into force
• EC estimates replacement at €10–13 billion, GSMA at €30–40 billion
• Germany is phasing out core network from 2026, RAN and management systems by 2029