With the so-called Cybersecurity Act 2, the European Union is preparing a reform that would reach deep into the infrastructure of European mobile networks. The goal is to remove network equipment vendors classified by the EU as a security risk from existing networks and to prevent their use in the future. According to industry calculations, this conversion could cost European telecom providers up to 40 billion euros.<\/p>\n\n\n\n
The legislative package builds on the EU's existing 5G toolbox, which has allowed member states to classify individual vendors as high-risk suppliers since 2020. What's new is that the requirements are meant to become more binding and uniform, so that not every country proceeds differently. <\/p>\n\n\n\n
This would mainly affect network components from Chinese manufacturers Huawei and ZTE, which have been in use in many European networks for years.<\/p>\n\n\n\n
The EU Commission argues that uniform security standards are necessary to protect critical infrastructure from manipulation or failures. Several member states, including Germany and the Netherlands, have already adopted or implemented their own phase-out plans for such components. A coordinated approach across the EU is now meant to create legal certainty for all operators.<\/p>\n\n\n\n
Industry associations like GSMA and Connect Europe warn that a complete replacement of the affected hardware would be technically complex and expensive. Base stations, antennas, and core network components would in many cases need to be completely replaced, not just individual parts. The estimated costs of up to 40 billion euros<\/strong> would be distributed across the entire EU, but specific figures for Austria are not yet available.<\/p>\n\n\n\n For network operators, this means not only direct investment costs but also time pressure. A rapid replacement within a few years is considered significantly more expensive than a replacement carried out as part of network expansion that was planned anyway, such as the transition to new mobile generations. The industry is therefore calling for longer transition periods and financial support through EU funding programs.<\/p>\n\n\n\n In Austria, the three major network operators A1, Magenta, and Drei are directly affected by the discussion, since components from the manufacturers in question have been installed here in the past as well. The domestic regulatory authority RTR is monitoring developments at EU level; national implementation would only follow after a final decision in Brussels. Consumer advocates point out that high conversion costs could, in the medium term, also affect end-customer tariffs.<\/p>\n\n\n\n The Austrian federal government has so far not publicly commented on specific timelines, but points to the existing national 5G security strategy, which already provides for review mechanisms for critical components. This is to be adapted to the new EU requirements if necessary.<\/p>\n\n\n\n With the Cybersecurity Act 2, Europe's telecom industry is facing one of the most expensive overhauls of recent years, the costs of which will ultimately have to be borne by operators, investors, and possibly also customers. <\/p>\n\n\n\n How quickly and to what extent the rules actually become binding will be decided in the upcoming negotiations between the EU Parliament, Council, and Commission. Until then, one thing above all remains certain for Austria's network operators: there is currently no planning certainty.<\/p>\n\n\n\n The question is also how good the alternative technologies are, and whether one is protected from security risks there as well.<\/p>\n\n\n\nImpact on Austria<\/h3>\n\n\n\n