10 reasons why Connect Europe shot themselves in the foot with their new report: ”The European Commission’s Cybersecurity Act 2 Proposal: An Impact Assessment of Title IV”

Two weeks ago, Connect Europe published a new report, The European Commission’s Cybersecurity Act 2 Proposal: An Impact Assessment of Title IV. In this note, Strand Consult examines the report’s claims against the facts.

Early in the report, Connect Europe states that “European operators have publicly expressed support for the EC’s pursuit of security as the end goal of the CSA2.” Yet the report then spends 64 pages defending the High-Risk Vendor (HRV) position that some operator groups have continued to advocate—even though the EU adopted the 5G Toolbox in 2019, seven years ago.

This is the fundamental contradiction. Connect Europe represents operators responsible for Europe’s digital infrastructure—the foundation of modern society. The organization therefore has a responsibility to take seriously the security and resilience of that infrastructure. Yet it continues to defend the use of Chinese infrastructure despite the security concerns that led the EU to establish the 5G Toolbox in the first place.

Strand Consult’s recommendation is simple: Connect Europe, formerly ETNO, should consider a more honest name: ”Connect China”.

The problem is not merely that its position is outdated. It suggests a profound failure to understand the strategic reality of China and what the Chinese system represents for European security and critical infrastructure.

10 reasons why Connect Europe shot themselves in the foot:

1. Security policy: Connect Europe forget to tell that the operators that continued to deploy High-Risk Vendors after the introduction of the EU’s 5G Toolbox 2019 made a deliberate commercial decision that was inconsistent with the direction established by the European Union and subsequently implemented by many Member States.
   Those operators accepted regulatory, financial, and geopolitical risks that were both foreseeable and avoidable. The principal High-Risk Vendors are headquartered in China, a country that has declared a “no limits” strategic partnership with Russia and maintains close strategic relationships with Iran and North Korea. These geopolitical realities form part of the rationale behind the EU’s security framework.

2. Vital infrastructure: Connect Europe does not address the fact that NATO, first responders, and other mission critical entities require access to secure infrastructure. Read this note: The Next Big Opportunity for Mobile Operators: Mission Critical Communication for Defense, Public Safety and Emergencies

3. The effect of the UK restrictions. Connect Europe claims that restricting HRV will harm the rollout of 5G in Europe, citing the United Kingdom market’s 2020 rule That claim was already debunked in this note: 5G rollout slowed while mobile operators await merger approval. Case in point: the slow rollout in UK. 
   
   For example, Connect Europe claims “BT UK reportedly will have spent £500m (€579m) removing Huawei equipment from its network.” In point of fact, on BT’s investor call on 30 January 2020, the company estimated that complying with the UK’s Huawei restrictions would cost approximately £100 million per year over five years. BT also explained that much of this represented the acceleration of planned investment rather than entirely new expenditure. The annual impact corresponded to approximately 2.4 percent of BT’s annual network capital expenditure. Importantly, the UK’s restrictions covered both mobile and fixed broadband infrastructure. This is not the catastrophe Connect Europe claims.

4. Market definition: Connect Europe portrays the challenge as widespread across the EU. In fact, the risk is concentrated in a handful of large Member States and operators. Connect Europe does not disclose how widespread the problem actually is across the EU and, unfortunately, has not identified the operators that have failed to implement the EU’s 5G Toolbox. Exposure to High-Risk Vendors (HRVs) is now concentrated in a small number of Member States. There are approximately 100 5G networks in the EU, of which around 60 were supplied by trusted vendors—Samsung, Nokia and Ericsson—at the beginning of 2026. Approximately 10 additional networks are expected to be supplied exclusively by trusted vendors by the time the Cybersecurity Act (CSA2) comes into effect, following national implementation of the 5G Toolbox.
   
   Approximately 30 networks still have between 35 and 100 percent of their radio access network (RAN) supplied by High-Risk Vendors. This does not apply to the core network, which has already been upgraded for 5G using trusted suppliers. These networks are owned and operated by a limited number of operators across Europe that made a commercial decision to retain High-Risk Vendors when upgrading their 4G equipment to 5G, and they continue to do so as of early 2026. These operators should have understood, based on the action taken by the European Commission and at least half of the EU Member States under the 5G Toolbox from 2019, that this was not a prudent decision.
   
   A substantial share of the equipment scheduled for replacement over the next five years is concentrated in Germany (Vodafone, O2, and Deutsche Telekom), Italy (Vodafone and Wind Tre), and Spain (MasOrange and Vodafone). Based on Strand Consult’s analysis, combined with figures from the EU’s Regulatory Impact Assessment as well as the underlying figures, these three countries make up over 55% of equipment that must be replaced over the next five years, which presents the opportunity to replace the supplier.
   
   Vodafone and Deutsche Telekom (DT) are particularly significant in this context. DT operates across multiple countries with varying levels of exposure to high-risk suppliers, including Germany (58%), Greece (100%), Austria (100%), the Czech Republic (100%), Croatia (50%), and Poland (70%). In addition, its subsidiary T-Systems resells cloud solutions built and operated on Huawei infrastructure. Vodafone is also heavily exposed in several European markets, including 100% reliance on Huawei in the Czech Republic, Greece, Hungary, and Romania, as well as 67% in Spain and 53% in Germany.

5. Competition: The report argues that reducing the number of infrastructure suppliers will weaken competition. Yet the consolidation of the global RAN equipment market has largely been driven by mobile operators’ own purchasing decisions. Recent procurement decisions, including Vodafone/Three UK’s choice of Nokia and Ericsson over Samsung, demonstrate that operators continue to shape the supplier market through their commercial choices.
   
   If supplier concentration is considered a concern in Europe, the same analytical standard should be applied to other markets, including Korea, the United States, Australia and New Zealand. China’s mobile infrastructure market, for example, is overwhelmingly supplied by Huawei and ZTE, yet Connect Europe has not publicly argued that this level of supplier concentration represents a competition concern. Applying consistent principles across markets would strengthen the credibility of the debate.
   
   There is also an apparent double standard in the position of some operators. The same operators argue that Europe has too many mobile operators and that consolidation is needed in the mobile market. Strand Consult agrees that consolidation is warranted. Yet these operators simultaneously argue against consolidation in the infrastructure supplier market. They cannot logically argue for fewer competitors in one market while insisting that more suppliers are needed in another. Strand Consult’s research on mobile market consolidation is available here: Consolidation – Strand Consult

6. OpenRAN: Connect Europe says OpenRAN is not an alternative to existing RAN suppliers, and Strand Consult can only agree. Yet operators such as Deutsche Telekom and Vodafone have, for years, publicly promoted OpenRAN as a means of replacing Huawei and other incumbent suppliers. This raises an obvious question: were these operators wrong when they promoted OpenRAN as a major alternative to existing suppliers, or was that narrative used to create the political and regulatory space to continue using equipment from Huawei and ZTE?

7. Rip & replace: Connect Europe presents this as a disruptive “rip-and-replace” scenario. In reality, the actual process is a phased replacement and network upgrade over a period of months or years. The issue is not the immediate removal of existing equipment but the gradual phase-out of High-Risk Vendors (HRV) as networks are upgraded.

8. Time consuming: Connect Europe’s claims about deployment are contradicted by established facts, publicly available data, and the real-world experience of European operators. Connect Europe itself states that “the costs involved” and the “extremely tight timelines” proposed for removing Huawei, Russia and Venezuela (HRV) from the RAN are likely to create significant disruption to services for users and pose risks to network resilience. Denmark provides a useful case study. Two of the country’s three mobile networks previously relied on HRV, yet Denmark now has some of Europe’s highest-performing 5G infrastructure, according to multiple independent studies.

9. Building permits: Connect Europe claims that replacing active equipment on existing masts and antennas would require new building permits. Strand Consult disputes this claim, as it has studied and worked with the regulation of mobile infrastructure markets for many years, including the processes governing the construction, operation, and modernization of mobile networks.
   
   Strand Consult cannot rule out the possibility that one or two European jurisdictions may have specific rules requiring additional approval for certain equipment replacements. However, that is very different from suggesting that replacing active equipment on an existing site generally requires a new building permit. In the countries Strand Consult has examined globally, once a mobile site has been legally established, operators can replace and modernize the active equipment on that site as part of normal network evolution.
   
   Strand Consult’s research distinguishes between the regulatory process required to establish a mobile mast or site and the subsequent operation and modernization of the network. The former can involve lengthy permitting processes; the latter does not ordinarily require a new building permit simply because the active radio equipment is replaced.
   Strand Consult’s extensive research on mobile infrastructure regulation, including the costs and regulatory barriers associated with deploying and operating mobile networks, is available here: Strand Consult — Infrastructure Research

10. Access to subsidies: In the report, CE describes what they call the “rip and replace case from the United States”, the problem is that their portrayal of what has happened in the United States is not accurate. On top of that, they forget to mention that none of the three operators in the United States, who have 98% of the American customers (Verizon, AT&T and T-Mobile), have newer used or are using Chinese equipment. The operators that we are talking about in the United States are some very small operators that primarily service customers in the outskirts of America. Please read this article: European telcos must learn from US rip and replace programme

It is reasonable to debate whether the Chinese companies affected by CSA2 are correct in claiming that the regulation will cost billions. It is equally reasonable to examine the GSMA’s estimate that CSA2 will cost between €30 and €40 billion, as well as the European Union’s own risk assessment underpinning the proposal. Strand Consult has followed this issue for many years with the objective of increasing transparency in a debate where key assumptions and calculations have often received limited scrutiny.

Germany provides a useful case study. Approximately 58 percent of the country’s mobile sites—equivalent to around 46,000 sites—still use Huawei 5G RAN equipment. Based on Strand Consult’s research, replacing this equipment with 5G RAN equipment from trusted suppliers would cost approximately €50,000 per site. This results in an estimated total replacement cost of €2.5 billion, distributed approximately as follows: Deutsche Telekom: €1.1 billion; Vodafone Germany: €0.7 billion; and Telefónica Germany: €0.7 billion.

For comparison, Deutsche Telekom is estimated to invest approximately €300 million annually in RAN infrastructure in Germany. Viewed in this context, replacing all Huawei 5G RAN equipment represents a one-time capital investment rather than a recurring operating cost.

Expressed differently, the total replacement cost is equivalent to approximately €29 per German citizen. This provides a useful benchmark for assessing the economic impact of replacing High-Risk Suppliers.

Strand Consult welcomes the fact that Connect Europe and GSMA Intelligence has attempted to quantify the cost of securing Europe’s digital infrastructure. Whether the one-time cost is €10, €20, or €30, per European citizen is an important policy question. That figure should also be considered alongside the potential economic and security consequences of allowing vulnerabilities to persist in Europe’s telecommunications infrastructure, including the risk of disruption to critical communications services.

Put differently, if the one-time investment required to secure Europe’s telecommunications infrastructure amounts to the price of 5 to 10 cups of coffee, the relevant policy question is whether that is a reasonable premium for reducing reliance on High-Risk Suppliers operating under the jurisdiction of the People’s Republic of China.

Conclusion

The report that Connect Europe has published does not look like a report that comes from companies that take Europe’s security seriously. It is a direct attack on the security analyses and conclusions that EU and a number of countries have made in relation to the use of High-Risk Vendors.

The picture Connect Europe paint is that the use of equipment from High-Risk Vendors is a pan-European problem. Today 60 soon 70 out of 100 mobile networks in Europe use equipment from Trusted Vendors. The use of equipment from HRV is primarily limited to three countries (Germany, Spain and Italy) and two operator groups Deutsche Telekom and Vodafone.

Europe needs a regulatory framework that encourages investment, innovation, and consolidation. For many years, Strand Consult has published research documenting why excessive regulation has weakened the competitiveness of the European telecommunications industry relative to markets such as the United States, South Korea, and India.

However, advocating regulatory reform should not come at the expense of national security. The credibility of the industry’s policy agenda is weakened when the same organizations argue that telecommunications operators provide critical national infrastructure while simultaneously defending, or seeking to delay the phase-out of, High-Risk Suppliers that European governments have concluded should no longer form part of that infrastructure.

Rather than focusing on practical solutions for the relatively small number of operators that continued to deploy High-Risk Vendors after 2019, the report attempts to portray their commercial decisions as a challenge for the entire European telecommunications sector. The evidence suggests otherwise. The transition to trusted vendors has already been completed, or is well underway, across most European mobile networks. The remaining costs are the consequence of commercial decisions made by a limited number of operators despite more than a decade of evolving security policy and clear regulatory signals from the European Union.

Over the past eight years, Strand Consult has published extensive research on the security, economic, and competitive implications of relying on High-Risk Vendors. That research has consistently challenged many claims made by both certain operators and High-Risk Vendors regarding the costs and consequences of supplier replacement.

The evidence from Europe is clear. Countries and operators that implemented the EU’s 5G Toolbox have successfully transitioned to trusted vendors while maintaining competitive 5G deployment and network performance. At the same time, some operators continue to argue that they play a critical role in national security while choosing to retain High-Risk Vendors in their networks. As national security becomes an increasingly important consideration for governments, regulators, investors, and enterprise customers, that position is becoming progressively more difficult to justify.