European governments remain divided over how aggressively to sideline Chinese technology vendors from critical systems. A new analysis from the Royal United Services Institute makes that fracture clear. The UK-based think tank argues the bloc’s current approach leaves too many members exposed to supply-chain weaknesses that Beijing could exploit. The Register reported on the findings October 1.

RUSI researchers examined policies in Germany, Spain and the UK. They found sharp contrasts. Germany, with annual trade with China topping €251.8 billion, has long prioritized economic links over aggressive risk reduction. Spain maintains contracts with Huawei for sensitive law enforcement data storage. The UK, post-Brexit, adopted stricter limits on Chinese gear in its networks.

These differences matter. Chinese vendors such as Huawei and ZTE sit deep inside telecom, energy and other essential infrastructure across the continent. Concerns about them aren’t abstract. Chinese law requires companies to assist state intelligence efforts on demand. Party representatives sit inside firms. Data can flow to authorities without meaningful pushback. RUSI calls those worries “well-founded.”

Brussels has tried to impose order. The proposed overhaul of the EU Cybersecurity Act would let the Commission designate high-risk suppliers and force their removal from 18 critical sectors. Initial drafts called for a 36-month rip-and-replace deadline for telecom operators. Yet member states pushed back. A September 22 council document, seen by Reuters, drops the fixed timeline. Replacement schedules would instead factor in risk levels, equipment life cycles, interoperability needs and alternative availability. Reuters detailed the shift on September 29.

Industry warnings drove much of the hesitation. Seventeen senior telecom executives, including leaders from Deutsche Telekom, Orange and Telefónica, warned that accelerated replacement could cost the sector up to €40 billion. That figure doesn’t count broader economic ripple effects. A KPMG study commissioned by China’s Chamber of Commerce to the EU put the five-year hit across all sectors at €367.8 billion, with Germany alone facing €170.8 billion. Reuters covered the Chinese-backed assessment in May.

Pushback from capitals isn’t new. Officials in Berlin and Madrid have resisted ceding more authority to the Commission. They worry about sovereignty, implementation costs and potential Chinese retaliation. Some sectors see Chinese offerings as cheaper or even superior in areas like solar inverters and certain 5G components. Yet the security case has grown stronger. Reports of hidden communication devices in Chinese inverters have raised fresh sabotage fears. The Mercator Institute for China Studies noted in June that 20 Chinese vendors stand out for their risk profile given their supply-chain centrality and Beijing’s legal environment. MERICS outlined the fragmentation.

So the EU finds itself caught. National leaders guard procurement decisions as matters of core security. At the same time, uneven rules create collective vulnerabilities. One member’s relaxed stance on a vendor can undermine the bloc’s overall resilience. Data that crosses borders doesn’t respect national boundaries. Neither do cyber threats.

RUSI recommends a new common risk-assessment framework. It would apply bloc-wide while preserving members’ rights to set their own national security red lines. The think tank also suggests rethinking procurement criteria. That could bring American suppliers under closer review too, not just Chinese ones. The goal isn’t blanket exclusion but smarter, consistent evaluation of trust factors such as ownership, governance and legal obligations.

Recent developments add urgency. EU governments are negotiating the Cybersecurity Act revisions with the European Parliament. Any final text will likely blend Commission ambitions with member-state pragmatism. Telcos may win extra time. Yet the direction points toward tighter controls. Huawei denies its products pose special dangers. It calls the measures discriminatory and says it delivers secure equipment.

Broader tensions complicate choices. China has expanded its own economic security tools, making diversification moves by Western firms riskier. Beijing can investigate, restrict or penalize actions it views as harmful to its supply chains. MERICS warned in late September that this arsenal could raise the price of European de-risking efforts. The update appeared September 25.

Germany’s position illustrates the trade-offs. Its economic dependence on China remains massive. Yet Berlin has tightened some rules on sensitive investments and research partnerships. Spain continues to see value in Huawei partnerships dating back years, including a €12 million contract for wiretap storage signed in 2025. The UK, unbound by EU rules, moved faster to limit exposure.

These national stories add up to a patchwork. And that patchwork creates openings. Adversaries don’t need every system compromised to cause damage. They need enough footholds to disrupt at scale during a crisis. Supply chain dependencies multiply the leverage.

European officials increasingly speak of economic security alongside traditional cybersecurity. The December 2025 Joint Communication from the Commission and High Representative diagnosed risks from China’s techno-industrial model. It called for reduced dependencies in strategic areas. Implementation, however, lags. The European Think-tank Network on China documented the resulting fragmentation across 24 national chapters in its 2026 report.

Costs will test political will. Replacing embedded equipment isn’t simple. Networks must stay operational. New suppliers must scale. Prices may rise as the pool of approved vendors shrinks. GSMA Intelligence estimated €30 billion to €40 billion for telecom alone, with added expenses for higher equipment costs through 2030.

Yet delay carries its own price. Persistent reliance on vendors subject to foreign compulsion laws invites espionage or sabotage risks. Intelligence services in several countries have reached similar conclusions about Huawei and ZTE. The U.S. banned them from federal networks years ago on comparable grounds.

Brussels now aims for mandatory measures where previous recommendations proved uneven. The 5G Toolbox encouraged exclusion of high-risk suppliers. Roughly 10 member states acted. Many others did not. That gap explains the push for binding rules.

RUSI’s report lands at a pivotal moment. EU institutions and governments are hashing out the Cybersecurity Act’s final shape. The outcome will signal how seriously the bloc takes supply-chain sovereignty. A watered-down framework that leaves too much discretion could simply codify existing inconsistencies. A tougher version risks economic pain and diplomatic friction with Beijing.

Neither path looks easy. Short-term procurement savings or trade volumes pull against long-term resilience needs. Fragmented policy satisfies no one fully. It protects some markets while exposing the whole. Industry wants predictability. Security agencies want fewer single points of failure.

The conversation has expanded beyond telecom. Solar, connected vehicles, medical devices, cloud services and semiconductors all fall under the proposed rules. Chinese firms hold strong positions in several. Shifting away requires investment, time and alternatives that aren’t always ready at equivalent cost or performance.

Still, momentum builds toward tighter standards. Recent MERICS analysis shows China accelerating its own innovation push under the 15th Five-Year Plan. Europe cannot afford to treat technology supply as purely commercial. Strategic dependencies have security consequences.

Procurement reform, as RUSI suggests, offers one lever. Clear, shared criteria for vendor trustworthiness could reduce arbitrariness. Assessments would weigh legal environments, ownership transparency, cooperation with foreign intelligence and track records. Such a system might scrutinize any supplier, American or otherwise, that fails key tests.

Europe’s approach to China on technology has evolved. Unconditional openness has given way to de-risking rhetoric. Turning that rhetoric into coherent practice remains the test. The RUSI critique highlights how far the bloc still has to go. Inconsistent national policies don’t add up to collective defense. They add up to collective exposure.

Negotiators in Brussels will soon face choices on timelines, scope and enforcement. Industry cost concerns are real. Security gaps are real too. The compromise they reach will shape European infrastructure for years. And it will signal whether the EU can act as one on matters where fragmentation carries strategic cost.