Europe's Fractured Tech Security Strategy Leaves Members Vulnerable to Supply Chain Threats

Disjointed Rules Create Security Vulnerabilities Across the Bloc

The European Union faces a critical credibility problem in managing technology security. While Brussels drafts increasingly stringent regulations, member states pursue dramatically different strategies when it comes to sourcing critical infrastructure equipment. This fractured approach, according to research from the Royal United Services Institute, leaves the entire bloc exposed to supply chain vulnerabilities that no single country can adequately address alone.

The core issue centers on Chinese technology vendors, particularly companies like Huawei and ZTE. These firms have become major suppliers of telecommunications infrastructure across Europe. However, the EU currently lacks binding standards that would force uniform responses to the perceived risks these vendors present. The result resembles a patchwork of national policies that undermines collective security objectives.

Consider the starkly different trajectories across three major European economies. Germany maintained substantial reliance on Chinese suppliers, with an estimated 59 percent of its 5G network equipment sourced from Chinese vendors as of 2024. This reflects Berlin's longstanding prioritization of economic relationships over security concerns; China represents Germany's most important trading partner, worth roughly 284 billion dollars annually. Even under Chancellor Friedrich Merz, who has signaled a gradual shift in approach, material changes to Germany's network composition remain unlikely in the near term.

Spain occupies a middle ground. Chinese equipment comprises approximately 32 percent of Spanish 5G infrastructure, a share expected to decline. However, Spain's procurement decisions historically favored cost-effective solutions over security precautions. This orientation shifted somewhat following controversy over a Huawei contract involving storage of sensitive judicial wiretap recordings, yet Spanish leadership does not articulate the same level of concern about China as do the UK or US authorities.

The United Kingdom represents the opposite extreme, committed to complete elimination of Chinese technology from its telecommunications networks by the end of 2027, responding to intense pressure from Washington regarding geopolitical security implications.

Defining Risk Remains Elusive

The proposed solution faces an awkward prerequisite: the EU must first define what constitutes a high-risk vendor before it can effectively police supply chains. Currently, no official definition exists, nor does "high-risk vendor" function as a legal category. This definitional vacuum creates precisely the kind of loophole that allows countries to circumvent scrutiny by pursuing their preferred suppliers under ambiguous standards.

The European Commission proposed amending the Cyber Security Act earlier this year, which would grant authority to establish a list of untrusted vendors that all members must exclude from critical infrastructure. The amendments would require countries to remove equipment from designated vendors within 36 months, a compressed timeline that would necessitate massive infrastructure overhauls.

Brussels has signaled intent to designate Huawei and ZTE should the amendments gain approval. However, without clear criteria for determining what qualifies as high-risk, these designations risk appearing arbitrary or politically motivated rather than technically justified.

Real Security Foundations

RUSI acknowledges that concerns about Chinese technology vendors rest on substantive security grounds. Chinese law grants the government broad authority to compel companies to provide data, host Communist Party officials, and restrict vulnerability disclosures from international partners. Chinese firms must report discovered vulnerabilities to the state within 48 hours while withholding the same information from overseas entities.

The challenge for European policymakers involves balancing legitimate security concerns with respect for member state autonomy and economic interests. A unified framework must account for sector-specific risk profiles; vulnerabilities affecting telecommunications networks do not necessarily translate directly to other industrial sectors.

Without decisive action that establishes clear standards and applies them consistently across the bloc, individual member states will continue pursuing divergent strategies that ultimately weaken European security posture as a whole.