“If the EU designates China as a ‘country posing cybersecurity concerns’ or lists Chinese entities as ‘high risk suppliers’ to phase out equipment manufactured by Chinese businesses in a compulsory manner and exclude Chinese products and services from the EU market, China can launch relevant investigations into the EU or EU businesses, and take reciprocal measures,” stated a submission from the ministry in response to the commission’s request for feedback.
The sweeping new cybersecurity act would, if adopted, create a framework that would compel EU members to remove firms identified as a security risk from their 5G networks – a measure that has so far only been recommended – within three years of coming into force.
It marks the first time Brussels has attempted to make removal mandatory and could be the tip of the iceberg for Chinese firms such as Huawei and ZTE.
Under the act, the EU can designate an entire country as a “cybersecurity threat”. This would then see companies from that country excluded from sectors across the 27-member union, starting with telecommunications but then extending into a raft of hi-tech industries and critical infrastructure.
In future, designated companies could be considered off limits in sensitive sectors, including connected vehicles, electricity and water supply and storage, cloud computing, medical devices, space services and semiconductors, according to the proposal.
