European households and businesses could eventually be affected by the European Commission’s proposed revision of the EU Cybersecurity Act, presented on 20 January 2026. The proposal would establish an EU process to identify high-risk information and communications technology suppliers and restrict their use in critical assets. It covers mobile, fixed and satellite electronic-communications networks, potentially extending the debate beyond mobile infrastructure to equipment in fixed-access networks.
The proposal is not an immediate blanket ban. Restrictions would depend on the regulation’s final approval, formal identification of suppliers and subsequent implementation decisions. While the draft does not name specific companies, Huawei and ZTE are widely viewed as possible candidates for designation. Measures would apply through the supplier-identification process, not through an explicit brand-specific prohibition.
From Recommendation to Requirement
The proposal would create a formal EU-level structure to designate high-risk suppliers, moving beyond reliance on national discretion or nonbinding guidance. If adopted, the structure could make restrictions binding once suppliers and affected assets are identified. The distinction matters: the proposal itself does not require consumers to replace equipment as soon as it is presented.
For mobile networks, the Commission’s draft sets a maximum phase-out period of 36 months from publication of the applicable high-risk-supplier list. Fixed and satellite networks are also within the proposed scope, but the draft sets no equivalent definitive deadline for them. Grupo Tecón’s analysis of the proposal notes that later implementing decisions would determine how the measures apply across different network types. The treatment of household routers, optical network terminals (ONTs) and other customer access equipment so depends on the final legal text and subsequent decisions.
The legislative timetable remains active. The European Parliament published a draft report on 18 September 2026 and registered further amendments on 13 October. A Council negotiating version dated 22 September was reported to remove the fixed 36-month deadline, instead tying phase-out periods to risk, infrastructure life cycles, interoperability and the availability of suitable alternatives. RIPE Labs has described the Council’s preliminary approach as a more gradual, risk-based transition that would give member states a greater role in supplier designation. These positions differ from the Commission draft. The 36-month period remains a proposal-stage provision, not a final obligation.
Cost and Complexity for Operators
European telecom operators warn that large-scale replacement of network technology could be costly. Mobile World Live reported that the European Commission initially estimated the cost at €17 billion to €21.5 billion, while industry estimates put the potential bill as high as €40 billion. ICTbusiness.info reported that the higher estimate includes more than replacement hardware: network design, integration, testing, software adaptation, running old and new systems in parallel, field work and staff retraining. In Spain alone, replacing mobile and fixed network equipment could cost major operators around €4 billion.
The impact would vary across the sector. Operators use different supplier mixes by region and network type, and replacement can require coordinated changes across radio-access, transport and basic-network systems. Companies could also need to review contracts, stocks, active installations and equipment already deployed at customer premises. The scope and pace of any transition would affect the total cost, particularly if deadlines reflect equipment life cycles and the availability of alternatives.
The reform is not yet law. Reuters reports that the proposal must still be negotiated with EU governments and the European Parliament. MLex reported on 22 October that several governments oppose classifying suppliers as security risks based on their links to non-EU states. Governments and lawmakers are also divided over removal deadlines and risk-assessment methods. The Commission’s proposal would establish a formal process for identifying affected suppliers; the final designation and implementation arrangements remain part of the legislative debate.
European Manufacturers Eye Chance
While operators highlight the costs, several European manufacturers see a chance to gain market share in home networking. FRITZ!, devolo, LANCOM and TDT have formed the SAFENet alliance to promote greater European autonomy in routers and network equipment.
The debate is fueled by the scale of the issue. A report from the Innovate Europe Foundation estimates that home routers and devices handle about 93% of Europe’s internet traffic, with Chinese manufacturers accounting for roughly 37% of the home network equipment market.
Supporters of the reform point to risks including reliance on foreign firmware updates, potential backdoors and the possibility that compromised devices could be used in coordinated cyberattacks. The same report links these concerns to obligations under Chinese intelligence and counter-espionage laws. The policy debate also reflects a wider effort to balance cybersecurity and technological sovereignty against competition, replacement costs and the practical constraints of removing installed equipment.
For now, consumers are not required to take any action. The proposal could reach mobile, fixed and satellite networks, but it sets no final fixed-network deadline and does not mean households will automatically have to replace Chinese-branded routers. If adopted, the structure would leave supplier designation and the pace and scope of replacement to the regulation’s final provisions and subsequent decisions. The home router has become part of a wider European debate over network security and technological sovereignty.
