According to a 17 January 2026 report by the Financial Times, the European Commission will table a new Cybersecurity Act that would oblige EU member states to phase out Chinese-made equipment from critical infrastructure, excluding firms such as Huawei and ZTE from telecom networks and solar-power systems.

The proposal is due to be unveiled on Tuesday, 20 January, after which it will enter negotiations with the European Parliament and EU member states.

   Core provisions of the proposal   

Targeting companies and suppliers: the measure focuses on Chinese firms such as Huawei and ZTE, which are classified as high-risk suppliers. EU officials fear their equipment could be used to harvest sensitive data and thereby pose a national-security threat. The proposal will also extend to any other suppliers deemed to present a comparable high risk.

   Sectors covered   

Telecom networks: mandatory restriction or exclusion of equipment from high-risk suppliers; parts of the EU’s 5G infrastructure still rely on Chinese technology.

Solar-energy systems: more than 90 % of solar panels installed in the EU are Chinese-made; the proposal envisages a gradual replacement of these components.

Security scanners: airport and border-security equipment will be barred from using Chinese suppliers.

The shift moves from today’s voluntary guidance to binding obligations. Member states must assess supplier risk and phase out the equipment concerned.

Timetable: replacement deadlines will depend on the supplier’s risk profile, the specific sector and the cost/availability of alternatives. High-risk areas may face rapid timelines, while sectors with high switching costs (e.g., solar) could receive longer transition periods.

The EU acknowledges likely challenges—telecom operators warn of higher consumer prices because viable alternatives are scarce—and stresses it will weigh economic impacts to avoid sudden disruption.

The initiative stems from dissatisfaction with previous, non-mandatory measures. Since 2020 the EU has recommended that members avoid high-risk suppliers, but implementation has been uneven: the U.K. and Sweden banned Huawei and ZTE early, while Spain, France and others continued to use them.

The bill marks a major EU shift on tech security and geopolitics, aiming to cut dependence on vendors deemed "high-risk" and to bolster digital sovereignty by reducing reliance on both Chinese and U.S. suppliers.