Chinese giant Huawei responded to European moves this week to galvanize removal of its equipment from the continent.

In one of its revisions to the Cybersecurity Act (CSA) announced this week, the European Union (EU) proposed enforcing compliance with the EU Toolbox for 5G security, which launched in 2020. Without naming specific vendors, the proposal called out the heightened vulnerability risk stemming from “high dependency on non-European suppliers, on high-risk suppliers, and single suppliers.”

Huawei’s response was unequivocal, stating: “A legislative proposal to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU’s basic legal principles of fairness, non-discrimination, and proportionality, as well as its WTO (World Trade Organization) obligations.

“We will closely monitor the subsequent development of the legislative process and reserve all rights to safeguard our legitimate interests,” Huawei’s spokesperson told Reuters.

The response from Huawei – which has previously raised concerns in a WTO capacity regarding the United States ban on its equipment that set in motion the EU Toolbox – is the latest in a long-rumbling endeavor to replace equipment from it and Chinese peer ZTE across European infrastructure. According to Brussels' proposal, only 13 member states have implemented restrictions on high-risk suppliers in the five years since the Toolbox’s implementation, which comes part of the EU 5G Cybersecurity Certification (EU5G).

Away from telecom, the EU’s revised Cybersecurity Act also plans to harmonize its cloud services across the continent, noting that with the current European Cybersecurity Certification Scheme for Cloud Services (ECUS), cloud vendors have to meet a complex number of security requirements to provide their services in countries such as Germany.

Regarding cloud sovereignty more than cloud security, the ECUS does not invoke similar discussions of high-risk vendors as the 5G aspect, although the proposal states it came about due to "the politicization of the discussion related to the structure of the cloud computing market in Europe (heavily dominated by non-EU players)."

While Huawei does not have as big a footprint as the hyperscalers in this regard, analyst John Strand told this title recently that T-Mobile's T-Systems cloud arm does resell Huawei cloud solutions to European clients.

Last year a Huawei spokesperson told SDxCentral that its Huawei Cloud offering had "gained rapid growth in markets including Europe.

"Based on our cloud regions in a number of countries, including Ireland and Turkey, we provide cloud services to help accelerate the intelligent upgrade of industries in Europe. By the end of 2024, Huawei Cloud had worked with partners to serve more than 6,000 enterprises in Europe," the Huawei spokesperson said.

Huawei has been contacted for comment on the latest EU proposal.

Unclear picture – and red lines

Rumors of the high-risk vendor ban have accumulated since the fall, with the European Commission (EC) reported to be enforcing the Toolbox by placing financial sanctions on nations that don’t rip out the offending gear. That came amid reports Germany and Finland were galvanizing efforts to brick out Huawei from their national infrastructures.

The Finnish Transport and Communications Agency (TRAFICOM) was reportedly building on an original 2021 ban on equipment from the core network deemed high-risk by the EC, with Germany said to be eyeing Deutsche Telekom (DT) and other telecom operators to replace existing equipment from Huawei.

Meanwhile, Finnish giant Nokia banged the drum by criticizing Chinese coverage in Europe’s telecom markets, while European vendors such as itself were left out in the cold over in China by its authorities. The firm would go on to buy out Chinese joint venture Nokia Shanghai Bell in December, giving it a wholly Western-owned stake in the country’s telecom market in a similar manner to Ericsson’s own Chinese subsidiary.

In its proposal from Tuesday, the EC admitted that a majority of its members “have no clear picture” of which suppliers are present in their deployed networks, noting findings from the European Court of Auditors that “the absence of a concerted approach across the EU, may impact the effective functioning of the single market.”

While Brussels did not outright name what it deemed as high-risk vendors, it did point to research from Strand Consult that the current proportion of 5G sites in the EU and five other countries provided by both ZTE and Huawei was 32%, dropping to a predicted share of 29% in 2028. Strand recently went deeper with the figures, telling SDxCentral that Huawei gear is still propping up major European telecom players such as DT and Vodafone.

Strand explained that networks from DT subsidiary T-Mobile are largely Huawei-based, with total penetration in Austria, Greece, and the Czech Republic; 70% penetration in its Poland operations; 58% penetration in Germany; and half of its Croatian networks.

While the EC estimated replacing such networks would cost up to $5 billion for the non-upgradeable equipment over three years, the proposal does not give a deadline for members to meet in replacing the equipment, nor break down penalties for non-compliance.