Brussels reiterates its warning regarding Huawei and is getting ready to enforce it.

      The European Commission has officially advised member states to exclude Huawei and ZTE from their connectivity infrastructure. These restrictions are progressing towards becoming legally enforceable. China has signaled potential retaliation in response.

      When the European Commission initially urged its member states to exclude Huawei and ZTE from their 5G networks through the 2020 5G Cybersecurity Toolbox, it was merely a recommendation. Six years later, on 4 May 2026, the Commission reiterated this stance.

      According to Reuters, Brussels has formally advised its 27 member nations against utilizing equipment from the two Chinese companies in their connectivity infrastructure, expanding the original request to cover not just mobile networks but the broader telecommunications and digital framework on which the Union relies.

      While it may seem like the Commission is repeating itself, there is a strategic intent behind it. Monday’s recommendation serves as a public counterpart to a more serious structural change in progress.

      The same restrictions are advancing, through a draft cybersecurity law introduced in January, toward becoming obligatory for member states, complete with infringement implications. The voluntary approach has, by Brussels's own acknowledgment, proven ineffective.

      What the recommendation entails, and what it does not

      The Commission's text from 4 May reinforces its long-held view that Huawei and ZTE present significantly greater risks than other suppliers within the EU’s connectivity framework, and instructs member states and telecom operators not to use their equipment in essential network infrastructure.

      As published, the recommendation is non-binding. National regulators maintain official authority over their own procurement choices. Member states that choose to continue using the two vendors are not legally barred from doing so.

      What alters the situation is that the recommendation is no longer the Commission’s primary tool. On 20 January 2026, Henna Virkkunen, the EU's Executive Vice-President for Tech Sovereignty, introduced a cybersecurity package intended specifically to shift from soft to hard measures.

      Under the proposed legislation, components from designated high-risk suppliers would need to be eliminated from crucial network infrastructure within 36 months of the regulations taking effect; member states that disregard this obligation could face infringement actions and potential financial penalties.

      “It didn’t work on a voluntary basis,” Virkkunen stated at the time, a comment frequently shared by Euronews and CNBC.

      In this context, Monday's recommendation functions as a temporary measure: it reaffirms the foundational policy direction while the legislative framework that will implement it moves through deliberation.

      Reasons for the failure of the voluntary phase

      Data shows the challenge. According to Euronews, as of February 2024, only 11 of the EU’s 27 member states had enacted specific 5G security protocols towards Huawei and ZTE. By the time the Commission’s January 2026 package was announced, this number had risen to 13.

      In essence, after six years of persistent regulatory pressure, just under half of the member states had acted on the recommendation that has now been reiterated.

      The reasons behind this are partly economic and partly political. Germany, the EU's largest market, was the most notable resister: an estimated 60 percent of German 5G sites were equipped with Huawei technology as recently as late 2024, with the cost and complexity of replacing it viewed by Berlin as a gradual, local endeavor. Several Eastern European states have shown similar reluctance.

      The Commission’s dissatisfaction with this pattern is widely regarded as the immediate political impetus behind the legislative initiative.

      Member states with strong domestic suppliers, like France with Nokia’s Alcatel-Lucent and Sweden with Ericsson, have aligned more closely with Brussels's stance from the outset. Sweden, in particular, prohibited Huawei and ZTE from its 5G network back in October 2020.

      The downstream result was illustrative: Ericsson's revenue from China dropped by 46 percent the year following the Swedish ban, and the company has not recuperated that business since. Capitals observing the Commission’s draft law are aware of this precedent.

      What the new connectivity-infrastructure scope involves

      Previously, the Commission primarily focused on mobile networks, covering areas like the 5G core and radio access—equipment that determines connectivity for citizens.

      Monday's recommendation expands its vocabulary to encompass “connectivity infrastructure” in general, indicating that the forthcoming binding framework will extend to fixed networks, fiber-optic and submarine cables, and satellite networks. Transition timelines for these areas will be announced later.

      The inclusion of submarine cables is notably strategic. The geopolitical tensions surrounding undersea cable infrastructure, which handles much of the EU’s intercontinental internet traffic, have recently grown, especially concerning suspected sabotage incidents in the Baltic and Red Seas. Excluding high-risk suppliers from this segment involves a different level of complexity compared to removing them from a base station and, according to experts, is more urgent.

      China's response has been characteristically assertive. Beijing labeled the cybersecurity package as “discriminatory” and threatened to retaliate against European companies operating within its market. Earlier this year, we reported