Beijing's lobbying campaign regarding the EU Cybersecurity Act depicted through statistics

      A study conducted by KPMG and commissioned by the CCCEU estimates that replacing Chinese suppliers in 18 crucial EU sectors from 2026 to 2030 would cost €367.8 billion. Reuters has rounded this figure down, but it is significantly higher. The China Chamber of Commerce in the EU has quantified the cost of the European Commission's plan to eliminate Chinese suppliers from critical infrastructure, revealing a substantial amount. The KPMG study suggests that the forced transition from Chinese suppliers in these 18 sectors would amount to €367.8 billion ($432.83 billion) over the specified period.

      The revised Cybersecurity Act, which we discussed when the Commission reissued its recommendations regarding Huawei and ZTE last week, is shifting the EU's existing soft restrictions on Chinese telecom suppliers toward a more binding framework. This legislation would expand high-risk supplier exclusions to 18 sectors of the European economy, including energy, transportation, healthcare, banking, digital networks, and the space industry. Components and equipment from identified high-risk suppliers would need to be removed from essential infrastructure within 36 months of the law taking effect, with breach procedures and potential financial penalties for non-compliance.

      The KPMG study details the projected $432.83 billion cost, categorizing it into infrastructure replacement, operational disruption, lost interoperability, and productivity impacts. The methodology assumes the current penetration of Chinese suppliers in the 18 sectors is replaced within the 2026 to 2030 timeframe at price points comparable to available European, Japanese, and Korean alternatives. In the framing of the CCCEU, the headline cost should be viewed as a minimum rather than a maximum estimate.

      The origins of the study are important. The CCCEU represents Chinese commercial interests in the EU, and KPMG was commissioned to create the cost estimate for them. Therefore, the figure should be interpreted as the high end of a self-serving advocacy position rather than an independent cost estimate. TNW has monitored the EU's broader push for tech sovereignty, and when the European Commission eventually publishes its own internal cost analysis, it is likely to yield a considerably different figure.

      That said, the scale of the estimate is credible. The European Union Institute for Security Studies has highlighted the structural challenges of scaling up the replacement of Chinese legacy chip and telecom hardware, especially in sectors lacking adequate European, Japanese, and Korean alternatives. According to the ISS analysis, the legacy semiconductor issue alone could account for billions in replacement costs over the timeframe modeled by the CCCEU. The broader footprint covering 18 sectors includes infrastructure categories like grid equipment and rail signaling, where replacement costs with reduced Chinese supplier penetration are significant.

      The CCCEU figure comes at a crucial time for EU-China commercial relations. Reports indicate that China's Big Fund is negotiating a $45 billion funding round for DeepSeek, reflecting Beijing's assertion of leadership in frontier AI. Meanwhile, in 2026, the EU is also juggling its competition agenda, its AI safety framework, and its supply chain sovereignty goals, with the Cybersecurity Act revision intersecting all three.

      Beijing's desired outcome is clear: a reconsideration by Brussels of the proposed binding regime, ideally incorporating exemptions that allow Chinese suppliers to continue operating in the 18 sectors. The CCCEU study represents the first public move in this lobbying effort. Its impact hinges on whether European member states with significant exposure, such as Germany and Italy, deem the projected costs high enough to justify softening the proposed legislation.

      Three key factors will influence the trajectory of the proposal. The first is the European Commission's anticipated publication of its impact assessment later this year. Should the Commission's figure fall significantly below CCCEU's $432 billion, the political rationale for the binding regime will remain strong. Conversely, if it is closer to the CCCEU figure, member states are likely to advocate for exemptions and more lenient timelines for transition.

      Secondly, it is important to monitor whether Germany, which has the highest exposure to Huawei equipment in its 5G networks, accepts the proposed 36-month removal window. The third factor is whether Beijing responds to the CCCEU study with tangible commercial countermeasures against European exporters, particularly in the automotive, luxury, and machinery sectors.

      Currently, none of these signals are available. However, what exists is the most comprehensive cost estimate for the binding cybersecurity regime produced to date. The figure is substantial, the methodology is clear, and the political context renders it significant regardless of whether the European Commission concurs with the projection. In the coming months, Brussels will need to publish its own assessment.