Beijing's lobbying efforts regarding the EU Cybersecurity Act quantified.

      A study conducted by KPMG for the China Chamber of Commerce to the EU (CCCEU) estimates that removing Chinese suppliers from 18 key EU sectors between 2026 and 2030 would incur costs of €367.8 billion. Reuters simplifies this figure in its reporting, but the actual number is significantly higher.

      The CCCEU has quantified the financial impact of the European Commission’s strategy to eliminate Chinese suppliers from critical infrastructure, and it is substantial. The KPMG study estimates that the forced transition away from Chinese vendors across these sectors would cost the EU approximately €367.8 billion ($432.83 billion) during the specified timeframe.

      Recently, the revised Cybersecurity Act has progressed, transitioning the EU’s previously soft restrictions regarding Chinese telecom suppliers toward a more stringent framework. This legislation will expand the exclusions of high-risk suppliers across 18 economic sectors, including energy, transport, healthcare, banking, digital networks, and the space industry. Components from identified high-risk suppliers must be eliminated from vital infrastructure within 36 months after the law is enacted, accompanied by enforcement procedures and potential fines for non-compliance.

      The KPMG study details the estimated $432.83 billion cost, breaking it down into categories such as infrastructure replacement, operational disruptions, interoperability losses, and impacts on downstream productivity. The methodology assumes that the current market penetration of Chinese suppliers within the 18 sectors will need to be replaced during the 2026-2030 period, in line with price levels of available alternatives from Europe, Japan, and South Korea. In the context presented by CCCEU, this cost should be viewed as the minimum rather than the maximum.

      The source of the study is significant. The CCCEU represents Chinese business interests in the EU and commissioned KPMG for this estimate, which should thus be interpreted as representing the high end of a self-serving advocacy stance instead of an unbiased cost analysis. TNW has been monitoring the EU’s broader push for technological sovereignty, and the European Commission's forthcoming internal cost assessment is expected to yield a markedly different figure.

      Nonetheless, the magnitude presented is credible. The European Union Institute for Security Studies has indicated the challenges in replacing legacy Chinese chip and telecom hardware at scale, especially in areas lacking sufficient European, Japanese, or Korean alternatives. According to their analysis, merely addressing the legacy semiconductor issue would result in replacement costs amounting to tens of billions over the timeline modeled by CCCEU. The broader footprint of the 18 sectors additionally entails infrastructure categories such as grid systems and rail signaling, where reliance on Chinese suppliers is significant, making the costs of replacement tangible.

      The CCCEU’s estimate emerges at a crucial time for EU-China trade relations. Reports suggest that China’s Big Fund is negotiating to lead a $45 billion investment in DeepSeek, viewed as a demonstration of Beijing's commitment to leading in advanced AI technology. As the EU navigates its competition policy, AI safety regulations, and supply chain sovereignty in 2026, the revision of the Cybersecurity Act intersects with all of these elements.

      China aims for a reconsideration from Brussels regarding the proposed binding regime, hoping for exemptions that allow Chinese suppliers to remain viable in the affected sectors. The CCCEU study serves as the first public step in this lobbying initiative. Its impact will depend on whether EU member states, particularly Germany and Italy—who have significant stakes—find the estimated costs compelling enough to advocate for adjustments to the proposed legislation.

      Three key indicators will shape the future of the proposal. First is the European Commission’s forthcoming impact assessment, anticipated later this year. If its estimate is significantly lower than CCCEU's $432 billion, the political justification for the binding regime will remain robust. If it aligns more closely with the CCCEU figure, member states may seek exemptions and more lenient deadlines.

      Second, it will be crucial to see whether Germany agrees to the proposed 36-month timeframe for removing Huawei equipment from its 5G networks, as it currently has the highest vulnerability among EU nations. Third, it remains to be seen if Beijing responds to the CCCEU study with tangible commercial retaliations against European exporters, especially in sectors like automotive, luxury goods, and machinery.

      Currently, no such signals have emerged. However, the detailed cost projection from the CCCEU represents the most comprehensive estimate for the proposed binding cybersecurity regime to date. The sum is substantial, the methodology clear, and the political climate renders the figure pertinent, regardless of whether the European Commission accepts this projection. Brussels will need to release its own assessment in the coming months.