Thirty-five billion euros: that is the median cost attributed to a security decision for which, until now, no one had calculated the full cost. This is neither the cost of a breakdown nor that of a new network, but rather the cost of equipment that is still operational but would have to be removed because its supplier is considered too risky.
Published in July by GSMA Intelligence, the report estimates the direct cost of removing and replacing equipment from high-risk suppliers in the European Union’s networks at between 30 and 40 billion euros. Its base-case scenario puts the figure at 35 billion. Mobile networks would account for between 16 and 22 billion euros, fixed networks up to 5 billion, and transport infrastructure – the links that carry traffic between different parts of the network – between 9 and 12 billion.
The study marks a milestone because it extends the calculation beyond the mobile network alone. The European Commission had estimated the cost at 3 or 4 billion euros per year over three years, but, as GSMA Intelligence points out, without providing a detailed estimate based on fixed and transport networks. The new report aggregates data from 28 national operations representing 258 million mobile connections and 77 million fixed-line connections, and then extrapolates these figures to the EU as a whole.
An industry report
However, this first detailed breakdown is neither impartial nor comprehensive. The study was commissioned by Deutsche Telekom, Fastweb, MEO, Orange, Telefónica, United Group and Vodafone – seven groups that would have to bear part of these costs. The sample covers around 44 per cent of mobile connections and 43 per cent of fixed-line connections in the EU. The report itself states that it does not claim to be “comprehensive or complete”. It measures industry costs, not the expected security benefits of reducing dependencies.
Its assumptions should also be read as a scenario, rather than as a definitive European list. GSMA Intelligence classifies Huawei, ZTE and FiberHome as high-risk suppliers for the purposes of this analysis. However, the proposed amendment to the Cybersecurity Act presented by the Commission on 20 January 2026 does not yet name any companies in its text. It provides for a European assessment procedure and the subsequent adoption of lists of suppliers. The actual cost will therefore depend on the groups ultimately designated, the categories of equipment covered and the deadlines imposed.
The report highlights a second cost. According to its model, excluding certain suppliers would reduce competition and increase the cost of future purchases by 24 per cent in the mobile sector, 19 per cent in the fixed-line sector and 10 per cent in the transport sector. Out of nearly €42 billion worth of active equipment that operators are already planning to purchase between 2027 and 2030, the additional cost would amount to €8.5 billion. Extended to 2035, this figure would rise to 24 billion. GSMA Intelligence warns, however, that these figures should not simply be added to the 30 to 40 billion required for replacement: they describe distinct effects and may overlap.
Diversification and its limitations
Luxembourg provides a telling example of this study, but does not yet have national figures. The decisions announced regarding 5G show that the move towards diversification has already begun. Post Luxembourg relies on Ericsson. Orange Luxembourg chose Nokia in 2020 for its base stations, routers, and the roll-out and maintenance of its 5G network. Proximus Luxembourg, which markets its services under the Tango brand, has also entrusted its 5G network to Nokia. Reuters reported at the time that the Finnish equipment manufacturer was replacing Huawei at Proximus Luxembourg.
These contracts are not sufficient to conclude that Luxembourg’s networks no longer contain Chinese equipment. The 5G radio network is just one layer of a much broader system: 4G antennas still in use, the core network, fixed access, routers, transmission systems and equipment installed at customers’ premises. According to Reuters and Light Reading, which cited data from Strand Consult, Huawei supplied the 4G radio networks of Orange and Proximus in Luxembourg before they switched to Nokia. However, the operators have not published an inventory that would allow verification of what remains of these installations today. Post publicly documents the presence of Huawei equipment at certain customer sites. This information alone does not allow us to conclude that Huawei is currently present in the critical parts of its network.
The most robust conclusion is therefore also the least spectacular: there is public evidence of Chinese equipment, whether legacy or peripheral, but no publicly available mapping data allows us to ascertain their number, location, function or criticality for each individual operator. It is therefore not possible to apply the European average cost of between 30 and 42 euros per mobile connection, as calculated by GSMA Intelligence, to Luxembourg, nor to claim that the country has already completed the replacement process in its entirety.
The analysis does not require the risks to be published
The mapping exercise provided for in the European project will not necessarily fill this gap for the public. The text calls on the Commission to identify suppliers of ICT components and services, and then to examine their country of establishment, ownership and control. This analysis is to form the basis for lists adopted by implementing acts, which will be made public. However, the proposal does not require the publication of a detailed inventory of the equipment present in each national network. It is still under discussion: no date can therefore be given for a possible first list, and there is no guarantee that the underlying mapping will be made public.
The same framework makes it possible to deal with the case of a foreign operator without confusing its activities with those of an equipment manufacturer. China Telecom (Europe) Limited has had a branch registered in Luxembourg since April 2022. Its 2024 accounts show that it is a UK company controlled directly by China Telecom Global in Hong Kong and, ultimately, by China Telecommunications Corporation in Beijing. It provides telecommunications and ICT services in Europe, particularly to the Chinese group’s international clients.
Its presence does not, in itself, result in a ban. European law allows an operator established or authorised within the EU to provide electronic communications networks and services under the general authorisation regime, subject to notification to the national regulator where required. Cybersecurity obligations, supervision by the Luxembourg Regulatory Authority and, depending on the transactions carried out, investment screening mechanisms continue to apply.
The proposed Cybersecurity Act, however, introduces a broader criterion than simply having a European headquarters. A company established in Europe could be classified as a high-risk supplier if it is controlled by an entity or a state from a designated third country. Legally speaking, this could therefore apply to a European subsidiary or branch of a non-European group. However, the country and the supplier would still need to be formally designated, and the products or services in question would have to fall within the scope of the critical assets covered.
Even in this case, the text does not provide for the automatic closure of a branch such as that of China Telecom (Europe) Limited. It targets the use, installation or integration of components and services from high-risk suppliers in critical ICT assets. For mobile networks, the Commission proposes a phase-out no later than 36 months after the publication of the relevant list. The timetables for fixed-line and satellite services would be specified at a later date. A standard international connection, a cloud service integrated into critical infrastructure and equipment located at the core of a network therefore do not present the same regulatory challenges.
The GSMA Intelligence report thus assigns a European rating to a policy that is still taking shape, but above all it reveals what is lacking in Luxembourg. The country knows which providers have been selected for its new networks; it has not, however, published a complete inventory of what remains in the old ones. Even before knowing who will be legally classified as high-risk, the first national unknown is therefore not the cost of replacement, but its scope.
