European telecom operators could face up to €40 billion in direct costs to remove designated high-risk vendors (HRVs) from telecom network under the proposed EU Cybersecurity Act (CSA2), according to a GSMA Intelligence study. The report warns that mandatory replacement of vendor equipment from Huawei and ZTE across 5G mobile, fixed and transport networks would significantly increase network investment costs, reduce vendor competition and slow future 5G deployment.
The study estimates that replacing HRV equipment across the European Union would cost between €30 billion and €40 billion, with a central estimate of €35 billion. Mobile networks would account for the largest share at €16–22 billion, equivalent to €30–42 per mobile connection, while fixed networks would require up to €5 billion and transport networks €9–12 billion. The estimates are based on data from seven major European telecom groups representing nearly half of the EU’s mobile and fixed broadband connections.
The surveyed operators include Deutsche Telekom, Fastweb, MEO, Orange, Telefonica, United Group and Vodafone, covering approximately 258 million mobile connections out of 588 million across the EU and 77 million fixed broadband connections out of 181 million.
Under the proposed regulation, operators would be required to remove HRV equipment from 5G core and Radio Access Network (RAN) infrastructure within three years after CSA2 becomes law. The study notes that the legislation also applies to fixed access and transport networks, expanding the scale of required network upgrades.
GSMA Intelligence forecasts that removing major vendors from the market would sharply reduce supplier competition and increase equipment prices. Mobile network equipment prices are projected to rise by 24 percent, while fixed network equipment could become 19 percent more expensive and transport network equipment 10 percent costlier. In scenarios where most demand shifts to the largest remaining suppliers, mobile equipment prices could increase by as much as 43 percent, fixed equipment by 45 percent, and transport equipment by 16 percent.
The report estimates that EU operators plan to invest nearly €41.7 billion in physical active network equipment between 2027 and 2030. Higher vendor concentration would add approximately €8.5 billion to those investments, including €6.6 billion for mobile networks, €1.1 billion for fixed infrastructure and €800 million for transport networks. Over the longer 2027–2035 period, cumulative additional investment costs could reach €24 billion, with €19 billion linked to mobile infrastructure alone.
Beyond higher investment costs, GSMA Intelligence warns that operators are likely to slow 5G Standalone (5G SA) deployment, delay fibre expansion and reduce network modernisation because of constrained capital budgets. The report highlights that Europe already faces a digital infrastructure funding gap, requiring around €475 billion to deliver best-in-class connectivity while only €270 billion of investment is currently expected, leaving a shortfall of approximately €205 billion. Additional regulatory costs could further delay Europe’s next-generation network rollout and digital competitiveness.
Meanwhile, a KPMG study, conducted in collaboration with the China Chamber of Commerce to the EU (CCCEU), estimates that the proposed EU Cybersecurity Act 2 (CSA2) could reduce the EU economy by €367–370 billion cumulatively between 2026 and 2030. The analysis attributes the losses to direct network replacement costs, system disruptions, and economic spillover effects. The telecom sector is expected to be among the hardest hit, with estimated losses of around €57.4 billion over the five-year period, accounting for approximately 16 percent of the total projected economic impact.
BABURAJAN KIZHAKEDATH