EU Updates Cybersecurity Act Amid Geopolitical Risks

The European Union (EU) has introduced the updated Cybersecurity Act, known as CSA2, presenting a framework that would allow Brussels to categorize third countries as high-risk based on their political and legal climates. This legislative change, discussed in an article by Euractiv, could lead to the exclusion of certain suppliers from the EU's technology supply chains. Critics highlight the potential subjectivity of evaluating geopolitical risks, deviating from a strictly technical certification model, which could have broad implications for supplier relations.

The implications of the CSA2 could be far-reaching, particularly for the telecommunications sector. With mandatory exclusions for high-risk providers from critical 5G network components, significant financial burdens could be placed on operators, impacting service expansion and future-proofing infrastructure. Legal challenges are anticipated regarding the constitutional grounding of these regulations, as the EU’s approach to cybersecurity must balance national and collective security imperatives. Furthermore, industry experts warn that these measures may inadvertently deepen Europe’s technological dependency on suppliers outside the region, particularly as it strives to remain competitive against the US and China.