Geo-Specific
,
Security Operations
,
Standards, Regulations & Compliance
GSMA Intelligence Says Ejecting Huawei Equipment Will Cost Up to 40B Euros
European mobile network operators would have to shell out as much as 40 billion euros – or $45.7 billion – in direct costs to kick high-risk suppliers such as Huawei out of their infrastructure, asserts the research arm of the industry’s main trade association.
See Also: Solve Credential Chaos and Digitize Securely
The expulsion of such equipment from Europe’s networks is a key element of revisions to the European Union’s Cybersecurity Act, as proposed by the European Commission in January. Although the proposal names no countries, it’s widely understood to be an effort to protect European communications from potential Chinese espionage or service disruption, particularly as Chinese equipment vendors dominate the market.
In an impact assessment, the EU’s executive body said the rip-and-replace cost would be somewhere between 3.4 billion and 4.3 billion euros per year over three years (see: Europe Readies Law to Eject Chinese Equipment From Telecoms).
The much higher figure of 30 billion to 40 billion euros was touted Wednesday in a report from GSMA Intelligence, the research and consulting wing of the GSMA. The study was commissioned and sponsored by seven telecoms groups: Deutsche Telekom, Fastweb, MEO, Orange, Telefónica, United Group and Vodafone.
Apart from the direct cost of ripping out equipment from high-risk vendors such as Huawei and ZTE, the industry association claimed the move would raise equipment prices through supplier concentration, raising investment costs by around 8.5 billion euros between 2027 and 2030.
“Mandatory removal of [high-risk vendor] equipment would impose substantial direct costs on operators, reduce competition in network equipment markets and likely slow the development of Europe’s digital infrastructure,” the report read. “Although outside the scope of this study, operators have highlighted that, notwithstanding the costs involved, the extremely tight timelines proposed to remove HRV from [radio network equipment] are also likely to create significant disruption to services for users and risks to network resilience.”
Some experts are deeply suspicious about the report’s figures and the industry association’s broader argument against the burden of booting so-called HRVs from Europe’s networks.
“The GSMA’s report is a cry for help from a number of operators who took a calculated risk when they chose to upgrade their 4G network to 5G with equipment from HRV,” veteran telecoms analyst John Strand told ISMG on Wednesday. “It is a report that exposes the consequences that can be for shareholders when investing in telecommunications companies that on the one hand claim that they have a vital role when it comes to national security, while at the same time choosing not to do what has been agreed to do across the EU to ensure the safety of citizens, businesses and authorities depart for secure infrastructure.”
That’s a reference to the “5G security toolbox,” a voluntary framework that the EU member states and the commission approved at the start of 2020. The toolbox encouraged countries to ban high-risk vendors as their operators built out 5G networks at the time. Because it is non-binding, it was very unevenly applied, and the commission explicitly said this year that this was a big driver behind its proposal to stiffen continental cybersecurity regulations.
Strand and his research outfit, Strand Consult, have been tracking the issue in detail for around nine years. He said the operators that chose to phase out HRVs from their networks had experienced only “marginal” financial consequences, based on their financial statements and earnings calls.
Around 30 networks currently have 35% to 100% of their radio access network equipment coming from HRVs, Strand said, and those networks are ultimately controlled by a handful of groups like Vodafone and Deutsche Telekom.
He added that over 55% of the equipment that will need replacement can be found in just three countries: Germany, Italy and Spain. Most of this will be radio access network equipment, as Europe’s operators have been far more diligent about keeping HRVs out of their core networks – Strand estimates that over 95% of core networks used only trusted vendors at the start of this year.
As for GSMA Intelligence’s claim that the HRV rip-and-replace program will cost 30 billion to 40 billion euros, Strand said the reality would be far closer to what the commission has forecast, which Strand Consult described as “broadly consistent with the experience from countries that have already replaced equipment from high-risk suppliers” in a research note last week.
The GSMA Intelligence projections “do not take into account that the exposure to high-risk vendors is distributed among a few players,” Strand said. “These are costs that affect the 30 out of 100 operators who have maintained HRV in their network.” He added that what was presented as a rip-and-replace situation would more likely involve a gradual phasing-out of equipment.
Strand did agree with GSMA Intelligence about the existence of a sizeable telecoms investment gap in Europe, which he attributed to over-regulation and operators’ poor choices. But the United States, South Korea and India have all managed to build out superior 5G infrastructure while avoiding equipment from high-risk vendors, he said.
“We find it very difficult to understand how, from a security policy point of view, in 2026 you can go out and defend the use of equipment from high-risk vendors,” Strand said.