The Commission confirms its preference for a risk-based approach, which will leave plenty of room for individual member states to make decisions.
Background: Amid growing concerns for 5G network security at the international level, the previous European Commission signalled its intention to make sure EU member states followed a coordinated approach in identifying the risks posed by 5G deployment, and in turn the necessary measures to address them. This was happening at a time when several countries in the world were deciding whether to rule out Chinese vendors – Huawei in particular – from 5G networks. In March 2019, the Commission issued a Recommendation requiring member states to carry out individual risk assessments, and asking the European Network and Information Security Agency (ENISA) to complete a coordinated risk assessment, before the approval of a European ‘toolbox’ with the necessary instruments to mitigate any risk.
The toolbox is here: On 29 January 2020, almost one month after the planned deadline, the EC published its 5G toolbox. Member states retain ample freedom to restrict vendors they deem to be high-risk. However, the toolbox provides key criteria on the approach to take, across three pillars: to grant regulatory authorities sufficient power to strengthen network security requirements; to assess the risk profile of individual suppliers (applying restrictions if necessary); and to ensure operators have a diverse, multi-vendor strategy in when building their networks. On its end, the EC commits to screen foreign direct investment and to monitor competition to make sure long-term dependency on specific vendors is avoided.
A balanced approach the industry will welcome: With the launch of the toolbox, the EC retains a flexible approach to security, which has the clear benefit of not being disruptive of any operators’ supply chain. Going forward, operators will have to ensure they plan for a diverse make-up of the equipment they choose, by not tying themselves up to individual vendors. However, they can go ahead with their existing plans in the short run, which means 5G deployment will not be delayed due to security concerns. ETNO welcomed the toolbox, noting that “Europe’s decision-making on 5G should continue being based on facts, it should be proportionate to threats and build on a solid understanding of technology reality”.
Next steps: The EC requires member states to take steps to implement the set of measures recommended in the toolbox conclusions by 30 April 2020, and to prepare a joint report on the implementation in each member state by 30 June 2020. By the end of October 2020, the EC will review the impact of the measures it has taken so far.
