Brussels' draft Cybersecurity Act revision would start a 36-month Huawei removal clock at adoption

The 36-month window in the January 2026 CSA2 revision runs from the day the law takes effect ^[3]. It is not keyed to any operator's readiness. The draft also pushes scope past mobile networks into fixed broadband and transport infrastructure ^[4]. If adopted as drafted, it would let Brussels designate high-risk suppliers and mandate their removal from critical infrastructure across 18 industries, with telecom the most concrete and measurable category in the package ^[6].

Telecom is not one thing you swap. The dev.to analysis breaks it into RAN, core, transport and OSS/BSS integration, each with a different dependency depth and a different failure consequence if the order is wrong ^[13]. Core is the most centralized layer and carries the highest blast radius, and replacing it badly risks a national-scale outage ^[14]. Regulators and operators have prioritized core first because the risk calculus there is clearest ^[14]. RAN is the largest cost line and the most physically distributed, so it is slow and logistically heavy, though lower-risk per individual swap ^[15].

Transport sits underneath both. The same analysis calls it the layer most likely to be treated as an afterthought, right up until a core or RAN cutover depends on transport capacity nobody re-verified ^[16]. Transport verification therefore gates the sequence, and transport is one of the layers the draft newly brings into scope ^[4].

The published cost views differ by a factor of three or four ^[9]. According to the analysis, the Commission is pricing a policy and GSMA is pricing a rip-and-replace program built from real operator cost data ^[10]. The post does not state either absolute figure ^[19]. Its argument is that the spread is evidence nobody has produced a consistent shared model of the dependency surface being replaced ^[18]. Either number transfers to your own plan only if your vendor mix, layer depth and contract structure look like the operators whose data built it.

One line inside the GSMA figure is separable from the swap itself. Reduced vendor competition is projected to add roughly EUR 8.5bn on its own between 2027 and 2030, independent of the direct replacement cost ^[11]. Spread evenly across those four years, that is about EUR 2.1bn a year ^[12]. It prices having fewer suppliers to bid against, so clean execution does not remove it.

None of it binds anyone yet. The revision is in front of the European Parliament and Council ^[5], and the May 4 reissue reaffirmed the Commission's position without touching the law ^[2]. The 2020 toolbox was a recommendation member states could act on or not, and by early 2026 only 13 of 27 had taken concrete action ^[7]. Voluntary turned out to mean voluntary. The other 14 would start the same 36-month clock as the states that moved ^[8].

The work that survives either legislative outcome is a per-layer inventory: which vendor's equipment sits where, which contract covers it, and what depends on transport capacity that has not been re-verified ^[13][16]. After that, the variable to price is Germany, which the analysis names as the most exposed member state and the one most likely to negotiate the window down before it is binding ^[17].