The proposed Cybersecurity Act 2 (CSA2, Flash) would establish a mechanism for the European Commission to designate and ban or restrict the use of ICT components from high-risk suppliers (HRS) in the sectors in scope of the directive on measures for a high common level of cybersecurity across the EU (NIS2, Tracker). The sectors include, for example, energy, transport and digital infrastructure such as data centres, cloud computing and telecoms.

For mobile communication networks, the proposed CSA2 sets out concrete measures requiring the removal of ICT components from HRS in key 5G assets (e.g. core network) within three years of a supplier being designated by the Commission.

This would make mandatory one of the central measures of the 5G risk management toolbox (legally non-binding) on de-risking 5G networks from HRS (Tracker). The same obligation would also apply to fixed and satellite electronic communication networks, although the proposal does not set removal deadlines for these types of networks.