5G Toolbox in 2025: A Question of Trust

State of the EU 5G Security Toolbox

In October 2019, we published a short illustrated comment explaining how Europe’s approach to 5G security increasingly became distinct from technical security, involving product security features and supply chain integrity. This short piece predicted that any future assessment must factor in trust judged by a vendor’s autonomy from foreign interests.

Five years later, trust and the EU 5G Security Toolbox are today the linchpin for the delicate balance between EU coordination and impermeable Member State competencies. The toolbox introduced the concept of high-risk vendors (HRVs) based on a common risk assessment methodology of 5G infrastructure across all Member States. Whereas the methodology predestined certain mitigation methods for each risk, it was still up to each national authority to determine whether certain risks were prevalent.

Subsequently, several Member States have imposed market restrictions based on a comprehensive implementation of the Toolbox. Notably, Belgium, Denmark, Portugal, Romania, Sweden, and the Baltic states have implemented exclusions that have also spurred legal challenges, Chinese retaliation, or both. Meanwhile, many EU countries have allowed Chinese suppliers to participate in the 5G rollout – thereby avoiding retaliation – but imposed geographic, domain or quantitative restrictions to diversify suppliers, rendering Chinese HRVs commercially unviable in some cases. Notably, the European Commission has also conducted its own risk assessment for EU funding.

Despite the Draghi report’s case for the contrary, any revision of the 5G Toolbox (or to make its application legally binding) is extremely unlikely in the coming years. The appetite for further incursion on national sovereignty within the NIS Cooperation Group is limited, and the group is preoccupied with implementing toolboxes in other domains, including ICT supply chains, EVs, submarine cables and other undisclosed workstreams.

“Death by Thousand Papercuts”

Nonetheless, several Member States are continuously reviewing their risk assessments and their decisions or non-decisions, including Greece, Czechia, Poland, Croatia, Spain, and possibly Finland, not least given the ongoing transposition of the NIS2 Directive. Here is where the current trenches of advocacy, lobbying, and lawfare run between national security and the operators’ commercial interests.

Germany – Europe’s largest telecom market – is another jurisdiction in flux and warrants a short sidebar. From the onset, lobbyists engaged in an intense disinformation effort that feinted the ailing Scholz government into inventing a false vocabulary of “RAN management” and “antennas” – a deliberate effort to play down modern base stations that are full-fledged supercomputers costing €100,000 or more. Also, the absence of a causal link between the risks and the proposed mitigation measures has baffled many experts on both sides, and it cannot be precluded that a CDU-led government will rescind the government’s decision next year.

Frustration over the slow and fragmented progress has sometimes been tangible in Brussels. While many political novices therefore believed that Thierry Breton, then-Industry Commissioner, might take legislative action to force a “full implementation” of 5G Toolbox (a euphemism for banning Huawei) last summer, anyone that matters in Brussels politics knows that an EU-wide legislation entails a decade-long process that would go beyond the limits of current EU competences – which was not a very credible threat from an outgoing administration during its last months.

But such a legislative action is not just politically and constitutionally infeasible – it is also unnecessary. Rather than opting for overtly headline-grabbing bans, the European Commission has adopted an incremental strategy of “death by thousand paper cuts” against Chinese vendors where the European Investment Bank (EIB) has denied financing for EU operators that purchased Chinese equipment, which affected their credit rating and indirectly increases their borrowing from commercial banks.

Similarly, the European Commission has imposed conditions on Recovery and Resilience Facility (RRF) and Connecting Europe Facilty (CEF) for Chinese equipment, regardless of whether the countries have designated them HRVs. In addition to financial constraints, the Commission has severely limited Chinese participation in R&D cooperation under the Smart Networks and Services Joint Undertakings (SNS JU). The EU also provides limited support for the US-led O-RAN Alliance, given its contingent of Chinese and Russian state and military enterprises.

Europe’s third-country challenge

Taken together, the market share of Chinese vendors in Europe has declined from nearly 40 per cent to approximately 25 per cent despite the fragmented implementation of the 5G Toolbox due to diverging national interests. Despite losing around ten per cent of the EU markets (in addition to setbacks in the UK, Norway, Canada, India, Japan, Australia, New Zealand, and Korea), Chinese vendors have expanded their market share in China (at the expense of EU vendors), retaining its market shares on a global basis.

In addition, the three major European operators (Telefonica, Orange, TIM) and the UK-based Vodafone have expanded their use of both Huawei and the Chinese-military-controlled ZTE among their subsidiaries outside the EU to keep the balance. Besides negating EU industrial policy objectives, Global Gateway and other EU or bilateral financing may have directly or indirectly financed the purchase of ZTE and Huawei equipment in Africa, Latin America, and Asia before mid-2024.

Ukraine and the accession candidate countries are also in the spotlight. The Ukraine Facility, the EU financial assistance programme, allocates 50 billion for balancing the budget, investments, and assistance for green transition, digital transformation, and EU integration. Providing “fast and secure” connectivity for Ukraine and integrating it into the EU Digital Single Market is also one of its highest priorities, via the allocation of 4G LTE/5G spectrum bands, building a stable backbone infrastructure that bypasses Russian territory, and aligning Ukraine’s legislation with NIS2.

However, ensuring that Ukraine adopts the 5G Security Toolbox before commencing 5G services will be a common challenge given the circumstances of a full-scale invasion. Persuading Ukraine to implement the toolbox comprehensively will take more than a make-believe promise of a Union membership: Kyiv is balancing at the edge between the US, UK, China and the EU, who all claim legitimate interests in the reconstruction across fixed-line, mobile, and submarine domains. Moreover, Ukraine could easily point to how several major Member States (including two G7 members) have not yet excluded Chinese vendors.

The situation among the Western Balkan partners for 2025 is more hopeful, as these countries (especially Serbia) are intensifying their cybersecurity reforms and EU alignment and adoption of the risk assessment under the toolbox. The recently announced Brussels declaration calls for secure and resilient 5G networks that adhere to EU standards and regulations and are deployed by “trusted vendors”. Aside from Serbia, North Macedonia seems to be ticking all the boxes and Albania, Kosovo and Montenegro are expected to roll out 5G infrastructure in full alignment with the Toolbox.

But taken together, 5G connectivity remains a challenge for the EU neighbourhood and partnership policies given the limited technical and diplomatic resources available. Also, the EU is less accustomed to “tied aid” and is typically not well-placed to leverage military assistance for commercial contracts. Also, the EU telecom operators tend to look exclusively to their self-interest, contrasting the behaviour of other donor countries. Chinese or Japanese service providers would never dream of using anything other than their nationals in ODA-financed infrastructure projects.

Dealing with a new US administration

The situation in Ukraine reveals the complexities involved in the EU advocating for its approach in third countries – especially in regions like Latin America or the Indo-Pacific, where the US, China and Japan wield a slightly bigger influence through bilateral and much more tailored regional instruments. This is just one example of how the incoming Trump administration adds an element of uncertainty to Europe’s policy space.

China is more confident than it was at the outset of the first Trump term. Bolstered by the successes of SMIC and HISilicone, China has imposed import restrictions on Western chipsets in its telecom sector, making US export controls look farcical.

Since the US market has always been free of Chinese equipment, 5G is, first and foremost, a foreign policy question under the purview of the State Department for the Trump administration. Similar to the HRV concept, the Trump administration launched its campaign for “clean networks” and security risks that could only be addressed by excluding Chinese vendors.

In contrast, the transatlantic relations went awry with the Biden administration’s failed efforts to champion indigenous 5G vendors to compete with Europe and China. But it remains true in 2025 that the EU needs regional partners in Latin and South America – rather than another technical or systemic rival – if it wants to remain competitive against Chinese vendors. The US is also where Ericsson and Nokia draw almost two-thirds of their profits, while they are practically non-profit entities in Europe and developing countries.

Meanwhile, the whispers are flying thick and fast on how the incoming administration might augment the US strategy with direct subsidies akin to the CHIPS Act for R&D and manufacturing of 5G and 6G equipment in the US. Subsequently, the EU vendors would be strongly incentivised to relocate some divisions to the US or even move their HQ to the US outright. Such a move would have profound political ramifications – and the Nordics would not let their apex industry crumble to dust. Meanwhile, the Government of France has already acquired Nokia’s submarine cable division, while further M&A activity is expected in 2025.

Towards trusted connectivity

As 2025 approaches, we must recognise that the EU has carefully threaded – sometimes valiantly marched – an arduous path towards formulating a 5G security policy. An informal network of diligent individuals within the Commission has achieved what is supposedly infeasible within the EU structure, gradually setting the rest of the EU machinery into action. For those in the know, the 5G Toolbox is merely a workaround – but it is also a policy innovation in 2019 that changed the reality in the trenches by swiftly changing the burden of proof.

Nevertheless, the failure of last year’s German debate or the diverging risk assessment in Ukraine reiterates the importance of trust, i.e. prioritising the promotion of trusted vendors and technology rather than slapping Beijing in the face for optics. Thus, what began as a question of trust in 2019, which evolved into mechanical branding of Chinese suppliers as “high-risk”, has now returned to a question of trust in 2025.

This is particularly the case in third countries, where it has become imperative to promote “trusted connectivity”, to encourage investment in secure infrastructure adapted to the risks identified in respective countries and situations without singling out specific entities. Rather than a narrow and adversarial notion of HRVs, trusted connectivity is a more forward-looking narrative considering the entire ecosystem, including governance, supply chains, cybersecurity practices, and international cooperation.

On that note, international cooperation is more than just managing the Trump administration’s industrial and digital foreign policy agenda. It also requires working with Canada’s G7 presidency in 2025 and could span 5G, submarine cables, and potentially even cloud infrastructure. In any case, a wider stakeholder base than Sweden and Finland is needed within the EU to mobilise the internal resources necessary for efforts in third countries. To wield such an agenda-setting influence, the EU cannot rely solely on a narrative of excluding threats, whether our counterparts believe they are real or imagined.