Connect Europe and GSMA Europe have issued a joint position on the European Commission’s proposed revision of the Cybersecurity Act, highlighting both support for certain elements and concerns over provisions affecting ICT supply chains.

The organisations reaffirm that the telecommunications sector plays a critical role in economic and societal resilience and is a key target for cyber threats. They note that telecom operators already implement extensive technical, operational and organisational security measures, including multi-vendor strategies aligned with the EU 5G Cybersecurity Toolbox.

While welcoming parts of the proposal, the groups express concern over proposed ICT supply chain measures under Title IV. They argue these provisions go beyond what is necessary, introducing significant financial, operational and service-level burdens, including potential “rip and replace” requirements for existing technologies.

According to Connect Europe and GSMA Europe, such measures risk diverting resources away from network modernisation and innovation at a time when operators must invest heavily in next-generation technologies, including AI-enabled networks, 6G development and quantum-secure infrastructure. They also caution that this could undermine competitiveness and resilience across Europe’s telecom sector.

On the ECCF, the organisations support efforts to improve cybersecurity certification but stress that schemes should remain voluntary, aligned with international standards, and developed with strong industry involvement. They also call for mutual recognition of national certifications and avoidance of overlapping certification layers.

Regarding ENISA, the groups support an expanded mandate but emphasise that the agency should remain focused on technical coordination and guidance rather than becoming a quasi-regulatory authority.

On broader cybersecurity legislation, including NIS2-related simplification efforts, Connect Europe and GSMA Europe argue that the current proposals do not meaningfully reduce complexity. They call for clearer simplification, reduced legal uncertainty, and more efficient incident reporting through a single-entry point system that avoids duplicate national reporting obligations.

The organisations ultimately call for the deletion of Title IV provisions from the proposed regulation, maintaining that cybersecurity policy should remain primarily within Member State competence and better reflect operational realities and investment needs in the telecom sector.