EU Cybersecurity Rules Could Cost Bloc €367.8 Billion, Study Says

Proposed European Union cybersecurity rules aimed at reducing reliance on Chinese suppliers could impose costs of more than $400 billion on the bloc over the next five years, according to a study released on Wednesday for the China Chamber of Commerce to the EU (CCCEU).

The proposed legislation would require the gradual removal of equipment and components from suppliers classified as “high-risk” in critical sectors across the EU. Chinese technology company Huawei is expected to be among the firms most affected by the measures.

The proposals have already triggered criticism from Beijing, which has urged the EU to remove references to “countries posing cybersecurity concerns” and “high risk” from the draft rules. China also warned last week that it could introduce countermeasures if the legislation proceeds without substantial amendments.

KPMG Study Highlights Economic Impact

A study commissioned by the CCCEU and conducted by KPMG estimated that replacing Chinese suppliers across 18 critical sectors would cost the EU approximately 367.8 billion euros between 2026 and 2030.

According to the report, the costs would stem from replacing hardware, writing down existing assets, and dealing with reduced operational efficiency. In addition, the study warned that the measures could delay digitalisation efforts across the bloc.

The report identified the energy and telecommunications sectors as two of the most heavily affected industries. Both sectors play a central role in the EU’s broader digital and green transition plans.

Furthermore, the study suggested that businesses and governments would face operational disruptions during the transition away from Chinese technology providers.

Germany Expected To Bear Largest Share

Among EU member states, Germany is projected to face the largest financial burden. The study estimated that Germany alone could incur costs of 170.8 billion euros over the five-year period.

France, Italy, Spain, Poland and the Netherlands were also identified as major economies likely to face losses exceeding 10 billion euros each.

The report argued that the scale of the investment required could place additional pressure on European industries already dealing with rising costs and economic uncertainty.

Legislative Process Still In Early Stages

Despite the strong reactions from China and industry groups, the proposed EU cybersecurity legislation remains in the early stages of the bloc’s legislative process.

EU governments and the European Parliament must still negotiate and amend the proposals before they can become law. The lengthy process is expected to result in further revisions and debate over the scope of the measures.

Separately, the European Commission recommended on Monday that EU funding should be restricted for projects involving power inverters supplied by companies considered “high risk”.

The Commission said such equipment could potentially allow the remote shutdown of electricity networks within EU member states, raising concerns about energy security and infrastructure resilience.

With inputs from Reuters