EU carriers price rip-and-replace of 'high-risk' gear at €35 billion

EU telecom operators have put a central price of €35 billion on ripping "high-risk" network gear out of their networks, the first industry-commissioned number to size the EU's security policy in real capex terms. The figure comes from a GSMA Intelligence study commissioned by seven EU carriers, and the gap between it and the €40 billion downstream outlets are citing is where the policy dispute lives. At recent EUR/USD rates near 1.08, the central estimate translates to roughly $38 billion, with the indirect-inclusive number at about $43 billion.

"High-risk vendor" is the operator euphemism for Huawei and ZTE under the EU 5G Cybersecurity Toolbox, a 2023 policy framework that lets national regulators restrict or ban telecoms equipment makers deemed a security risk. In practice, the flag has fallen hardest on the two Chinese suppliers whose gear sits inside European mobile, fixed, and transport networks, and member states have been translating that policy into firm rip-and-replace timelines.

The €35 billion central estimate breaks down across three categories. Mobile network rip-and-replace, the largest line item because 5G radio gear from the flagged vendors is the most deeply embedded in operator networks, runs €16–22 billion (~$17–24B). Fixed network rip-and-replace adds up to €5 billion (~$5.4B). Transport, the backhaul and core routers and optical kit that underpins everything above it, runs €9–12 billion (~$10–13B). Transport is the most underestimated of the three: replacing backhaul and optical kit is what turns a radio swap into a multi-year rebuild.

The €40 billion figure that Mobile World Live and Italy's Key4Biz report is the operator's central estimate plus the additional and indirect costs the GSMA Intelligence central figure does not capture. The €35 billion figure is the direct bill. The €40 billion figure is what happens when the financial impact on operator balance sheets is added in. Whether Brussels ultimately compensates any of the indirect side is the part member states have not agreed on.

Seven of the EU's larger carriers commissioned the study, so the position it adopts is that of a sector that wants policy support to absorb the security-driven capex bill. TelecomTV reports Telus and Telefonica as two operators actively navigating HRV removal in their European footprints, so the study's assumptions track decisions operators are already making.

SC World has reported the operator figure could understate the bill by up to four times. The €40 billion downstream figure is the lower end of that range. The upper end, if the SC World reporting is right, runs several times the operator central number.

The counterweight comes from a BankInfoSecurity critic who argues the operator cost figure is exaggerated. That view and the SC World concern that the figure understates the bill point in opposite directions, and the policy sits between them. The question is who pays, and how much of the indirect cost ends up on operator balance sheets versus being absorbed by member-state subsidies or by the vendors themselves through accelerated replacement deals.

What the €35 billion figure does is turn the policy into a number that finance ministries and national regulators cannot wave away. The original Telecompaper report presented it as the operator side of an accounting argument. The policy side is what comes next, and member states' rip-and-replace timelines are now firm enough to underwrite real capex decisions. The next move belongs to the European Commission and to the member-state regulators who have to decide whether €35 billion is the bill, or whether €40 billion is.