EU 5G Security Toolbox Guide: High-Risk Vendor Measures

The EU 5G Toolbox is soft law, but it drives binding national restrictions on high-risk telecoms suppliers, and the Commission has now proposed to make derisking mandatory. Agreed by EU Member States through the NIS Cooperation Group and endorsed by the Commission on 29 January 2020, the Toolbox sets out strategic and technical measures for securing 5G networks, with restrictions on high-risk suppliers for critical and sensitive assets at its centre. How those restrictions bite depends on national law, which differs from one Member State to the next. This guide summarises the Toolbox's origins, its measures, the state of implementation, the January 2026 Cybersecurity Act proposal, and what the regime means for operators, equipment buyers, managed service providers and the machine identities that run modern networks. It is for security and procurement leads at mobile operators, network vendors, MSPs and large enterprises running private 5G. Status line: checked against Commission, EUR-Lex and European Court of Auditors sources on 27 October 2026. This page is not legal advice.

Key takeaways

• Not binding in itself. The European Court of Auditors confirmed that none of the Toolbox measures are legally binding; force comes from national telecoms and security laws, and from NIS2 and the electronic communications framework.
• 29 measures, one centre of gravity. The Toolbox has eight strategic measures, eleven technical measures and ten supporting actions; SM03, restricting high-risk suppliers for key assets, is the core.
• The Commission has named names. In June 2023 the Commission said Member State decisions to restrict or exclude Huawei and ZTE are justified and that these suppliers present materially higher risks than other 5G suppliers.
• Implementation is uneven. By the 2023 progress report, 24 Member States had adopted or were preparing powers to restrict suppliers, but only 10 had imposed restrictions.
• Mandatory derisking is proposed. The revised Cybersecurity Act proposed on 20 January 2026 (COM(2026) 11) would enable mandatory derisking of mobile networks from high-risk third-country suppliers; check its legislative status before planning to it.

Scope: who and what is covered

The Toolbox addresses the security of 5G networks as a whole, not a single company type. In practice its measures land on four groups.

Enterprises are affected indirectly: private 5G and network slices bought from operators inherit the operators' supplier choices, and public bodies may face procurement rules. The Commission itself said in 2023 that it would avoid exposure of its corporate communications to mobile networks using Huawei and ZTE and would phase their equipment out of its sites' connectivity.

Key obligations

How the Toolbox defines high risk

The EU coordinated risk assessment behind the Toolbox, summarised by the European Court of Auditors, set out the factors used to judge a supplier's risk profile:

• Likelihood of interference by a non-EU government: including strong links between the supplier and that government, the third country's legal framework, and the absence of security or data protection agreements with the EU.
• Ability to ensure supply: the supplier's capacity to keep delivering equipment and support.
• Product quality and cybersecurity practice: the overall quality of products and the supplier's security practices.

The Commission described these as objective factors, and the Toolbox explicitly targets non-technical risks such as interference from non-EU state or state-backed actors through the supply chain.

The measures that matter for supplier risk

What the 2023 progress report asked Member States to do

1. Obtain detailed information from mobile operators on deployed and planned 5G equipment.
2. Impose restrictions on high-risk suppliers without delay, including for critical assets in the radio access network.
3. Stop operators installing new equipment from restricted suppliers and remove existing equipment as quickly as possible.
4. Restrict managed service providers and tighten controls on their access.
5. Pursue supplier diversification and enforce technical measures and supervision.

The NIS2 link

NIS2 (Directive (EU) 2022/2555, in force since 16 January 2023) brings providers of public electronic communications networks and services within scope (recital 92) and requires essential and important entities to manage supply chain security, including suppliers' cybersecurity practices (recital 85). It also gives the Cooperation Group, the Commission and ENISA a role in coordinated security risk assessments of critical supply chains, explicitly modelled on the 5G assessment and Toolbox (recitals 90 and 91). Significant incidents follow NIS2's staged reporting: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (recital 102). See the NIS2 Directive Guide.

Timeline and current status

As at 27 October 2026 the revised Cybersecurity Act was a Commission proposal; we did not confirm its adoption. The press release says the Act would apply immediately once approved by Parliament and Council, with one year for Member States to implement the accompanying NIS2 amendments, and it describes joint EU and Member State identification and mitigation of supply chain risk across 18 critical sectors. It does not set a public phase-out schedule.

National picture: the European Court of Auditors reported that by October 2021, 13 Member States had enacted or amended 5G security laws, that approaches differed on scope (core versus radio access network), that Sweden required phase-out of certain Chinese vendor equipment by 2025 and that Hungary had no restriction framework. The 2023 report counted 24 Member States with laws adopted or in preparation, 10 with restrictions imposed and 3 implementing their legislation. Obtain the current position for each market you operate in from its national regulator or security authority.

Enforcement and penalties

• Toolbox: no enforcement; the Commission cannot enforce soft law.
• National laws: penalties, removal orders and deadlines come from national telecoms security and national security laws and differ widely. In the UK, which left the EU before the Toolbox matured, designated vendor directions sit under the Telecommunications (Security) Act. See the UK Telecommunications Security Act Guide.
• NIS2: supply chain security duties are enforced by national competent authorities with fines and supervisory measures; the fine ceilings are in Article 34 and national transpositions. See the NIS2 Transposition Tracker.
• EU funding: the Commission said in 2023 it would apply its supplier approach across relevant EU funding programmes, so funded projects can lose eligibility.
• Proposed Cybersecurity Act: if adopted, mandatory derisking would add an EU-level legal basis; enforcement details depend on the final text.

What it means for AI agents and non-human identities

High-risk vendor policy is usually discussed as a hardware question, but the threat it addresses, interference through the supply chain, operates through access: remote support connections, vendor-held credentials, management interfaces and automation. That makes machine identity central to SM04 and to any equipment you cannot remove quickly.

• Vendor and MSP access is non-human heavy: remote support relies on service accounts, SSH keys, API credentials and jump hosts. Inventory every credential a supplier or MSP holds, bind it to a named purpose and require just-in-time activation. See the GDAP and MSP Delegated Admin Access Guide.
• Network functions are workloads: 5G core network functions communicate over service-based interfaces using OAuth tokens and certificates. Certificate and token issuance for functions from different vendors should be controlled by the operator, not the vendor. See the Machine Identity, PKI and Certificate Lifecycle Guide.
• Shared device secrets are a known path: the Salt Typhoon telecom intrusions relied largely on stolen legitimate credentials, SNMP community strings, weakly protected local accounts and TACACS and RADIUS shared secrets, which let the actor move between devices and providers.
• Automation and AI operations: AI-driven network operations and vendor-supplied automation agents need their own identities, scoped to specific functions, with actions logged outside the vendor's control.
• Swap-out projects create credential debris: removing high-risk equipment leaves behind accounts, keys and firewall rules that must be revoked, not just powered off.

Compliance steps

1. Map your markets: for each Member State, record the national law, the authority, any vendor designations, the assets covered (core, RAN, transport, operations) and any removal deadlines.
2. Build an equipment and software inventory: by supplier, network domain and criticality, since authorities ask for deployed and planned equipment.
3. Classify critical and sensitive assets: align your classification with the Toolbox's focus on core network functions, network management and orchestration and, increasingly, the RAN.
4. Assess supplier risk profiles: using the coordinated risk assessment factors, and record the evidence behind each decision.
5. Control MSP and third line support access: restrict locations, require operator-controlled jump hosts, session recording and just-in-time credentials, and remove standing vendor access.
6. Write security into procurement: security requirements, right to audit, certification and software transparency (such as SBOMs) in every tender, per TM08.
7. Plan diversification and swap-out: multi-vendor architecture, Open RAN options where appropriate, budgets for replacement, and a credential and configuration decommissioning step for every removed element.
8. Align with NIS2 reporting and supervision: integrate supplier-driven incidents into the 24-hour, 72-hour and one-month reporting path.
9. Track the Cybersecurity Act proposal: assign an owner to follow the legislative procedure and assess how mandatory derisking would affect timelines.

Decision guidance

• Remove or ring-fence: where national law requires removal from core or RAN, plan replacement; where it does not yet, ring-fence high-risk equipment with operator-controlled management, no vendor remote access and enhanced monitoring, and budget for later removal.
• Large operators: treat supplier risk as a board-level programme with per-market legal tracking and a multi-year swap plan.
• Enterprises with private 5G: ask your operator or integrator which suppliers sit in the core and RAN that serve you and how vendor access is controlled.

Detection, measurement and framework mapping

• Critical assets from restricted suppliers: count and percentage, trending to the national target.
• Standing vendor and MSP credentials: number of always-on accounts and keys held by suppliers, target zero.
• Vendor sessions recorded and approved: share of supplier sessions through operator-controlled jump hosts.
• Single-vendor dependency: share of each network domain served by one supplier.
• Decommissioned credentials: accounts, keys and secrets revoked per removed network element.

Common failure patterns

• Treating soft law as optional: ignoring the Toolbox because it is not binding, then facing a national removal order with a short deadline.
• Core only: excluding high-risk suppliers from the core while leaving them in the RAN and management systems that the 2023 report singled out.
• Vendor access left open: high-risk equipment ring-fenced on paper while the vendor keeps standing remote support credentials.
• Swap without clean-up: new equipment installed, old accounts, keys and TACACS or RADIUS secrets left valid.
• One national view for many markets: applying the strictest or loosest regime everywhere instead of tracking each Member State.

Practitioner checklist

• Per-market register of national 5G supplier rules, authorities, designations and deadlines.
• Equipment and software inventory by supplier, domain and criticality.
• Supplier risk profile assessments using the coordinated risk assessment factors.
• No high-risk suppliers in core network functions and a plan for RAN and management.
• Vendor and MSP access through operator-controlled jump hosts with just-in-time credentials and recording.
• Security, audit and certification clauses in every network procurement.
• Credential and secret decommissioning step in every swap-out.
• Owner tracking the revised Cybersecurity Act and NIS2 amendments.

Standards and references

• European Commission: Cybersecurity of 5G networks, EU Toolbox of risk mitigating measures
• EUR-Lex: Commission Recommendation (EU) 2019/534 on the cybersecurity of 5G networks
• European Commission: Secure 5G networks, Commission endorses EU toolbox and sets out next steps
• European Commission: Second report on Member States' progress in implementing the EU Toolbox on 5G cybersecurity
• European Court of Auditors: Special Report 03/2022, 5G roll-out in the EU
• European Commission: Report on Member States' progress in implementing the EU Toolbox on 5G cybersecurity
• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• European Commission: Proposal for a revised Cybersecurity Act

Related NHI Mgmt Group resources: UK Telecommunications Security Act Guide · 5G Security Guide · Telecoms Identity Security Guide · Third-Party Risk Management Guide. This guide summarises the EU 5G Security Toolbox and related EU measures as at 27 October 2026 and is not legal advice.