STRAND CONSULT’S research suggests that mission-critical communications systems for defense, public safety, and emergency services could prove as the next major opportunity for mobile operators. The research indicates that these sectors could become an important new source of demand and revenue for commercial mobile networks.
In the future defense and public safety organizations increasingly operate through MVNO-type arrangements on existing mobile networks, leveraging the RAN infrastructure, spectrum, coverage, and scale that commercial operators have already built.
The European Commission’s proposal for an EU Critical Communication System (EUCCS) therefore has important implications for the telecom industry. Rather than creating a parallel communications infrastructure, the opportunity is to build on Europe’s existing commercial mobile networks and the investment already made by operators.
Strand Consult has undertaken an initial review of the proposal and its implications for the telecommunications industry. The Commission’s accompanying communication is also important for understanding the policy rationale. Executive Vice-President Henna Virkkunen and Commissioner Magnus Brunner, under the title “Remarks by EVP Virkkunen and Commissioner Brunner on the EU Critical Communication System,” described EUCCS as a framework for strengthening secure, resilient and interoperable critical communications across the EU.
At its core, EUCCS seeks to make national critical communication systems interoperable across borders and agencies while retaining Member State control. The proposal establishes a common framework for the transition to secure and resilient mission-critical broadband, with rollout beginning in 2030 and full interconnection targeted for 2036. From Strand Consult’s perspective, the proposal is commercially more significant for the telecommunications industry than its public-safety framing might initially suggest.
Importantly, the proposal does not require Member States to construct separate, dedicated networks. Instead, national critical communication systems are expected to make use of existing commercial infrastructure, including network slicing, with additional requirements for security, resilience and service performance. This places commercial mobile network operators and other telecommunications providers directly within the operational architecture of EUCCS.
The proposal would establish defined obligations concerning latency, jitter, packet loss and throughput, alongside priority and pre-emption requirements in periods of network congestion. In effect, commercial infrastructure would be incorporated into a public-sector critical communications framework with legally defined performance and availability requirements.
This raises an important commercial question: how will operators be compensated for the additional investment, capacity, resilience and operational obligations that EUCCS imposes? The proposal refers to remuneration on “fair and reasonable” terms, but does not establish a precise methodology for determining what those terms mean. This leaves considerable scope for interpretation and, potentially, dispute during implementation.
The scale of the investment cycle is also significant. The Commission estimates EUR 3.571 billion in direct EUCCS costs, against an estimated EUR 12.667 billion associated with the broader national transition to broadband critical communications over a seven-year period. This is not a single EU-level procurement exercise. Rather, the expenditure will be channelled through 27 national implementation and procurement processes, each operating within a sensitive security environment in which existing supplier relationships, national industrial policy and procurement practices are likely to matter.
For telecommunications operators and technology suppliers, the commercial significance therefore extends well beyond the technical interoperability objective. EUCCS has the potential to shape which infrastructure, vendors and service providers are eligible to participate in a substantial new cycle of national critical communications investment.
The EUCCS–CSA2 connection
The supply-chain provisions are among the most consequential and politically sensitive elements of the proposal. EUCCS provides for the exclusion of high-risk suppliers not only from the mission-critical core but also from “any other key ICT assets.” That formulation is deliberately broad. Depending on how it is interpreted and subsequently implemented, the provision could extend well beyond the core communications infrastructure and into other parts of the technology stack supporting critical communications
For Strand Consult, an important point is that these restrictions cannot be assessed in isolation from the Cybersecurity Act 2 (CSA2) process. The practical scope of the EUCCS supply-chain provisions will depend in significant part on how the relevant CSA2 provisions and designation criteria ultimately develop.
This creates an important element of uncertainty. CSA2 remains subject to the legislative process, and its final designation criteria may differ from those currently contemplated. If the criteria are narrowed during the negotiations, the practical reach of the EUCCS restrictions could consequently be narrower than the proposal’s initial language suggests.
At the same time, EUCCS provides CSA2 with its first particularly concrete dual-use application. Critical communications for police, emergency services, border authorities and other public-security functions provide a direct example of how cybersecurity and supply-chain rules can translate into operational requirements for communications networks. This strengthens the political connection between the two legislative files and creates a feedback mechanism between them.
The sovereignty provisions also extend beyond physical network equipment. The proposal addresses the use of third-country legislation that could require access by foreign authorities to data transmitted through EUCCS. Consequently, the sovereignty question potentially reaches into cloud services, software, managed services and other elements of the digital infrastructure supporting critical communications.
Why this matters for the telecom industry
The central issue for industry is therefore not simply whether Europe should have interoperable critical communications. That objective is broadly understandable. The more consequential question is how the EU intends to procure, finance, secure and regulate the commercial infrastructure on which that capability will depend.
EUCCS effectively creates a new category of regulated use of commercial communications infrastructure. Operators will be expected to provide capacity and specified performance characteristics, maintain resilience and security requirements, support priority and pre-emption, and potentially accommodate restrictions on suppliers and technology choices.
The economic consequences will depend heavily on the implementation choices made by Member States and the European Commission between now and the beginning of the planned 2030 rollout. In particular, the definitions of “fair and reasonable” remuneration, the scope of high-risk supplier restrictions, the treatment of network slicing and the allocation of investment and operational costs will be critical to determining the ultimate impact on operators and suppliers.
Strand Consult will continue to analyse the EUCCS proposal as the legislative and implementation process develops, with particular attention to its implications for commercial mobile networks, network investment, procurement, supplier policy and the economics of critical communications.
Background Material
Against the backdrop of growing European concern over cybersecurity, supply-chain resilience, and the role of high-risk third-country suppliers in critical infrastructure, Strand Consult has followed the European Commission’s evolving Cybersecurity Act framework and its implications for the telecommunications sector. See the note Cybersecurity Package, proposed by the European Commission (Feb 2026). The package is designed to strengthen the EU’s resilience, preparedness, and response to rapidly evolving cyber and hybrid threats that increasingly target critical sectors. At its core is a revised Cybersecurity Act that updates the EU’s cybersecurity framework to address contemporary risks, particularly in information and communication technology (ICT) supply chains, including risks linked to high-risk third-country suppliers. This proposal would apply across all 27 EU Member States, the three EEA countries (Iceland, Liechtenstein, and Norway), and Switzerland. It covers 18 industries in total, of which telecommunications is only one. Strand Consult details in “European Commission’s Proposal Wants to Secure Telecom and 17 Other Critical Industries from High-Risk Suppliers.”
In Europa exposure to High-Risk Vendors (HRVs) is now concentrated in a small number of Member States. There are approximately 91 5G networks in the EU, of which around 60 were supplied by trusted vendors—Samsung, Nokia, and Ericsson—at the beginning of 2026. Approximately 10 additional networks are expected to be supplied exclusively by trusted vendors by the time the Cybersecurity Act (CSA2) comes into effect, following national implementation of the 5G Toolbox.
Approximately 30 networks still have between 35 and 100 percent of their radio access network (RAN) supplied by High-Risk Vendors. This does not apply to the core network, which has already been upgraded for 5G using trusted suppliers. These networks are owned and operated by a limited number of operators across Europe that made a commercial decision to retain High-Risk Vendors when upgrading their 4G equipment to 5G, and they continue to do so as of early 2026. These operators should have understood, based on the action taken by the European Commission and at least half of the EU Member States under the 5G Toolbox from 2019, that this was not a prudent decision.
A substantial share of the equipment scheduled for replacement over the next five years is concentrated in Germany (Vodafone, O2, and Deutsche Telekom), Italy (Vodafone and Wind Tre), and Spain (MasOrange and Vodafone). Based on Strand Consult’s analysis, combined with figures from the EU’s Regulatory Impact Assessment, as well as the underlying figures, these three countries make up over 55 per cent of the equipment that must be replaced over the next five years, which presents an opportunity to replace the supplier.
Rather than focusing on practical solutions for the relatively small number of operators that continued to deploy High-Risk Vendors after 2019. The transition to trusted vendors has already been completed, or is well underway, across most European mobile networks. The remaining costs are the consequence of commercial decisions made by a limited number of operators despite more than a decade of evolving security policy and clear regulatory signals from the European Union.
Over the past eight years, Strand Consult has published extensive research on the security, economic, and competitive implications of relying on High-Risk Vendors. That research has consistently challenged many claims made by both certain operators and High-Risk Vendors regarding the costs and consequences of supplier replacement.
The evidence from Europe is clear. Countries and operators that implemented the EU’s 5G Toolbox have successfully transitioned to trusted vendors while maintaining competitive 5G deployment and network performance. At the same time, some operators continue to argue that they play a critical role in national security while choosing to retain High-Risk Vendors in their networks. As national security becomes an increasingly important consideration for governments, regulators, investors, and enterprise customers, that position is becoming progressively more difficult to justify.
