The morning read on Europe's digital policy Friday 30 October 2026
Search

Huawei 5G ban in Europe: which countries restrict Huawei and ZTE

As of October 2026 there is no EU-wide legal ban on Huawei or ZTE in 5G networks. Restrictions are national: Sweden, Estonia, Lithuania, Romania and Portugal keep high-risk vendors out of 5G, Germany's operators must remove critical Huawei and ZTE components from their 5G core networks by the end of 2026, and Poland and the Czech Republic have new laws that allow bans. An EU law that would make removal mandatory is still under negotiation, and EU governments have proposed dropping its 36-month deadline for mobile networks.

Last checked: 30 October 2026.

Huawei and ZTE rules at a glance

  • Germany: out of 5G core networks by the end of 2026; critical network management functions replaced by the end of 2029.
  • Sweden: out of central 5G functions by 1 January 2025.
  • Estonia: 5G transition period ended on 31 December 2025; 2G to 4G period runs to 31 December 2029.
  • Lithuania: replacement of non-compliant equipment due by the end of 2025.
  • Poland: designation law in force since 2 April 2026.
  • Czech Republic: law in force since 1 November 2025 lets the government prohibit risky suppliers.
  • Romania: Huawei's applications for 5G authorisation rejected in 2024.
  • Portugal: high-risk criteria since 2023, no published removal date.
  • France: prior authorisation for 5G radio equipment since 2019.
  • United Kingdom (outside the EU): Huawei out of 5G by the end of 2027.

Is there an EU ban on Huawei 5G equipment?

Not yet. The EU 5G Toolbox, endorsed by the Commission on 29 January 2020, recommends restricting high-risk suppliers in the critical and sensitive parts of networks, but it is soft law, as the European Court of Auditors noted. In June 2023 the Commission called national restrictions on Huawei and ZTE justified and said the two "represent in fact materially higher risks than other 5G suppliers". A progress report that day found that 10 member states had imposed restrictions.

The Cybersecurity Act 2 proposal

The Commission's Cybersecurity Act 2 proposal of 20 January 2026 (COM(2026) 11) would make the approach binding:

  • The Commission could designate a third country as posing serious and structural non-technical risks to ICT supply chains and list suppliers established in or controlled from it as high-risk. The draft names no country or company.
  • Operators could not use or install components from listed suppliers in the key assets of mobile networks, and existing components would be phased out.
  • For mobile networks, the phase-out would be capped at 36 months from publication of the supplier list.
  • Listed suppliers could not obtain EU cybersecurity certificates, according to the Commission's Q&A.

The Commission's impact assessment puts the cost for mobile operators at roughly €3.4 billion to €4.3 billion a year during the transition. In September 2026, 17 telecom chief executives, including Deutsche Telekom's Timotheus Höttges, warned in a Connect Europe letter that forcing out high-risk suppliers could cost the sector up to €40 billion. A 22 September EU governments' document reported by Reuters shows EU governments replacing the 36-month cap with periods based on the level of risk, equipment lifecycles, replacement cycles, interoperability and available alternatives. The text still needs the European Parliament's agreement; we follow it in Policy.

Huawei and ZTE restrictions by country

Entries cover laws, licence conditions and binding agreements as of October 2026; operator news is in our Telecom section.

Germany: core by end-2026, management systems by end-2029

Germany used contracts rather than a statutory ban. Under public-law agreements described in the government's March 2026 answer to the Bundestag, Telekom, Vodafone and Telefónica must stop using critical Huawei and ZTE components in their 5G core networks by the end of 2026, and by the end of 2029 replace the critical functions of Huawei and ZTE management systems in their 5G access and transport networks. Reuters reported in 2024 that the second stage would also cover Chinese antennas, transmission lines and towers by 2029, while the government's answer refers only to management systems.

Sweden: existing equipment out by 1 January 2025

The regulator PTS attached conditions to its 3.5 GHz and 2.3 GHz licences in October 2020. Huawei and ZTE products may not be used in new installations of central functions, covering radio access, transmission, core, and service and maintenance networks, and existing equipment in those functions had to be phased out by 1 January 2025. An appeals court in Stockholm upheld the conditions in June 2022.

Estonia: 5G transition period ended in 2025

Estonia's Electronic Communications Act requires that network hardware and software pose no risk to national security, and operators need authorisation from the regulator TTJA. Producers are assessed against 12 criteria, including whether their home country respects democratic and human rights principles and whether it subjects producers to state authority without independent judicial control. For equipment found to pose a risk, the law sets transition periods until 31 December 2025 for 5G and 31 December 2029 for 2G to 4G, as the Advocate General's opinion in case C-354/24 sets out.

In that case, brought by Elisa Eesti over its Huawei equipment, Advocate General Tamara Ćapeta advised the Court of Justice in March 2026 that member states may in principle exclude such equipment on national security grounds if the measures are proportionate and open to judicial review. The opinion is not binding.

Lithuania: replacement due by the end of 2025

Lithuania's parliament amended its communications and national security laws in May 2021 to keep manufacturers deemed unreliable out of the market, especially for 5G. Operators using non-compliant equipment had until the end of 2025 to replace it or be barred from applying for state-allocated 5G frequencies.

Poland: ban mechanism in force since April 2026

The amended National Cybersecurity System Act, signed by President Karol Nawrocki on 19 February 2026, took effect on 2 April 2026. The digital affairs minister, with the government's cybersecurity advisory body, can designate a supplier as high risk; new deployments are then banned and existing equipment must be phased out within up to seven years, or up to four years for the largest telecom operators. The law names no company, and the president referred these provisions to the Constitutional Tribunal.

Czech Republic: government can prohibit risky suppliers

Act No. 264/2025 on cyber security, in force since 1 November 2025, requires providers of strategically important services to vet suppliers of security-relevant supplies. Based on a government decision, the cyber agency NÚKIB may set conditions on, or prohibit, the use of a risky supplier.

Romania: Huawei refused authorisation

Law 163/2021 admits 5G equipment and software only from manufacturers authorised in advance by the prime minister, based on approval from the Supreme Council of National Defence; one condition is that the manufacturer is not controlled by a foreign government. A decision rejecting Huawei's applications was published on 29 February 2024. The law sets replacement periods of five years for core-network equipment and seven years for other equipment. In 2026 the Bucharest Court of Appeal sent Huawei's challenge to the law to the Constitutional Court.

Portugal: high-risk criteria since 2023

A deliberation of 23 May 2023 by the Security Assessment Commission, under the Higher Council for Cyberspace Security, sets criteria for high-risk 5G suppliers, among them being based outside the EU, NATO or OECD and having a home government able to control or pressure them. It covers the core, network management, radio access and transport layers, names no company and sets no fixed removal date. Huawei challenged it before a Lisbon administrative court in 2023.

France: prior authorisation since 2019

A law of 1 August 2019 requires operators of vital importance to obtain the prime minister's authorisation before running certain equipment that connects users to 5G and later mobile networks. Authorisation can be refused for a serious national security risk, taking into account whether the operator or its suppliers are controlled by, or subject to interference from, a non-EU state, and it lasts at most eight years. The Constitutional Council upheld the regime on 5 February 2021.

United Kingdom (outside the EU)

Under the Telecommunications (Security) Act 2021, a designated vendor direction sent to 35 operators in October 2022 banned new Huawei installations in 5G networks, required Huawei's removal from network cores by 31 December 2023 and from all 5G networks by the end of 2027.

Gaps in the national picture

This guide lists only measures documented in laws, regulator decisions, court records or government statements. The Commission's proposal says uneven national rules have left a large number of EU 5G sites supplied by high-risk vendors, and a February 2026 Strand Consult note cited by Reuters puts the largest share of equipment due for replacement in Germany, Italy and Spain. Five of the national regimes above (Estonia, Lithuania, Poland, the Czech Republic and Romania) are in central and eastern Europe.

Frequently asked questions

Has the EU banned Huawei from 5G networks?

No. As of October 2026 the 5G Toolbox is only a recommendation, and the Cybersecurity Act 2, which would require high-risk suppliers to be phased out, is still being negotiated.

Which European countries have banned Huawei 5G?

Sweden barred Huawei and ZTE from central 5G functions with a 1 January 2025 removal deadline, and Estonia, Lithuania, Romania and Portugal exclude high-risk vendors from 5G. Germany requires critical Huawei and ZTE components to leave 5G core networks by the end of 2026, and the UK requires Huawei's removal from 5G by the end of 2027.

Is Huawei banned in Germany?

Not completely. Critical Huawei and ZTE components must leave 5G core networks by the end of 2026, and critical network management functions in access and transport networks must be replaced by the end of 2029.

What is a high-risk supplier under the Cybersecurity Act proposal?

Under the Commission's draft, it is a supplier established in, or controlled from, a third country that the Commission has designated as posing serious and structural non-technical risks to ICT supply chains. The draft names no country or company.

How long would operators have to remove Huawei equipment under EU rules?

The Commission proposed up to 36 months for mobile networks, counted from publication of the high-risk supplier list. EU governments' September 2026 text replaces that cap with case-by-case periods, so the final deadline depends on talks with the European Parliament.