The Horizontal Working Party on Cyber Issues has spent four months debating whether the Commission’s revised Cybersecurity Act will damage Europe’s 5G rollout, arguing that the phase-out window is either impossibly short or irresponsibly long, depending on who is speaking.
Earlier this year, my colleague and I conducted a regression analysis of the factors that determine the speed of 5G rollout, coverage, and affordability, using data from 39 markets reported by operators themselves through the industry association GSMA.
The central finding was that vendor restrictions themselves – i.e., whether equipment vendor markets were restricted or not – had no statistically significant effect on roll-out, coverage, or service affordability. In other words, whether a certain supplier is in your network does not predict the national performance.
How the Econometrics Apply
Only two restriction-adjacent variables were relevant for 5G rollout: how early the restriction decision was taken after commercial licensing, and, in cases where restrictions were imposed, how generous the phase-out window was. Based on historical 5G launches, we can see that each of these factors moved the GSMA Connectivity Index by up to 4 points (on a scale of 0 to 100).
Applied to CSA2 as drafted by the Commission:
- The EU’s first commercial 5G licences were assigned in October 2018. CSA2 was published on 20 January 2026. The delay is 87 months. At −0.035 points per month, that is a 3-point penalty already locked in, before a single piece of equipment is removed.
- Furthermore, Article 110(3) grants a 36-month phase-out for mobile networks. At +0.041 points per month, that recovers 1.5 points.
- In reality, the phase-out is much longer, given the number of years (not months) it will take to negotiate CSA2.
The impact on the composite 5G Index:
- The net effect on the composite Connectivity Index is -1.6 points. If we then consider that half of the Member States are already subject to equivalent exclusions (via the 5G toolbox, NIS2 implementations, or purely commercial decisions), the actual impact is approximately -0.8 points on a scale of 0 to 100, i.e., not much.
- Just to put things into context, this drop in score is equivalent to the score gap between the Netherlands and Germany – and I suspect most readers won’t know which of the two is ahead.
The specific impact on coverage and affordability:
- On the coverage sub-index, where the coefficients are slightly larger, the actual impact amounts to -1 point.
- On end-users’ service affordability, the variables are not significant, and the answer is zero.
Ironically, the zero impact on end-users is the cleanest result in the regression and the one that Member States worry most about – and its reasons are primarily structural. To begin, the operator market is more concentrated than the vendor market: a handful of MNOs per country, no cross-border retail competition, ARPU determined by national regulatory and competitive conditions that bear no relation to which RAN supplier sits in the basement.
Simply put: vendors already compete across the Single Market at effectively zero margins, whereas operators do not. In contrast, the pricing relationship between the operator and the customer was set years ago by demand factors that long predate high-risk designations. The Commission’s estimate of EUR 3.4–4.3 billion per year in the SWD is likely real, but it is a transfer between some operators’ balance sheets and equipment vendors, and the regressions show that it does not reach consumers’ bills.
Key Takeaways
The takeaway for the Council is uncomfortable but straightforward. Empirical data show it is agnostic about whether a government allows or bans high-risk vendors – but those who proceeded with spectrum auctions before supply-chain rules were settled are being punished. Unlike the rest of the OECD countries, the EU auctioned spectrum from 2018 onwards into a security framework that is still being drafted in 2026.
The single largest cost CSA2 imposes on Europeans is not the replacement bill. It is the 87 months it took the EU executives to present the proposal, followed by what will likely be another two years before it is negotiated and enters into force. This delay caused twice as much damage as any phase-out can mitigate.
See also following ECIPE insights by Lee-Makiyama on CSA2: