The reform, proposed in January 2026, creates a mechanism for ‘security of supply chains’ in the information and communications technology (ICT) sector. The mechanism empowers the Commission to label non-EU companies as ‘high-risk suppliers’, which shuts them out of large parts of the European market. The Commission may also label entire countries as posing risks to ICT supply chains, excluding from EU markets all companies established there or controlled by entities connected to that country.

The restrictions connected to being designated a ‘high-risk supplier’ are far-reaching. A designated supplier’s components may not be used in the key assets of Europe’s mobile, fixed and satellite networks, and components already installed must be ripped out. The supplier and its products are barred from public procurement across the EU and from anything funded by the EU budget. Its European cybersecurity certificates are withdrawn and it is barred from being an accredited conformity assessment body or from becoming an authorised provider of cybersecurity skills attestations. It is also blocked from the rooms where European cybersecurity standards are written. The Commission may extend the ban to key ICT assets in all eighteen sectors that EU law treats as critical.

Discrimination is Central to the Legal Problems of the Proposal

An element in the mechanism that makes it particularly problematic is that it does not apply at all to fully domestic EU companies. If a company is established in the EU, and is owned and controlled by EU nationals, it is immune to being a ‘high-risk supplier’ under the proposed mechanism. This runs against the core principles of WTO law, says Dr Vidigal:

''Instead of strengthening cybersecurity rules and verification mechanisms for all product suppliers, the EU is imposing a massive burden on non-EU companies, all while ensuring that EU companies are exempted from the mechanism regardless of what they do. This means that, even before any company is designated, purchasers are far more likely to buy their products from an EU company. This violates the WTO’s non-discrimination obligations and imposes unnecessary restrictions on the ability of non-EU companies to supply their products.''

The proposed system would breach various commitments in the WTO Agreements. Discrimination against foreign suppliers violates the core most-favoured-nation and national treatment obligations of the GATT, as well as their equivalents in the WTO Agreements on investment measures and on trade in services. The proposal also contradicts the EU’s market access commitment on foreign capital participation and the recently inscribed Services Domestic Regulation disciplines, as well as obligations to give foreign companies access to certification and standardisation procedures.

WTO rules expressly allow Members to adopt measures to pursue legitimate regulatory  objectives, and contain specific exceptions for the pursuit of essential security objectives. But general regulatory objectives must be pursued in a way that preserves the legal framework of WTO law, while security objectives apply in tightly constrained circumstances. Dr Vidigal’s Opinion concludes:

Dr Vidigal notes that the proposed reform is part of a broader trend: ‘The Commission claims to be responding to ever greater cybersecurity threats and an increasingly complex geopolitical reality. However, the proposed response only contributes to the wider movement of “securitisation” of international economic relations, which challenges the bases of the very legal framework that has ensured stability in global relations over the past three decades’.