Overview

The Royal United Services Institute (RUSI) and Forum Europe are hosting an interactive discussion in Brussels on new research into how European countries manage high-risk ICT vendors in the public sector and critical national infrastructure.

Five years after the height of debates on banning specific vendors from 5G infrastructure, Europe continues to grapple with how to manage risks associated with so-called ‘high-risk information and communications technology (ICT) vendors’, particularly Chinese organisations that have been restricted or excluded from networks in multiple European countries on national security grounds. Although the EU has launched a range of initiatives, a cross-European approach to managing high-risk vendors has been undermined by inconsistent national implementation. In January 2025, Henna Virkkunen, the EU Commission’s executive vice-president for tech sovereignty, security and democracy, emphasised that ‘the current situation with regards to the 5G Toolbox implementation by Member States is not satisfactory.’

Reports suggest the EU intends to look beyond 5G by creating an ICT Supply Chain Toolbox. However, implementing another toolbox still leaves European technology supply chains vulnerable to the exact patchy implementation that has beset the 5G toolbox and other cybersecurity initiatives.

In 2025, RUSI’s Cyber and Tech research group conducted research across three European countries – Germany, Spain, and the UK – to better understand national approaches to managing high-risk ICT vendors. The purpose of the research was to identify inconsistencies and challenges in designing and implementing effective legislation, regulation, and risk management frameworks, and to assess what this reveals about Europe’s broader security posture and supply chain dependencies.

To discuss findings from research based on more than 30 interviews, RUSI and Forum Europe are bringing together policymakers and industry stakeholders for a one-off event in Brussels. The event will discuss the trade-offs between security and cost in the public sector; the challenges of aligning national policies with EU-level initiatives; and the implications for Europe’s relationship with large technology vendors. The session will be held under the Chatham House Rule to enable a frank and forward-looking conversation.