Telecommunications network equipment and semiconductor supply dependence

Telecommunications network equipment and semiconductor supply dependence are both objects and channels of economic statecraft. States use procurement restrictions, equipment-authorisation rules, vendor directions, export controls and funded replacement programmes to change critical network supply chains. The security case must separate technical vulnerability, vendor governance, legal compulsion, update access, concentration and component dependence. Proof of a hidden backdoor is not required for risk management, but risk findings do not prove exploitation.

Network and supply-chain layers

Mobile radio access equipment and base stations connect users to a carrier network. Core functions manage identity, sessions and traffic. Transport and routing systems move data between sites and networks. Enterprise equipment, management software, cloud functions and update channels create additional control points. A rule covering one category does not automatically cover them all.

Equipment supply also depends on semiconductors, memory, analogue components, design tools, operating software and continuing vendor support. Dependence varies by product and generation. A restriction on advanced chips can force redesign, substitution or delay without eliminating every product line. Conversely, a replacement programme can change the equipment vendor while preserving other concentrated component or software dependencies.

Distinct United States regimes

Four United States regimes must remain separate. Section 889 of the National Defense Authorization Act for Fiscal Year 2019 restricts specified federal procurement and contracting involving covered telecommunications and video-surveillance equipment or services. It is not an economy-wide sales prohibition.

The Secure and Trusted Communications Networks Act created the Federal Communications Commission Covered List and a reimbursement programme for eligible providers removing and replacing covered equipment. Huawei and ZTE were included on 12 March 2021. The Covered List later expanded through category-specific legal authorities, so the current list and each item's scope must be date-locked. The FCC's April 2026 notice described final-stage obligations and recipient-specific deadlines. It did not state that removal was universally complete.

The FCC's 2022 equipment-authorisation rule prevents authorisation of specified covered equipment. It governs market entry for covered radio-frequency devices and does not retroactively remove every deployed device. Commerce Department export controls, including Entity List rules and the Foreign Direct Product Rule, operate through a separate jurisdictional and licensing framework affecting supply to listed entities.

United Kingdom and European Union action

The United Kingdom's 2022 designated vendor direction requires Huawei equipment to be removed from public 5G networks by the end of 2027 and sets earlier deadlines for specified functions. It does not prohibit Huawei equipment in every fixed-network function. The National Cyber Security Centre's 2020 reassessment linked the risk decision in part to the supply-chain consequences of United States semiconductor sanctions, which created uncertainty about future components and assurance. It did not disclose a newly discovered hardware backdoor.

The European Union 5G Toolbox coordinates risk-reduction measures while national-security implementation remains primarily with member states. In 2023 the European Commission assessed decisions to restrict or exclude Huawei and ZTE as justified and consistent with the Toolbox. A Commission proposal updated in February 2026 would require a three-year phase-out of high-risk suppliers. As at 29 July 2026, that measure remained proposed law and must not be described as binding Union legislation.

Statecraft transmission and assessment

The state nexus is direct for legislation, procurement, authorisation, vendor directions and export controls. Carriers, rural providers, integrators, foundries and software suppliers transmit the effects as regulated or commercial intermediaries. The declared objectives include secure government communications, network resilience and reduction of vendor or supply concentration. Alleged hostile intent by a vendor or foreign state remains a separate evidential question.

Assessment should measure equipment removed, replacement completed, cost, delay, service continuity, vendor diversity, security outcomes and unintended concentration. It should also trace how semiconductor restrictions alter design, production and support. Exclusion can reduce one exposure while accelerating domestic substitution or increasing reliance on a smaller set of alternative suppliers.

See also

Huawei · Allied restrictions on Huawei in 5G networks (2018-present) · United States Entity List and foreign direct product rule campaign against Huawei (2019-present) · Supply-chain resilience

Sources

1. Federal Communications Commission, Covered List, DA 26-548, 4 June 2026.
2. United States Congress, Secure and Trusted Communications Networks Act of 2019, Public Law 116-124, 12 March 2020.
3. Federal Communications Commission, Wireline Competition Bureau Reminds Rip-and-Replace Program Recipients of the Necessary Steps to Complete Program Participation, DA 26-386, 20 April 2026.
4. United States Congress, John S. McCain National Defense Authorization Act for Fiscal Year 2019, Public Law 115-232, section 889.
5. Federal Communications Commission, Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, FCC 22-84, 25 November 2022.
6. United Kingdom Department for Digital, Culture, Media and Sport, "Huawei Legal Notices Issued", 13 October 2022.
7. Secretary of State for Digital, Culture, Media and Sport, Huawei Designated Vendor Direction (2022).
8. United Kingdom National Cyber Security Centre, "NCSC Advice on the Use of Equipment from High Risk Vendors in UK Telecoms Networks".
9. United Kingdom National Cyber Security Centre, Summary of NCSC Analysis of US May 2020 Sanctions (2020).
10. European Commission, Communication on the Implementation of the 5G Cybersecurity Toolbox, 15 June 2023.
11. European Commission, "Commission Proposes Three-Year Phase-Out of High-Risk Suppliers from 5G Networks", updated 2 February 2026.
12. United States Department of Commerce, Bureau of Industry and Security, "Export Administration Regulations, Part 744".
13. United States Department of Commerce, Bureau of Industry and Security, The Foreign-Produced Direct Product Rule.