{"id":47214,"date":"2026-09-02T17:07:05","date_gmt":"2026-09-02T15:07:05","guid":{"rendered":"https:\/\/www.vnc-china.nl\/cybersecurity-china-and-the-price-of-european-self-reliance\/"},"modified":"2026-09-22T14:23:51","modified_gmt":"2026-09-22T12:23:51","slug":"cybersecurity-china-and-the-price-of-european-self-reliance","status":"publish","type":"post","link":"https:\/\/www.vnc-china.nl\/en\/cybersecurity-china-and-the-price-of-european-self-reliance\/","title":{"rendered":"Cybersecurity, China and the Price of European Self-Reliance"},"content":{"rendered":"

Reporting from Shanghai, Yereth Jansen analyzes the debate surrounding the revision of the European Cybersecurity Act. A report by the China Chamber of Commerce to the EU (CCCEU) and KPMG warns of hundreds of billions of euros in costs if Chinese suppliers are barred from European critical infrastructure. But the real question is broader: is this an expensive security measure, or the long-awaited beginning of serious European industrial policy? <\/i>
\n<\/i>Jansen is clear: \u201cEurope must not choose between naive openness and blunt protectionism. It must choose mature reciprocity.\u201d<\/i><\/p><\/blockquote>\n

Raising the Stakes<\/b><\/h3>\n

Recent discussions regarding the New European Cybersecurity Act (CSA2)<\/em> may seem technical at first glance. They involve ICT systems, supplier risks, networks, certification, and critical infrastructure. But a closer look reveals that more is at stake. Europe is not just conducting a legal debate about cybersecurity; it is debating power, dependency, and whether the continent is still capable of building the systems upon which its economy runs.<\/p>\n

The original<\/i> Cybersecurity Act<\/em> from 2019 had a fairly clear function. The law gave ENISA, the European Agency for Cybersecurity, a stronger mandate and laid the foundation for European certification of ICT products, services and processes. The goal was to harmonize technical standards so that a product or service would not have to go through a different vetting circus in every EU country. Certification was meant to build trust, not to engage in geopolitics. ENISA describes it as a framework to make the security level of ICT solutions recognizable and comparable throughout the EU.<\/p>\n

With the proposed revision, commonly known as CSA2, the stakes have changed. The European Commission wants not only better technical certification, but also control over ICT supply chains. A new concept has taken center stage: the ‘high-risk supplier’. According to legal analyses, CSA2 would grant the Commission the authority to designate suppliers from certain third countries as high-risk and to limit or even phase out their products in critical parts of European networks and systems. This affects not only telecom, but also sectors such as energy, transport, healthcare, financial infrastructure, cloud, water, space and manufacturing.<\/p>\n

Although China is not mentioned by name in the proposed text, the source of the political tension is clear. Reuters reported in January 2026 that the proposals are widely seen as targeting Huawei and other Chinese tech companies. The Commission points to cyberattacks, foreign interference, espionage risks and European dependence on non-European technology. According to the proposal, mobile telecom operators would be given 36 months to phase out certain components from high-risk suppliers once an official list is published. The final law still has to be negotiated by the EU member states and the European Parliament, so the text may still change.<\/p>\n

The CCCEU\/KPMG Report<\/b><\/h3>\n

Against this backdrop, the China Chamber of Commerce to the EU and KPMG published a report with a stern warning. If Chinese suppliers were required to be replaced across 18 critical sectors, the report estimates it would cost Europe approximately \u20ac367.8 billion between 2026 and 2030. Of this, \u20ac146.2 billion would consist of direct costs, such as hardware replacement, dismantling, installation, and the write-down of existing assets. Other costs would stem from system reconstruction, digital transformation delays, legal proceedings, and broader societal impacts.<\/p>\n

The sectoral breakdown is telling. According to the report, logistics and manufacturing industry would bear \u20ac114.6 billion in damage. Energy would amount to \u20ac79.9 billion and telecom to \u20ac57.4 billion. These last two sectors are the very backbone of Europe\u2019s digital and green transition. Germany would be hit hardest by far, with \u20ac170.8 billion in costs, followed by France, Italy, Spain, Poland and the Netherlands.<\/p>\n

These are massive figures – too large to dismiss carelessly. At the same time, the report must be read for what it is: an advocacy report written from the perspective of Chinese companies in Europe. The calculation is based on the assumption that mandatory replacement is broad, rapid, and applied across 18 sectors. While that is possible, it is not the same as saying Europe is guaranteed to lose \u20ac367.8 billion tomorrow. It is a scenario. A pressure tactic. And likely a negotiating position.<\/p>\n

Price Tag or Investment?<\/b><\/h3>\n

This brings us to the real question. Is replacing Chinese suppliers expensive? Yes. Undoubtedly. Dismantling existing infrastructure before it is economically depreciated is almost always inefficient. Telecom networks, energy infrastructure and industrial systems are not mobile phones that are replaced every two years. They are deeply intertwined with maintenance contracts, software, personnel, certification, and operational routines.<\/p>\n

However, the CCCEU\/KPMG report pretends that every euro in replacement costs simply evaporates. That is too simple. Part of that money could also flow to European companies, European installers, European software developers, European chip designers, European maintenance teams and European factories. In that case, it is not a pure loss, but an expensive shift from dependence to capacity.<\/p>\n

The difference between loss and investment lies in the execution. If Europe bans Chinese equipment without having European or reliable alternatives ready, costs will rise, rollout will slow, and the consumer will pay. If Europe links these same measures to production capacity, standardization, fast-tracked permitting, cheap energy, skills development, and long-term procurement contracts, then a portion of the bill is converted into strategic development.<\/p>\n

Protection without production is expensive nostalgia. Protection with production is industrial policy.<\/p>\n

The Chinese Mirror<\/b><\/h3>\n

China calls the European plans discriminatory and protectionist. That is politically understandable. But it also sounds selective. For years, China has maintained a comprehensive system of cyber, data and security rules in which national security, control over critical infrastructure, and technological self-reliance weigh heavily.<\/p>\n

China’s Cybersecurity Review Measures<\/em> require, among other things, security assessments when operators of critical information infrastructure purchase networking products and services that could affect national security. This includes considering the safety and reliability of the products, the diversity of supply sources, the risk of disruptions due to political, diplomatic or trade factors, compliance with Chinese law and the risk of data or infrastructure coming under the influence of foreign governments.<\/p>\n

China also employs a layered system for data export. The rules for cross-border data flows are based on the Cybersecurity Law,<\/em> the Data Security Law<\/em> and the Personal Information Protection Law, <\/em>respectively the Network Security, Data Security<\/em> and Personal Data Protection Act.<\/em> Certain transfers of personal data or ‘important data’ require security assessments, standard contracts or certification. Critical information infrastructure and important data receive extra scrutiny.<\/p>\n

Moreover, since January 1, 2025, China has implemented new rules for network data security, with an emphasis on national security, public interests, personal information and cross-border data flows. The comparison with CSA2 is not one-to-one. Europe is primarily looking at suppliers in critical infrastructure; China looks much more broadly at data, platforms, infrastructure and national control. But the underlying logic is similar: when technology becomes strategic, security trumps free market access.<\/p>\n

More importantly, China has for years tied its industrial development to self-reliance. Made in China 2025<\/em> was about ‘indigenous innovation’ and reducing dependence on foreign technology. The Rhodium Group describes how China aimed for self-sufficiency in core components and basic materials, with a target of 70% by 2025 in certain strategic areas.<\/p>\n

That path hasn\u2019t vanished; it has been refined and expanded. According to the Rhodium Group, China’s latest industrial policy is focusing increasingly on self-reliance, import substitution, technological leadership, and control over critical value chains. Reuters reported in late 2025 that Chinese chip manufacturers are increasingly required to use at least 50% domestic equipment for new capacity, according to sources familiar with the matter. That is precisely the kind of \u2018local content\u2019 requirement Europe is now starting to cautiously consider.<\/p>\n

In other words: China has been playing this game for years. Europe is only just starting to read the rulebook.<\/p>\n

Europe\u2019s Uncomfortable Lag<\/b><\/h3>\n

Europe does not lack plans. The <\/i>Net-Zero Industry Act <\/i>aims to ensure that the EU can produce at least 40% of its annual needs for strategic clean technology itself by 2030. The European Chips Act<\/em> aims to strengthen Europe’s semiconductor position and reduce dependence on third countries, targeting a 20% share of the global chip market. The Critical Raw Materials Act<\/em> sets benchmarks for extraction, processing and recycling, including a limit of 65% dependence on any single third country for strategic materials.<\/p>\n

Europe is also becoming less na\u00efve in the field of trade. The Foreign Subsidies Regulation<\/em> gives the Commission tools to tackle distortive subsidies from outside the EU, including in acquisitions and tenders. CBAM, the Carbon Border Adjustment Mechanism<\/em>, imposes a carbon price on certain imports, so that European producers adhering to climate rules are not automatically undercut by ‘dirtier’ imports. And under the International Procurement Instrument<\/em>, the EU established targeted restrictions on Chinese medical devices in European public tenders for the first time in 2025.<\/p>\n

On top of this came the 2026 proposal for the Industrial Accelerator Act<\/i>. It aims to introduce ‘Made in EU’<\/em> and low-carbon criteria for public procurement and subsidies in strategic sectors. Reuters writes that the proposal is intended to strengthen European production and reduce dependence on cheap Chinese imports. Public procurement in the EU accounts for more than \u20ac2 trillion per year, about 14% of the European economy. That’s not a detail; it is a lever.<\/p>\n

Yet Europe remains slow. The continent is strong in regulation, but weaker in execution. It writes good rules, but builds too few factories. It formulates goals but stumbles over permitting. It wants strategic autonomy but struggles with energy prices, fragmented capital markets, conflicting national interests, and a culture where risks are often legally ‘papered over’ then commercially managed.<\/p>\n

China\u2019s advantage is not just low costs. It is coordination. It is not always efficient, certainly not. There is waste, overcapacity, and political misallocation. But when China declares a sector strategic, subsidies, local governments, banks, state-owned enterprises, private champions, educational institutions, and procurement policies often follow the same direction. Europe does much, but it is too scattered.<\/p>\n

Eastern Europe as an Industrial Engine<\/b><\/h3>\n

If Europe wants to produce more itself, it shouldn’t try to build everything in Germany, France, or the Netherlands. That would be too expensive and too slow. Central and Eastern Europe must play a much larger role.<\/p>\n

Poland, Romania, Hungary, the Czech Republic, Slovakia, Bulgaria and the Baltic States have industrial experience, integration to Western European value chains, relatively lower labor costs, and often a stronger political interest in new manufacturing. Eurostat showed that average hourly labour costs varied widely across the EU in 2024, with the lowest levels in Bulgaria, Romania and Hungary, and much higher levels in countries such as Luxembourg, Denmark and Belgium.<\/p>\n

However, Eastern Europe must not become the ‘cheap workbench ‘for Western Europe. That would be a mistake from the old globalization handbook. The opportunity lies in modern production: batteries, power grid components, industrial electronics, medical devices, defense technology, heat pumps, robotics, cybersecurity hardware, and the assembly of critical digital infrastructure. Not just labor, but automation, training, engineering, and energy must be central.<\/p>\n

Europe has a strategic advantage here. The internal market enables scale. Geographic proximity shortens supply chains. The expansion of defense and energy investments creates demand. And the political will in many Eastern European countries is greater than in Western Europe, where industrial policy still too often sounds like a throwback to the 1970s.<\/p>\n

Market Access Must Be Reciprocal<\/b><\/h3>\n

The European message to Chinese companies should not be \u201cleave\u201d. That is foolish and unnecessary. The message should be: “Whoever wants to sell significantly in Europe must also contribute significantly to Europe.”<\/p>\n

That means local production, European jobs, local tax payments, European R&D, transparency regarding subsidies, independent cybersecurity audits, data shielding, local maintenance, and emergency capacity within Europe. Not just a sales office in D\u00fcsseldorf and a marketing team in Paris, but a real presence in the value chain.<\/p>\n

For strategic sectors, Europe could work with graduated local contribution requirements. For example: a minimum share of European value-added for public tenders, a higher share for critical infrastructure and additional conditions when companies benefit from European subsidies. This doesn’t have to be ‘anti-China’. It would apply to everyone. The US does this. China does this. India, Brazil and other major markets have their own variations. Europe does not need to apologize for protecting its industrial base, as long as the rules remain transparent, proportionate and defensible.<\/p>\n

It is important, however, that Europe does not lapse into primitive protectionism. A simple ban without an alternative only makes Europe more expensive. A \u2018local content’ requirement without European suppliers makes tendering impossible. And mandatory technology transfer, as China has indirectly enforced in the past, would leave Europe legally and morally vulnerable. A better approach is: linking market access to local production, joint R&D, European certification, open standards, and mutual access to tenders.<\/p>\n

Cybersecurity as a Negotiating Table<\/b><\/h3>\n

CSA2 should therefore not be read merely as a technical dossier. It is a negotiating table. Europe says: “We want to be less dependent on suppliers that may be under the influence of geopolitical rivals.” China says: “This is discrimination and protectionism.” Both are partially right.<\/p>\n

Europe has legitimate security concerns. In vital infrastructure, technical security is not enough. A product may seem secure today and prove strategically vulnerable tomorrow due to ownership, maintenance, updates, remote access, data dependency, or political pressure from the country of origin. Cybersecurity is not just code; it is also governance.<\/p>\n

But China also has a point when it warns against arbitrary \u2018rules of origin\u2019. If Europe makes the country of origin more important than technical evidence, independent audits, and concrete risk mitigation, the legal basis becomes weaker. Therefore, Europe should not simply say: “Chinese is wrong.” Europe should say: “Every supplier in critical infrastructure must be demonstrably secure, auditable, replaceable, and locally anchored.” Those who cannot or will not meet this standard lose access. That is a stronger argument. And a fairer one.<\/p>\n

From Cost to Capacity<\/b><\/h3>\n

The biggest mistake would be to reduce this debate to the question of whether Chinese suppliers are cheap or expensive. Of course, they are often competitive. Of course, they have contributed to the rapid rollout of digital infrastructure. Of course, replacement will be costly. But ‘cheap’ is not the same as ‘strategically wise’.<\/p>\n

Over the past few decades, Europe has too often confused cost-cutting with competitiveness. Production was moved, supply chains grew longer, dependencies became invisible, and industrial knowledge slowly disappeared from regions where it was once taken for granted. Only during the pandemic, the energy crisis, the Russian invasion of Ukraine, and the chip shortages did it become clear how thin that efficiency really was.<\/p>\n

Self-reliance does not mean Europe must make everything itself. That is unrealistic and undesirable. Europe must strive for strategic sufficiency: enough domestic or reliable capacity to avoid being blackmailed, shut down, or hollowed out. The continent does not need to produce every screw itself. But it must have a grip on power grids, telecom, cloud, chips, defense, medical systems, payment infrastructure, critical raw materials, and industrial software.<\/p>\n

This also requires a new attitude toward Chinese investments. Chinese companies that want to produce in Europe, hire European people, follow European rules, and create real local value can be part of the solution. Chinese companies that only want to serve European market shares with subsidized imports, minimal local presence, and limited transparency reinforce exactly the problem that CSA2 seeks to address.<\/p>\n

Conclusion<\/b><\/h3>\n

The new <\/i>European Cybersecurity Act<\/em> is more than a cyber law. It is a symptom of a larger shift. Europe is beginning to understand that open markets only work when dependencies remain manageable. The era when technology, trade and security were neatly separated domains is over.<\/p>\n

The CCCEU\/KPMG report rightly points to the costs. A forced, broad replacement of Chinese suppliers would be expensive, especially for Germany, telecom, energy and industry. But the report draws too narrow a conclusion. Not every euro that no longer goes to Chinese suppliers is a loss. Some euros can become European capacity, provided politics finally makes the connection between security and production.<\/p>\n

Europe should therefore not choose between na\u00efve openness and blunt protectionism. It must choose mature reciprocity. Access to the European market remains possible, but not free and not without strategic conditions. Whoever profits here must also build here. Whoever supplies vital infrastructure must be accountable. Whoever brings subsidy advantages from their home country must be able to explain them. Whoever wants to serve European governments must strengthen European robustness.<\/p>\n

China did not build its own self-reliance by only giving nice speeches about free trade. It used rules, purchasing power, subsidies, local production, data legislation, and long-term goals. Europe does not need to copy that model in an authoritarian way. But it must stop pretending that industry will simply return as soon as a policy paper is written about it.<\/p>\n

The real test for CSA2, therefore, is not whether Europe can ban Chinese suppliers. The real test is whether Europe can build something better afterward.<\/p>\n

About the Author<\/p>\n

Yereth Jansen is an entrepreneur and strategic advisor based in Shanghai. As the co-founder of China Insights Weekly, he provides weekly analyses of the latest trends in China\u2019s tech and business landscape. In addition, he serves as CEO of Darling Advertising + Design in Shanghai, advising international companies on branding, digital transformation, and market strategy in China. With over 15 years of experience in cross-cultural business development and a strong focus on AI and platform economies, he helps companies worldwide learn from China\u2019s technological innovations. <\/i><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

Reporting from Shanghai, Yereth Jansen analyzes the debate surrounding the revision of the European Cybersecurity Act. A report by the China Chamber of Commerce to the EU (CCCEU) and KPMG […]<\/p>\n","protected":false},"author":1330,"featured_media":47209,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[333,335,409],"tags":[],"class_list":["post-47214","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-chinanu","category-economics-and-business","category-in-the-carousel"],"_links":{"self":[{"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/posts\/47214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/users\/1330"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/comments?post=47214"}],"version-history":[{"count":18,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/posts\/47214\/revisions"}],"predecessor-version":[{"id":47652,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/posts\/47214\/revisions\/47652"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/media\/47209"}],"wp:attachment":[{"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/media?parent=47214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/categories?post=47214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vnc-china.nl\/en\/wp-json\/wp\/v2\/tags?post=47214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}