European Commission proposals unveiled this week, aimed to bolster cybersecurity across the bloc in the face of a growing tide of digital threats, have drawn ire from China.

A draft proposal released on Tuesday, revising the EU’s Cybersecurity Act and its Network Information Systems Directive, would see member states phase out the use of high-risk suppliers within their critical national infrastructure.

The move reflects concerns about hostile actors exploiting supply chain vulnerabilities in the context of geopolitical tensions, state-sponsored hacking campaigns and the robust health of the cybercrime ecosystem.

Ransomware incidents, cyber espionage and attacks attempting to disrupt essential services are driving the measures, which plan to reduce risks across the IT supply chain by establishing a framework for certifying trusted companies.

“In today's geopolitical landscape, supply chain security is no longer just about technical product or service security, but also about risks related to a supplier, particularly dependencies and foreign interference,” the Commission announced.

Under the proposed revisions, IT suppliers would face what are intended to be clearer testing and certification requirements before their products can be sold in the EU. 

It explicitly gives telecommunication network operators up to three years to completely phase out components from suppliers deemed to pose a significant cybersecurity risk.

Although the move does not specifically mention either the United States or China, both of which have loomed as geopolitical risks for the continent in recent years, the Chinese foreign ministry responded to caution against the move.

"Chinese companies have long operated in Europe in compliance with laws and regulations and have never endangered Europe's national security," said Guo Jiakun, a foreign ministry spokesperson, warning the EU it risked “going further down the wrong path of protectionism.”

The potential threat posed by Chinese network equipment suppliers such as Huawei and ZTE had previously resulted in several national decisions to restrict those vendors from contributing to various parts of telecommunications infrastructure.

However those measures followed voluntary EU guidance, and some member states such as Spain have provoked concern from allies over their relationship with Chinese companies. Last year, the Spanish government cancelled a €10 million contract with Huawei after U.S. lawmakers said it threatened intelligence sharing with the country. 

A spokesperson for Huawei said the proposal “to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU's basic legal principles of fairness, non-discrimination, and proportionality, as well as its WTO obligations.”

The use of U.S. technology and service providers has also prompted concern across the European Union following President Trump’s unpredictable decisions to sanction various political figures — resulting in prohibitions against them using technology provided by companies such as Microsoft — and aggressive comments towards Greenland.

The company’s president, Brad Smith, has pledged to take legal action to resist any legal orders by the U.S. government demanding Microsoft suspend or cease its cloud operations in Europe. The threat of such an order has been stressed by competitors as part of ongoing antitrust probes in the bloc.

U.S. officials have not yet formally reacted to the EU announcement. Despite generally sharing broad concerns about Chinese supplies, the U.S. has in recent months characterized similar digital laws as disadvantageous to American tech companies. The White House has recently threatened to impose tariffs on several European countries over their response to President Trump’s statements on Greenland.