Spain has staked out a cautious position on the European Union’s revised Cybersecurity Act, backing the legislation in principle but insisting that individual member states retain the authority to decide which suppliers and technologies can be excluded from national infrastructure projects.
Spain’s Ministry of Digital Transformation said it supports strengthening the Cybersecurity Act but wants it done within a legally sound framework consistent with the division of powers in European Union treaties. Any classification of suppliers should be based on objective, proportionate and workable technical criteria, ensuring legal certainty and respect for national sovereignty, the ministry added.
The position places Spain at odds with the broader ambitions of the European Commission, which proposed sweeping revisions to the Cybersecurity Act in January 2026. Under the proposed changes, Brussels would gain the authority to impose the exclusion of suppliers, including Huawei and ZTE, from critical infrastructure across the bloc, making previously voluntary guidelines binding on all 27 member states.
Earlier in May, the Commission recommended that member states exclude Huawei and ZTE technology from local telecom operators’ connectivity infrastructure. The proposal covers 18 critical sectors, with mobile operators given 36 months to phase out key components once a high-risk supplier list is formally published.
Spain’s position carries added complexity given its own recent decisions on Chinese technology. Last year, Spain cancelled a fibre-optic service contract with Telefonica over the use of Huawei equipment, but the country has separately awarded contracts to Chinese technology firms for sensitive security infrastructure, drawing criticism from EU officials and intelligence partners.
The Commission’s proposed clampdown was partly motivated by Spain’s decision to award fibre-optic telecommunications services to Huawei, which EU Vice-President Henna Virkkunen warned could create dependence on a high-risk supplier in a critical and sensitive sector, increasing the risk of foreign interference.
The revised Cybersecurity Act is currently under negotiation between the European Parliament and member states.
