The European Union’s push to bar Chinese suppliers from its critical infrastructure under a proposed new Cybersecurity Act would cost the bloc a jaw-dropping €367.8 billion (US$431.4 billion) over the next five years, a new study has warned.
The law’s vast price tag comes from the need to rip out and replace huge amounts of Chinese hardware – a task that alone could cost €146.2 billion – with other losses stemming from resource reallocation, service disruptions, employment adjustments and legal fees, according to the report by the China Chamber of Commerce to the EU (CCCEU) and KPMG.
The revised Cybersecurity Act – proposed by the European Commission in January – would restrict the use of Chinese equipment across 18 sectors of the economy, ranging from energy, transport and healthcare to banking, digital networks and the space industry.
“Given the highly interconnected nature of Europe’s digital value chains … the resulting cost pressures would be borne across the economy, with small and medium-sized enterprises and end users likely to experience higher sensitivity,” said Liu Jiandong, chairman of the CCCEU, in the report released on Wednesday.
Annual losses from the policy are projected to reach €39.1 billion in 2026 and peak at €93 billion in 2028, before plateauing at €91 billion for 2029 and €89.6 billion for 2030, according to the study.
Beyond direct hardware costs, the report predicts €102.1 billion in social losses, with €88.3 billion of that driven by delayed digitalisation and green transition costs. The social losses also include €3.3 billion in unemployment assistance – a figure the report said carried significant policy weight despite its smaller size relative to other categories.
All 18 sectors covered by the NIS2 Directive – an earlier EU cybersecurity policy that paved the way for the new law – stand to incur major losses under the proposed measures, according to the report. Logistics and manufacturing would be hit hardest at €114.6 billion, followed by energy at €79.9 billion and telecommunications at €57.4 billion.
The move could even put “systematic pressure on the overall operating efficiency of EU industry”, the study warned. It pointed to security screening equipment as an example, where forced replacement could create border-control risks.
The warning comes as Nuctech – a Chinese manufacturer of security scanners – is locked in a legal battle with the European Commission over a Foreign Subsidies Regulation investigation into the firm.
The projected losses in the CCCEU-KPMG report contrast sharply with the European Commission’s official forecasts, which are far more limited in scope.
Brussels has only estimated the cost of replacing equipment from high-risk suppliers in the 5G mobile network: an effort that would cost roughly €10 billion to €13 billion over three years, according to an official assessment published in January. EU authorities have yet to publish similar estimates for the other sectors covered by the proposed law.
The CCCEU-KPMG report criticised Brussels’ assessment for failing to cover all member states, all impacted sectors or full-chain systemic losses, while also overlooking the long-term chain reactions that could be triggered by the policy.
According to the study, the costs would fall unevenly across the bloc. Germany alone would bear nearly half the burden – 46.4 per cent of total losses, or €170.8 billion – due to its deep manufacturing base and advanced industrial digitalisation. Meanwhile, 16 EU member states would each absorb less than 1 per cent of the costs.
The sectoral breakdown also varies widely by country, the report showed. Germany’s losses would be concentrated in logistics and manufacturing, while France would face a heavier hit to public services and healthcare – implying greater fiscal pressure on the state. Spain’s rapid renewable energy buildout leaves its energy sector highly exposed.
The costs would eventually lead to inflationary pressure and greater fiscal burdens for European consumers, and weaken Europe’s global competitiveness, the report said.
Brussels has itself acknowledged the risks of moving too fast. In its assessment, the European Commission said it would not impose restrictions across all 18 sectors at once, as there was currently insufficient data to gauge the impact the measures would have on several industries.
An immediate roll-out “could lead to disproportionate restrictions with unknown impact on the relevant market”, it warned. Instead, the body laid out a sector-by-sector implementation plan, which requires dedicated risk and economic assessments to be delivered for each sector before any restrictions are triggered.
The CCCEU and KPMG’s €367.8 billion figure represents what they say would happen if the EU pulls the trigger across all 18 sectors – a scenario that is still on the horizon, but one that China’s business community in Europe is already mobilising against.