The European Commission wants to force EU member states to remove Chinese companies Huawei Technologies and ZTE from its mobile networks, as part of a sweeping new cybersecurity act unveiled on Tuesday.
The new proposal would force capitals to comply within three years of adoption, although the legislation itself would first have to be approved by the countries themselves.
If a country is listed as a threat, its companies would then be considered off-bounds in sensitive sectors including connected vehicles, electricity and water supply and storage, cloud computing, medical devices, space services and semiconductors, the proposal shows.
Criteria for listing include whether the country has been linked to cyberattacks, hacking or organised cyber campaigns; whether EU institutions or EU-wide security assessments have raised concerns about risks linked to that country; and whether its laws force companies to secretly report software or hardware weaknesses to the state before those weaknesses are made public or fixed, especially if they may be exploited.
Countries where there is no independent judiciary to challenge government actions or effective democratic oversight could also be punished, the draft legislation says. A country need only meet one of the criteria to be considered.