The European Commission's January 2026 proposal to revise the Cybersecurity Act into binding law remains the central catalyst, shifting from the voluntary 5G security toolbox to mandatory phase-outs of high-risk suppliers like Huawei and ZTE from critical infrastructure such as mobile networks within 36 months of designation. Legislative momentum has slowed amid Council pushback on timelines, member-state concerns over EU authority, and industry warnings of €30-40 billion in replacement costs plus supply disruptions for radio access networks. Germany is already enforcing 5G core removals by end-2026 under operator contracts while weighing broader RAN restrictions, yet Deutsche Telekom continues resisting full exclusion. Parliament's industry committee vote expected around February 2027 and ongoing trilogue talks on flexible criteria like alternatives availability will determine whether a final text emerges soon.