The Communications Act 2003 High Risk Vendors
On 28 January 2020, in light of detailed technical and security analysis provided by the National Cyber Security Centre (NCSC), part of GCHQ, the Government announced that new restrictions should be placed on the use of ‘high risk’ vendors in the UK’s 5G and full fibre networks. It announced that such vendors should be:
excluded from security critical network functions;
excluded from sensitive geographic locations; and
restricted to a minority presence in other network functions to a cap of up to 35%, subject to an NCSC-approved risk mitigation strategy.
	The Government stated in January 2020 that the NCSC would continue to review and update its advice as necessary. On 15 May 2020, the US Department of Commerce announced that new sanctions had been imposed against Huawei through changes to the foreign direct product rules. The new US measures restrict Huawei’s ability to produce essential components using US technology or software. The NCSC reviewed the consequences of the US actions, and reported to Ministers that they had significantly changed their security assessment of Huawei’s presence in the UK 5G network. The NCSC concluded that given the uncertainty the US sanctions created around Huawei’s supply chain, the UK could no longer be confident it would be able to guarantee the security of future Huawei 5G equipment affected by the change in the US foreign direct product rules. To manage this risk, the NCSC issued new advice to the Government on the use of Huawei in the UK telecoms network.
	The Government agreed with the NCSC’s advice, that to secure the UK’s public telecoms, providers should not use Huawei equipment affected by the US sanctions to build the UK’s future networks. Consequently, on 14 July it announced that public telecoms providers should:
stop purchasing affected 5G equipment from Huawei after 31 December 2020; and
remove all Huawei equipment from 5G networks by the end of 2027.
	The Government advised full fibre telecoms providers to transition away from purchasing Huawei full fibre equipment affected by the US sanctions. A technical consultation would determine the precise timetable from which point full fibre telecoms providers should stop procuring affected equipment.
	The NCSC currently provides advice to public telecoms providers on the risks presented by high risk vendors and on the measures that the NCSC recommends they adopt as a result. The Act provides the Government with powers to impose binding controls on public communications providers’ use of high risk vendors.