Spain reportedly proposed protecting some existing public contracts with suppliers later designated high-risk, including Huawei, from future EU restrictions. EL ESPAÑOL-Invertia reported on November 2, 2026, that the proposed wording appeared in a Council of the European Union draft; it is a proposal, not an enacted rule.

What Spain’s reported proposal would protect

According to EL ESPAÑOL-Invertia, Spain’s proposed wording would leave contracts and agreements made before a specified date outside the restrictions. It would apply the restrictions to procurement procedures begun after that date. The report does not give the date Spain submitted its wording.

That distinction could matter for public agencies with existing supplier agreements: under the reported proposal, an earlier contract would be treated differently from a procurement started after the cutoff.

Extensions and framework orders would count as new contracts

The outlet also reported that Spain’s wording would treat later contract extensions and orders placed under framework agreements as new contracts. So the proposed protection for an existing agreement would not automatically cover those later transactions.

Spanish contracts and systems in the report

EL ESPAÑOL-Invertia cited several examples. It reported a €12.3 million renewal in summer 2025 for Huawei OceanStor servers supporting storage for SITEL, a system used for judicially authorized interception data. It also reported a two-year Adif spare-parts contract with a maximum budget of €484,000, including tax, awarded on December 24, 2025.

In June 2026, the General Information Technology Management of Social Security (GISS) tendered a €160.9 million service for database support, operation and maintenance. The outlet described this as a tender, not a completed award to Huawei. It also reported that the Spanish Tax Agency acquired two Huawei OceanStor Dorado 8000 systems in 2021.

What the Commission’s three-year proposal covers

The European Commission published its revised Cybersecurity Act proposal on January 20, 2026. Its separate three-year phase-out proposal applies specifically to mobile operators removing high-risk suppliers from 5G networks. That period is not a general deadline for every type of infrastructure or public contract.

EL ESPAÑOL-Invertia reported that the Council, European Parliament and Commission positions were to move toward a unified text during 2027.