Scope: This assessment examines NearLink’s technological architecture, industrial development and geopolitical implications for the European Union, Italy, France, Germany and the United Kingdom, using the public record available on 20 October 2026 and an analytical horizon extending to 2031.

Executive Summary

NearLink presents a credible emerging dependency risk, but the evidence reviewed does not establish that Europe is already dependent on it. The immediate concern is whether embedded connectivity can become difficult to inspect, maintain or replace as manufacturers integrate it into wider product ecosystems.

The strategic mechanism differs from dependence on telecommunications infrastructure: control may accumulate through semiconductor designs, firmware, development tools, certification, credentials and maintenance relationships distributed across numerous products.

The technology has a substantive technical and commercial basis. However, advertised radio performance, shipment figures and membership totals require careful interpretation; none independently measures European adoption or critical-system exposure.

Europe’s strongest response is to preserve operational choice before procurement and integration decisions make substitution expensive. Product security, supplier accountability and demonstrable replaceability should determine treatment.

Existing legislation and proposed legislation perform different functions. The Cyber Resilience Act’s reporting obligations already apply, while its main requirements apply from December 2027; the 2026 Digital Networks Act and revised Cybersecurity Act initiatives must be assessed as proposals unless subsequent enactment is established.

NearLink: Europe’s Next Digital Dependency Risk

Europe’s NearLink Risk Is the Cost of Leaving

Europe’s next digital dependency will be determined by procurement contracts signed before its new cybersecurity rules fully apply. NearLink, the Chinese short-range wireless technology, presents a credible industrial risk, but the dossier does not establish systemic European dependence. The governing issue is whether buyers retain the capacity to maintain, recover and replace the functions they purchase. The Cyber Resilience Act will impose most of its obligations from 11 December 2027; equipment bought before then can already embed supplier-controlled firmware, development tools and maintenance arrangements. Europe should therefore make demonstrable substitutability a condition of adoption. Otherwise, useful competition at the point of purchase can become dependence during operation, leaving manufacturers, infrastructure operators and public authorities to finance an exit they never priced.

Europe measures supplier compliance more readily than its ability to leave

The strongest available figures describe weaknesses in European supply-chain management, not NearLink penetration. ENISA’s NIS Investments 2025 report surveyed 1,080 organisations across 27 EU member states; 83% were large organisations and 17% were small and medium-sized enterprises. Its findings cannot establish the exposure of Europe’s entire business population, still less the installed base of a particular wireless technology. They do, however, identify the organisational conditions in which an embedded dependency could escape scrutiny.

In that survey, 90% of organisations reported supply-chain security controls, while 63% required suppliers to meet standards or hold certifications. Yet 30% had conducted no supplier security assessment during the preceding year, and 28% took more than three months to patch critical vulnerabilities. These measures are not interchangeable: certification describes an assurance process; assessment examines a supplier relationship; patching reveals whether an organisation can act when a weakness becomes operationally relevant.

The implication of ENISA’s findings is that adding another certification requirement will not, by itself, establish control over an embedded communications component. A buyer may possess a compliant procurement file while remaining unable to validate firmware, replace a module or restore a system without the original supplier. For NearLink, the useful denominator is therefore the number of important functions dependent on such arrangements, rather than the number of products carrying a compatible radio.

A cheap component can create an expensive system obligation

The procurement mechanism is already visible in the documented NearLink development ecosystem: chips and modules enter finished products through software libraries, integration tools and firmware. The purchasing organisation may contract with a European equipment supplier while remaining several commercial tiers removed from the party that controls the communications stack. The invoice identifies the seller; it does not necessarily identify who can repair, modify or reproduce the function.

The Cyber Resilience Act’s software bill of materials requirement will improve visibility into software dependencies, but it does not supply a complete account of hardware provenance, firmware-signing authority or maintenance control. That distinction matters when substitution requires changes to the host application, new integration work and fresh validation. A component that appears inexpensive at purchase can carry a much larger obligation once it becomes part of an operational system.

NearLink procurement should therefore distinguish a second source from a second route to the same dependency. Two module vendors may use the same underlying software, development tools or upstream support arrangements. Diversification becomes operationally meaningful when an alternative supplier can maintain or replace the required function without reproducing the original point of failure. Counting corporate names is a poor substitute for testing that proposition.

The EU’s ICT supply-chain security toolbox, adopted on 13 February 2026, gives public authorities a framework for examining these relationships. Its approach is horizontal and actor-agnostic; it does not establish that NearLink is compromised. Its practical value would come from translating supply-chain analysis into tender conditions: documented dependencies, accessible maintenance arrangements and an exit procedure demonstrated before deployment.

The law can improve products without financing their replacement

The Cyber Resilience Act creates a timetable that procurement departments must distinguish from their equipment replacement cycles. Reporting obligations began on 11 September 2026, while most substantive requirements apply from 11 December 2027. For products placed on the market before that latter date, the principal obligations generally depend on a subsequent substantial modification, although reporting requirements also reach earlier products. The transition therefore leaves buyers with decisions that legislation will not make retrospectively on their behalf.

Nor does the Cyber Resilience Act create an automatic security category for every NearLink-capable device. Conformity assessment depends on the product and its legal classification, while an inventory of software components does not answer whether the operator controls updates or can qualify a replacement. Treating the Act as a comprehensive solution would confuse product obligations with the buyer’s responsibility for operational continuity.

NIS2 addresses another part of the problem: the security management of covered entities and their supply chains. Italy’s Legislative Decree 138/2024, in force from 16 October 2024, places responsibilities on management and includes supply-chain security and secure acquisition within its framework. Those duties can force the dependency question into board-level decisions. They cannot manufacture a technically qualified alternative where procurement has allowed only one to remain.

The funding constraint is equally concrete. The SECURE programme’s second open call, running from 1 October to 11 December 2026, has an estimated budget of €11.5 million and offers grants of up to €30,000 at a 50% co-financing rate. That can support defined cybersecurity work by eligible smaller businesses. It is not a standing facility for replacing industrial systems after a dependency has become entrenched. Prevention has a programme; a large-scale exit would still require a financing decision.

Four national systems face different versions of the same problem

Italy’s Legislative Decree 138/2024 makes management accountability a useful transmission mechanism, but uneven organisational capacity will affect implementation. A large manufacturer able to audit suppliers and validate alternatives faces a different burden from a smaller integrator purchasing a finished module. Applying identical documentation demands without accessible testing support could favour incumbents with established compliance resources, even where the policy objective is to broaden the supplier base.

France’s ReCyF framework, issued on 17 March 2026 as preparatory guidance, illustrates the distinction between institutional preparation and a completed legal settlement. The dossier does not establish full French transposition of NIS2. Buyers should therefore separate current obligations from expectations under development, while using that preparation period to identify which connected functions would be difficult to maintain independently.

Germany’s NIS2 implementation entered into force on 6 December 2025, but its telecom arrangements also show why deadlines must be read precisely. The agreements described in the federal government’s November 2025 parliamentary answer distinguish replacement of relevant core-network components by the end of 2026 from measures affecting critical management functions in transport and access networks by the end of 2029. These are defined interventions in identified network functions, not a general prohibition covering every Chinese communications component.

The United Kingdom’s 2022 Huawei Designated Vendor Direction likewise targets specified telecommunications equipment and activities, including a deadline of 31 December 2027 for removal from the addressed 5G networks. Its consumer connectable product security regime has applied since 29 April 2024. Neither instrument, by its existence alone, resolves the maintenance and substitution questions surrounding NearLink-enabled industrial products. Extending the political language of telecom restrictions without examining the relevant product and legal scope would create certainty in public debate and uncertainty in procurement.

China’s standards timetable is firmer than Europe’s dependency evidence

China has made a documented institutional commitment to NearLink. The GB/T 48336 standards family was published on 28 September 2026, with implementation scheduled for 1 April 2027. Its coverage extends from architecture and identifiers to device functions, quality of service, media, positioning and IP carriage. These are recommended national standards, not evidence of a universal mandatory adoption requirement. Their importance lies in giving suppliers and developers a common technical reference across several product categories.

The GB/T 48336 family can reduce coordination costs within China’s industrial ecosystem and strengthen the proposition offered to overseas manufacturers. That mechanism does not require every European buyer to select a Chinese finished product: technology can travel inside modules, development environments and integrated equipment. The external competition is therefore partly about which ecosystem offers the most convenient route from design to commercial deployment.

Europe’s response through the ICT supply-chain security toolbox should preserve that distinction between industrial competitiveness and security evidence. Participation in international forums does not itself establish adoption as a global standard; a national standard does not prove foreign market penetration; penetration does not automatically establish an unmanageable dependency. Collapsing those stages into a single geopolitical claim would make restrictions easier to announce and harder to justify.

The proposed revisions to the Cybersecurity Act and the proposed Digital Networks Act belong in that same disciplined framework. The dossier identifies them as proposals, not as enacted authority for a universal NearLink ban. Their eventual treatment matters because fragmented national interpretations could require manufacturers to maintain different product configurations and compliance processes. Europe could then increase the cost of market access without ensuring that any operator has a workable replacement.

The next two years will decide whether exit remains affordable

Between October 2026 and October 2028, three documented timetables will overlap: implementation of China’s new NearLink standards, the main application date of the Cyber Resilience Act and the United Kingdom’s specified 5G removal deadline. None predicts NearLink’s European market share. Together, however, they create a period in which suppliers will develop products, buyers will revise compliance procedures and governments will confront the difference between setting a deadline and executing a technically qualified transition.

The immediate European choice is whether the ICT supply-chain security toolbox becomes an operating discipline. Procurement authorities can require evidence that important functions remain recoverable, that maintenance responsibilities are explicit and that an alternative can be qualified. Shared testing capacity would make those requirements more accessible to smaller buyers. Without it, demanding more assurance may simply transfer documentation costs down the supply chain while leaving the underlying dependence untouched.

The Cyber Resilience Act will raise the obligations attached to connected products from 11 December 2027, but the cost of an unplanned exit will fall on the owners and users of deployed systems. Manufacturers would fund redesign and validation; operators would absorb disruption and replacement costs; public bodies would have to find budgetary room for contracts already awarded. Europe’s position in 2031 will depend less on whether NearLink was admitted than on whether purchases made during this transition preserved a credible alternative.

---

Navigational Index

Pillar	Chapter	Analytical focus
I — Technology, Standards and Industrial Power	1. Inside NearLink	Radio architecture, protocol layers, implementation limits, performance verification and security boundaries
	2. Building an Ecosystem	Semiconductor suppliers, software tools, certification, intellectual property and commercial incentives
	3. China’s Standards Strategy	Domestic industrial coordination, international participation and the relationship between self-reliance and export expansion
II — European Exposure and Regulatory Capacity	4. How Dependency Forms	Procurement pathways, embedded components, maintenance control and substitution costs
	5. Europe’s Legal Instruments	Product cybersecurity, critical-entity obligations, sectoral rules and proposed supply-chain powers
	6. Four National Exposure Profiles	Italy, France, Germany and the United Kingdom assessed separately
III — Strategic Choices and the 2031 Outlook	7. Alternative Development Pathways	Competitive coexistence, concentrated dependence and regulatory fragmentation
	8. Preserving European Options	Procurement conditions, testing capacity, supplier diversification and standards participation
	9. Indicators and Net Assessment	Observable thresholds, evidence gaps and decisions that would alter the outlook

---

Master Abstract

The strategic asset is control over the connection’s lifecycle

NearLink should be assessed as an industrial ecosystem whose radio interface is only one component. HiSilicon’s development documentation distinguishes SparkLink Low Energy, or SLE, from SparkLink Basic, or SLB: the former addresses low-power, low-latency applications, while the latter targets higher-throughput uses. That distinction matters because a claim about one access mode cannot automatically describe every NearLink implementation or product. WS53 开发者中心

For European decision-makers, the central question is therefore broader than whether NearLink can outperform an existing connection in a particular application. It is whether an adopting company retains sufficient control over maintenance, authentication, integration and replacement throughout the equipment’s useful life. An efficient connection can still create strategic vulnerability if the buyer cannot independently obtain security fixes, migrate credentials or qualify an alternative component.

This assessment identifies operational substitutability as the decisive variable. A connection becomes strategically consequential when its failure, withdrawal or restriction would interrupt an important function and when an alternative cannot be introduced within the operator’s tolerable recovery period. That is an analytical test, not a finding that every NearLink product meets those conditions.

HiSilicon publicly presents both NearLink/Bluetooth and Wi-Fi/NearLink multimode semiconductor offerings. Their existence supports an important distinction: adoption can occur through a combined component rather than through a conspicuous decision to replace an entire connectivity system. It also means coexistence is technically and commercially relevant. Coexistence, however, does not by itself establish that an application can migrate between protocols without losing essential functions. HiSilicon Official Site

Technical capability requires implementation-level evidence

The available documentation provides firmer foundations than generic comparisons with Bluetooth or Wi-Fi. HiSilicon’s WS63 SLE interface documentation specifies support for 1, 2 and 4 MHz bandwidths, with a maximum 12 Mbps air-interface rate. These are implementation specifications; they do not establish application throughput, battery consumption or response-time guarantees under every operating condition. WS63 开发者中心

The distinction becomes particularly clear in the Hi3863V100 listing. The manufacturer describes a combined Wi-Fi 6/NearLink device with a maximum 114.7 Mbps Wi-Fi physical-layer rate and a separate maximum 12 Mbps SLE air-interface rate. The listing also labels the product as not yet commercially launched, with its release strategy undecided. Neither the higher Wi-Fi figure nor the product’s advertised capabilities should therefore be converted into evidence of deployed NearLink performance. 海思官网

For industrial and security-sensitive procurement, the appropriate comparison is between complete implementations performing the same task. Relevant measurements include application latency at specified percentiles, packet loss during interference, recovery after connection failure, energy consumed per completed transaction and the behaviour of authentication and update mechanisms. These are proposed evaluation criteria. A headline maximum data rate cannot answer them.

The same discipline applies to security. A local wireless protocol does not automatically imply remote access, foreign data transfer or malicious control. Those outcomes require an identifiable mechanism involving the implementation, its privileges, a connected gateway, management services or exploitable weaknesses. Conversely, a short radio range does not make a component strategically irrelevant if it carries commands or credentials that govern an important physical process.

China’s ecosystem strategy has substance, but scale remains difficult to compare

The alliance’s institutional record describes its establishment on 22 September 2020, registration in Shenzhen as an international alliance on 1 June 2023, and a structure encompassing standards, testing, certification and industry promotion. This is evidence of organised ecosystem development extending beyond a single finished product. cdn.sparklink.org.cn

International engagement is also documented. An ITU-hosted workshop transcript records a SparkLink Alliance presentation in October 2025 addressing short-range connectivity and embodied AI. Participation in that forum demonstrates engagement with an international technical audience; it does not establish adoption of NearLink as an ITU Recommendation. Any claim of formal international standardisation requires the relevant document identifier, approved text and status. itu.int

The geopolitical significance lies in the potential alignment of domestic demand, component development, software support and certification. Such coordination can reduce adoption costs for manufacturers and encourage complementary investment. If successful, it could make a Chinese-centred ecosystem commercially attractive abroad without requiring foreign buyers to endorse a geopolitical project.

That mechanism also supplies a counterargument to a purely security-driven interpretation. Manufacturers may adopt NearLink because a specific implementation meets performance or cost requirements. Commercial utility and strategic concentration can develop simultaneously. Policy should distinguish the benefits of the connection from the consequences of relying on a narrow set of organisations to sustain it.

Europe’s regulatory challenge is the relationship between product compliance and systemic dependence

The Cyber Resilience Act, Regulation (EU) 2024/2847, covers products with digital elements, including components marketed separately, subject to its scope and exclusions. It entered into force on 10 December 2024; its principal requirements apply from 11 December 2027. The Commission also explains that earlier products are generally brought under those requirements following substantial modification, while reporting obligations have a broader transitional reach. Shaping Europe’s digital future

Manufacturers’ reporting obligations began on 11 September 2026. The Commission specifies an early warning within 24 hours of awareness and a fuller notification within 72 hours for reportable actively exploited vulnerabilities and severe incidents. These obligations create an operational channel for emerging security evidence; they do not constitute a general finding about the geopolitical acceptability of a supplier. Shaping Europe’s digital future

The Commission’s January 2026 cybersecurity package proposed a broader supply-chain framework addressing supplier-related dependencies and foreign interference across critical sectors. Its stated approach includes proportionality, economic effects and market availability. The strategic value of that approach is its attention to risks that can persist even when an individual product passes technical tests. Its practical effect depends on the final legislation and subsequent decisions. ec.europa.eu

The Digital Networks Act proposal, adopted by the Commission on 21 January 2026, addresses the connectivity framework, including network resilience and preparedness. It should not be treated as an already operative, universal disclosure regime for embedded short-range components. Nor should software inventory alone be assumed to reveal semiconductor provenance, control of signing keys or dependence on a particular development toolchain. Those questions require additional evidence. Shaping Europe’s digital future

Key Evidence Table

The indicators below establish technical and institutional development. They do not provide a European installed-base estimate.

Indicator	Value/status	Reference date	Definition and analytical limitation	Issuer	Exact source
Alliance formation	22 September 2020	Historical event reported in alliance presentation	Establishment of the organisation; not evidence of commercial adoption	International SparkLink Alliance	Alliance ecosystem presentation, p. 3
International alliance registration	1 June 2023, Shenzhen	Historical event reported in alliance presentation	Institutional registration; does not establish independent international control	International SparkLink Alliance	Alliance ecosystem presentation, p. 3
SLB radio standard	T/XS 10001-2025, V2.0.0; listed as valid	Released and implemented 26 March 2025	Alliance standard for the synchronous low-latency broadband air interface; distinct from an ITU Recommendation	International SparkLink Alliance	Official standard record
Alliance membership	1,126 organisations	End-2024 figure reported March 2025	Membership count; does not measure active implementations or supplier independence	International SparkLink Alliance	2025 industry summit report
Products passing alliance testing	154	End-2024 figure reported March 2025	Products passing alliance tests; distinct from shipments and installed devices	International SparkLink Alliance	2025 industry summit report
Device shipments	More than 70 million	2024, reported March 2025	Ecosystem assertion attributed to a HiSilicon executive; not an independently audited European count	HiSilicon executive, reported by alliance	2025 industry summit report
Expected commercial terminal scale	More than 100 million	Forecast for 2025 made in March 2025	Forecast rather than verified realised shipments	HiSilicon executive, reported by alliance	2025 industry summit report
SLE bandwidth and maximum rate	1/2/4 MHz; up to 12 Mbps	Documentation accessed October 2026	Supported bandwidths and air-interface maximum; not guaranteed application throughput	HiSilicon	WS63 SLE API documentation
Combined-component example	Hi3863V100: Wi-Fi and SLE; listing says not yet launched	Listing accessed October 2026	Documents a design offering and announced specifications; commercial availability remains qualified	HiSilicon	Hi3863V100 product listing
European critical-system penetration	Not established by the reviewed evidence	Assessment cut-off	Requires product, procurement and deployment records; global totals cannot substitute	Analytical finding	Evidence boundary of this assessment

Interpretation: membership, tested products, chips, terminals and shipments describe different units. They cannot be added together, treated as interchangeable or converted into a European market share without compatible denominators.

Structural Exposure: What Must Be Measured

The following framework is an analytical proposal for procurement and technical assessment. It identifies evidence needed to determine whether adoption creates dependency.

Layer	Potential concentration mechanism	Evidence required	Test of retained European control	Decision consequence
Radio hardware	A component has no qualified substitute	Part numbers, manufacturer identity, interfaces, qualification records and alternative designs	Can another component meet the operational requirement within the recovery period?	Require an alternative design or explicitly accept the replacement lead time
Firmware	Only one supplier can diagnose or repair defects	Firmware versions, maintenance commitments, update procedures and support responsibilities	Can the operator obtain and deploy a validated fix during supplier disruption?	Make maintenance continuity a procurement condition
Update authority	External control of trusted updates constrains the operator	Signing-key governance, verification chain, revocation and recovery procedures	Can updates be controlled without weakening authenticity checks?	Establish accountable update governance before deployment
Credentials and pairing	Authentication depends on an inaccessible service or organisation	Provisioning workflow, credential ownership, reset procedures and offline behaviour	Can devices be securely enrolled, recovered and decommissioned independently?	Reject indispensable external provisioning dependencies where continuity requires autonomy
Software integration	Application functions depend on a particular stack or SDK	API dependencies, build requirements, licences and migration documentation	Can the application move to another implementation without major functional loss?	Price migration engineering into the acquisition decision
Gateway and management services	A local link depends on a wider management environment	Data-flow maps, administrative privileges, endpoints and service contracts	Does the essential function continue when external management is unavailable?	Define and test an acceptable autonomous operating mode
Certification and testing	Qualification depends on a narrow testing ecosystem	Test specifications, laboratory access and cross-vendor results	Can a replacement be assessed on transparent, reproducible criteria?	Invest in independent test capacity
System operation	Loss of connectivity interrupts a consequential process	Hazard analysis, fault response, recovery exercises and manual procedures	Can the system reach and sustain a safe operational state?	Apply restrictions proportionate to demonstrated consequences

A supplier’s nationality cannot answer these questions on its own. Neither can a protocol’s published specification. The relevant unit of assessment is the implemented product within its operational environment.

Dependency formation and intervention points

The scheme below presents a conditional causal model. It is not a claim that each stage has already occurred in Europe.

European and National Implications

The national priorities below are proposed assessment directions. They do not assert measured NearLink penetration in the sectors identified.

European Union: preserve choice across the internal market

The Union’s strategic objective should be a common evidentiary standard for embedded connectivity. Without comparable disclosure, one buyer may assess the finished product while another examines firmware provenance, update control and replacement options. The resulting variation would make cross-border exposure difficult to understand.

The Commission’s proposed supply-chain framework provides a possible institutional basis for addressing supplier risks beyond individual vulnerabilities. Its use should remain tied to evidence about consequential functions, available alternatives and economic effects. A protocol-wide restriction would require a different evidentiary justification from a restriction on a particular supplier or implementation. Commissione europea

The immediate practical priority is a shared inventory vocabulary: what component is present, which functions depend on it, who maintains it, and how it can be replaced. This would make subsequent regulatory choices more defensible while improving buyers’ negotiating position.

Italy: examine integration and maintenance relationships

Italy transposed NIS2 through Legislative Decree No. 138 of 4 September 2024, which entered into force on 16 October 2024. That establishes an existing national cybersecurity framework within which relevant operational exposure must be assessed; it does not establish a NearLink-specific restriction. gazzettaufficiale.it

The proposed Italian collection priority is the relationship between equipment manufacturers, integrators and maintenance providers. Assessment should establish whether a connectivity module is visible in technical documentation, whether the equipment owner receives updates through the integrator, and whether a replacement would require redesign of the wider machine or control application.

For public and critical-system procurement, Italy could require evidence of maintenance continuity and replacement feasibility before accepting an implementation that supports an indispensable function. Shared technical assistance would help smaller suppliers produce usable documentation without turning compliance into a purely administrative exercise.

France: connect technical assessment with market surveillance

France’s published CRA framework distinguishes the ANFR’s market-surveillance role from ANSSI’s functions in technical support, conformity-body notification and vulnerability coordination. That division offers a concrete structure for connecting laboratory findings with product-level corrective action. ANSSI

A useful French priority would be to test the complete control chain in selected implementations: authentication, firmware updates, administrative access and operation without external services. For sensitive procurement, such findings should feed into decisions about operational acceptance, rather than remain confined to a general statement that a radio interface is compliant.

French authorities also held a joint manufacturer-focused CRA event in September 2026 involving ANSSI, ANFR and the DGE. This provides evidence of implementation activity, although it should not be interpreted as a NearLink-specific assessment. ANSSI

Germany: make substitution an engineering requirement

For Germany, the proposed priority is to examine connectivity dependencies at design and qualification stages. The consequential question is whether a selected module becomes embedded in software, diagnostics and validation processes that later make replacement costly.

Procurement should therefore distinguish an available alternative from a qualified alternative. A substitute that exists in a catalogue may still require changes to power management, antennas, drivers, timing behaviour or application validation. Buyers should require documented migration assumptions and test them before large deployment commitments.

This approach could accommodate technically useful NearLink implementations while limiting concentration. The policy outcome would depend on demonstrated replacement capability, rather than on an assumption that protocol coexistence automatically provides operational redundancy.

United Kingdom: maintain a distinct legal assessment

The UK’s consumer connectable-product security regime has applied since 29 April 2024. Its baseline requirements concern passwords, vulnerability-reporting information and disclosure of minimum security-update periods. Its scope includes exclusions, and certain vehicle categories were excluded through amendments effective in February 2025. Consumer-product compliance cannot therefore be used as a universal answer for automotive or industrial systems. GOV.UK

The UK priority should be interoperability between evidence systems rather than an assumption of identical legal coverage with the EU. Shared technical tests and compatible component inventories could support coordination, while national authorities retain their respective powers and sectoral responsibilities.

Jurisdiction	Proposed first assessment focus	Procurement evidence to request	Principal implementation constraint
EU collectively	Comparable identification of embedded connectivity	Common component, firmware, maintenance and substitution fields	Coordinating product, sectoral and supplier-risk assessments
Italy	Equipment integration and maintenance chains	Integrator responsibilities, update access and replacement documentation	Obtaining usable evidence across multiple contractual tiers
France	Relationship between laboratory findings and market surveillance	Authentication, update governance and autonomous-operation tests	Translating technical findings into proportionate corrective action
Germany	Design-stage portability and qualification	Alternative-component validation and migration requirements	Requalification costs and engineering lead times
United Kingdom	Coverage across consumer and sector-specific regimes	Scope determination, update commitments and function-specific tests	Avoiding gaps between different regulatory frameworks

Competing Development Pathways to 2031

These pathways are conditional and may coexist across different sectors. The evidence does not support numerical probabilities.

Pathway	Mechanism	Evidence that would strengthen it	Evidence that would weaken it	Strategic implication
Competitive coexistence	NearLink supplies useful functions while buyers retain practical alternatives	Cross-vendor interoperability; portable software; independently maintained implementations; tested migration	Essential functions depend on one stack or maintenance organisation	Permit adoption with evidence-based safeguards
Concentrated operational dependence	Integration and qualification costs make switching progressively harder	Concentrated support; inaccessible update authority; failed substitution exercises; indispensable proprietary interfaces	Successful replacement tests and independent support arrangements	Intervene before deployment expands
Geographically segmented ecosystems	Different requirements and commercial platforms produce regional product architectures	Separate firmware branches, credentials or product designs by market	Common implementations satisfy multiple jurisdictions without functional loss	Monitor duplicated costs and cross-border compatibility
Limited specialist adoption	NearLink succeeds in selected applications without becoming a general platform	Concentrated use in bounded functions; modest expansion beyond initial categories	Broad integration across unrelated products and critical functions	Use targeted oversight rather than extrapolating systemic dependence

Principal Gaps and Watch Indicators

The most consequential uncertainty is the absence of a verified European deployment denominator in the reviewed evidence. Before estimating economic exposure, authorities would need to distinguish imported capability from activated functionality and from operational reliance.

Evidence gap	Record or observation required	Indicator that would change the assessment	Decision relevance
European installed base	Product declarations, procurement records and representative deployment surveys	Verified growth in active installations by product category and country	Establishes scale
Critical-function use	Operator architecture and dependency maps	Connectivity carries an indispensable command, credential or control function	Establishes consequence
Effective supplier diversity	Ownership, firmware provenance, SDK and maintenance relationships	Apparently separate suppliers depend on the same underlying implementation or support authority	Reveals correlated exposure
Security performance	Independent implementation testing and incident records	Reproducible failures in authentication, updates, recovery or isolation	Supports corrective action
Replacement feasibility	Migration exercises, alternative qualification and costed engineering plans	Replacement exceeds the operator’s acceptable recovery period	Establishes practical dependence
Standards governance	Current rules, participation rights, licensing terms and appeal procedures	Material barriers to implementation, participation or independent testing	Changes the assessment of ecosystem openness
International standardisation status	Approved institutional text and identifier	Formal adoption of a relevant specification, with a defined scope	Separates promotion from institutional recognition
Regulatory coverage	Final legislation, delegated measures and product-specific scope determinations	Enforceable obligations clearly cover the implementation and function concerned	Establishes available authority

Principal judgment: Europe’s opportunity is to govern the conditions of adoption while alternatives remain practical. NearLink’s strategic importance will depend on which functions it acquires, how independently its implementations can be maintained, and whether operators retain an affordable route out. The strongest early intervention is to make those conditions visible and testable before they become expensive to change.

PILLAR I — TECHNOLOGY, STANDARDS AND INDUSTRIAL POWER

Chapter 1. Inside NearLink: Architecture, Implementation Limits and Security Boundaries

NearLink’s strategic significance depends on the functions implemented above its radio interface. The technical record describes an architecture encompassing device discovery, connection management, service access, low-latency transmission, ranging and firmware delivery. Assessing it solely as a faster wireless connection would overlook the software decisions that determine which devices can communicate, which operations they can perform and how their behaviour can change after deployment.

The protocol stack separates connectivity from authority

HiSilicon’s SLE development documentation distinguishes the G, or Grant, role, which manages connection parameters and schedules communication slots, from the T, or Terminal, role, which communicates according to that scheduling. These roles are separate from the application’s client/server relationship: managing a connection and providing a data service are different responsibilities. A security assessment must therefore identify both who controls communication resources and who exposes information or accepts commands. SLE Overview — HiSilicon WS53 Developer Documentation — undated. WS53 开发者中心

This distinction matters when a connection moves beyond a peripheral interaction. Scheduling authority can affect availability and timing, while application permissions determine access to functions. A device may be correctly authenticated at the connection level yet remain excessively privileged at the application level. Conversely, a tightly restricted application may still depend on a poorly configured connection-management process.

The SLE Service Access Protocol, or SSAP, provides a more precise view of this application boundary. HiSilicon’s client API documents service discovery, reads by identifier or handle, write requests, write commands and callbacks. Its server API allows developers to construct services, properties and descriptors, including permissions. These interfaces establish that security depends partly on the service model chosen by the implementer, rather than following automatically from the presence of an encrypted radio connection. SSAP Client API — HiSilicon; SSAP Server API — HiSilicon. WS63 开发者中心

Table 1.1 — Implementation boundaries requiring separate assessment

Functional boundary	Documented implementation feature	Security question	Evidence required from the finished product
Connection control	Grant and Terminal roles; parameter management and scheduling	Can one connected device impair the availability or timing of others?	Role configuration, scheduling behaviour and resource-exhaustion tests
Service discovery	SSAP clients discover services and properties	Does discovery expose identifiers or functions unnecessarily?	Discoverable-service inventory before and after authentication
Data access	Reads and writes through identifiers or handles	Are access rights appropriate to the device’s operational role?	Property permissions and positive/negative authorisation tests
Command handling	Write requests and write commands	Does the application validate a command before changing state?	Input validation, state-transition rules and rejection behaviour
Asynchronous processing	Callback-based interaction	Can slow or blocked processing undermine timing or recovery?	Thread behaviour, queue limits and timeout handling
Network adaptation	CHBA network-device and link management	Does the connection introduce an additional network path?	Interface inventory, forwarding rules and segmentation tests
Firmware delivery	SLE OTA transport linked to a system upgrade framework	Is accepting a firmware package separated from merely receiving it?	Package verification, installation policy and recovery evidence
Ranging	HADM measurement APIs	Is measured proximity being treated as sufficient authorisation?	Error distributions and adversarial testing of the complete access decision

Documentary basis: the cited HiSilicon role and SSAP documentation, together with its CHBA API, OTA API and HADM API. The questions and evidence requirements are analytical assessment criteria.

Network carriage expands the relevant security perimeter

The CHBA implementation deserves particular attention because it moves the assessment beyond an isolated exchange of peripheral data. HiSilicon documents functions for creating network devices, adding and deleting links, sending data, collecting link statistics and registering callbacks for network-interface events. Its implementation distinguishes access-point and station roles. This establishes a documented network-adaptation capability, although it does not demonstrate that every NearLink product enables it. CHBA API — HiSilicon WS63 Developer Documentation — undated. WS63 开发者中心

The analytical implication is specific: a buyer cannot determine network exposure from the product’s marketing category. A peripheral, gateway or embedded controller may contain different enabled services despite using related silicon. The relevant assessment must establish whether the implementation carries application attributes, network traffic, firmware packages or several of these simultaneously.

Where network carriage is enabled, conventional security questions remain applicable. Which interfaces can forward traffic? Which destinations are reachable? Does the host apply the same filtering and monitoring to the NearLink-backed interface as to its other network interfaces? Can disabling a service leave an underlying communication path active? These are configuration and implementation questions, not evidence of a vulnerability inherent in the protocol.

Reporting frequency is not end-to-end latency

A frequent source of analytical error is the conversion of a reporting-rate claim into a complete response-time guarantee. HiSilicon documents a dedicated SLE low-latency service with configurable scheduling parameters and separate mouse, dongle and general transmit/receive interfaces. The feature depends on an established SLE connection; the documented build option for low-latency support is shown with a default value of “n”, meaning disabled in that configuration definition. A capability in the SDK is therefore not proof that it is enabled in a delivered firmware image. SLE Low Latency API — HiSilicon — undated. WS63 开发者中心

The distinction between cadence and response time can be expressed without adopting a manufacturer’s performance comparison. The nominal interval between evenly spaced reports is 1,000 divided by the reporting frequency, measured in milliseconds. That calculation describes an interval; it excludes sensor acquisition, application processing, queuing, retransmissions and the receiving system’s response.

Table 1.2 — Reporting frequency and its mathematical interpretation

Reporting frequency	Calculated nominal interval	What the calculation establishes	What remains outside the calculation
125 reports per second	8 milliseconds	Time between uniformly spaced report opportunities	Actual scheduling, packet delivery and processing delay
1,000 reports per second	1 millisecond	Nominal reporting cadence	Sensor-to-application response time
4,000 reports per second	0.25 milliseconds	Nominal reporting cadence	Reliability under competing traffic
8,000 reports per second	0.125 milliseconds	Nominal reporting cadence	Guaranteed delivery within 125 microseconds

Calculated values, not measured product results. The frequencies illustrate interpretation of reporting rates; they do not assert that every NearLink implementation supports each setting.

An industrial evaluation should consequently define the measurement endpoints before comparing technologies. An application-to-application measurement answers a different question from a radio-only measurement. An average delay answers a different question from the delay exceeded by only a small fraction of transactions. A technically meaningful result must also retain failed or late transactions in its assessment rather than reporting latency only for packets that arrived successfully.

Ranging creates an additional decision boundary

HiSilicon’s HADM documentation describes distance estimation using SLE physical-layer measurements, with APIs for measurement parameters, capability information and result callbacks. The documented feature configuration is also shown as disabled by default. This supports a finding of available development functionality, not universal availability in deployed products or a guaranteed ranging accuracy. HADM API — HiSilicon WS63 Developer Documentation — undated. WS63 开发者中心

The security importance arises when distance becomes an input to an access decision. A system may use proximity to decide whether to unlock, activate, pair or expose a privileged service. Its assessment must then distinguish measurement precision from security against manipulation. A narrow error distribution under ordinary conditions does not, by itself, establish resistance to an adversary.

The appropriate object of testing is the complete decision: how the system combines proximity with identity, authorisation, user intent and recovery procedures. The consequences of an incorrect acceptance and an incorrect rejection may differ substantially. A convenient entry mechanism and a safety-related control function should not share an acceptance threshold merely because they use the same ranging API.

Cryptographic hardware provides capabilities, not a security verdict

The WS63 security-system documentation lists symmetric encryption, hashing, key derivation, public-key operations, random-number generation and one-time-programmable storage. The breadth of these functions makes a simple “encrypted or unencrypted” classification inadequate. WS63 Security System — HiSilicon — undated. WS63 开发者中心

Table 1.3 — Selected WS63 security capabilities declared by the manufacturer

Function	Documented capability	Assessment implication
Symmetric cryptography	AES-128, AES-192, AES-256 and SM4	Verify the algorithms and modes actually enabled
Authenticated-encryption support	CCM and GCM among supported modes	Hardware support does not establish application use
Hashing	SHA-2 variants and SM3; SHA-1 also listed	Review the permitted profile and legacy-function exposure
Key derivation	PBKDF2; software-key derivation also describes HKDF	Examine derivation inputs and credential provisioning
Public-key operations	RSA, ECC and SM2	Confirm the selected parameters and verification policy
Hardware-derived keys	Described as unavailable for software readout	Require implementation-specific assurance
Randomness	Manufacturer describes a true-random-number generator	Verify configuration and integration
One-time-programmable storage	2,048-bit eFuse capacity	Examine provisioning, locking and recovery arrangements

Source: the manufacturer’s security-system documentation. These are capability declarations, not independent certification results.

Huawei’s presentation at the October 2024 ETSI Security Conference similarly described device, transport and application security domains, including mutual authentication and credential protection. Its evidentiary value is as a supplier’s architectural statement; hosting at an ETSI event does not convert that presentation into an ETSI certification or an independent validation of a finished product. NearLink Security Architecture, slide 10 — Huawei presentation hosted by ETSI — October 2024. docbox.etsi.org

Firmware transport and firmware acceptance are different controls

HiSilicon explicitly separates the SLE OTA service, which transports firmware packages over the wireless connection, from the system-level upgrade framework, which manages package verification, writing and the upgrade process. This is a consequential architectural distinction: a protected transport channel cannot substitute for verification that a package is authorised for the device. SLE OTA API — HiSilicon — undated. WS63 开发者中心

The proposed evaluation programme should therefore test the delivered implementation against the following boundaries.

Table 1.4 — Acceptance tests for consequential implementations

Test area	Measurement or observation	Required test condition	Decision supported
Application latency	Median, upper percentiles and maximum observed delay	Fixed payload, traffic load, firmware and measurement endpoints	Suitability for the intended timing requirement
Deadline delivery	Proportion delivered within the application deadline	Include lost and late transactions	Whether nominal speed translates into usable reliability
Coexistence	Delivery and recovery under competing radio activity	Record channel use, signal conditions and interferer behaviour	Robustness in the intended environment
Service permissions	Rejected unauthorised reads and writes	Unpaired, paired and revoked devices	Adequacy of application access control
Update authenticity	Rejection of unauthorised or modified packages	Valid transport connection	Separation of transport security from software trust
Interrupted update	Device state after power or connection loss	Interrupt distinct upgrade stages	Recoverability without unsafe operation
Downgrade handling	Behaviour when offered an older image	Test the stated version policy	Resistance to restoration of superseded software
Ranging decisions	False acceptance and rejection under defined conditions	Test the complete access workflow	Whether proximity is an appropriate security input
Resource exhaustion	Queue, memory and connection behaviour	Sustained malformed or excessive requests	Availability and containment
Network isolation	Reachability across interfaces	Enabled CHBA or gateway functions	Preservation of intended segmentation

These are proposed tests, not reported results.

Key judgments. The most consequential technical boundary lies between a connection’s capabilities and the permissions granted to the application using it. SDK functionality, enabled firmware features and operational assurance must be assessed separately.

What would change the assessment. Reproducible testing of named production devices could establish stronger conclusions about reliability, service isolation, update security and ranging-based access.

Open official record. The reviewed material does not provide a complete independent test corpus covering current European-market implementations, their firmware configurations and their operational environments.

Chapter 2. Building an Ecosystem: Silicon, Development Tools, Certification and Commercial Incentives

NearLink’s industrial strength will depend on whether manufacturers can turn specifications into dependable products at acceptable integration cost. Semiconductor availability is necessary, but development tools, test equipment, qualification and commercial support determine how widely a protocol can be incorporated into finished equipment.

Supplier breadth must be examined below the company name

A manufacturer account from July 2023 identifies Triductor’s TR5510 SLB and TR5312 SLE offerings, alongside the DX-T600 SLB chip and SLM10 module from Beijing Zhongke Jingshang. The same account records additional chip announcements and testing instruments. These records establish a multi-company development effort, but historical announcements cannot establish present production volume, delivery reliability or mutual substitutability. Industry summit and product announcements — Triductor Technology — 1 July 2023. Connecting the World with “Chips”

Table 2.1 — Selected implementation and development resources

Organisation or platform	Named resource	Documented role	Evidence status	Further evidence required
Triductor	TR5510	SLB chip and development board	Manufacturer account of a 2023 announcement	Current lifecycle, availability and qualification
Triductor	TR5312	SLE chip and development board	Manufacturer account of a 2023 announcement	Production support and compatibility
Beijing Zhongke Jingshang	DX-T600; SLM10	SLB chip and module	Identified in the manufacturer’s summit account	Current specifications and supply arrangements
HiSilicon	WS63	Wi-Fi 6, BLE 5.4 and SLE 1.0 combination platform	Developer documentation	Enabled production configuration and lifecycle support
HiSilicon ecosystem	BS21-based development board	Peripheral integration and development	Published partner case	Suitability beyond evaluation use
HiSpark Studio	Development environment	Project configuration, compilation and programming	Installation and development guides	Reproducibility and long-term tool availability

Additional sources: WS63 Quick Start — HiSilicon; BS21 Development Board Case — HiSilicon Developer Community; WS63 Development Environment — HiSilicon.

The distinction between supplier breadth and independent supply is central. Two modules may be sold by different companies while relying on the same baseband implementation, firmware library or maintenance channel. Conversely, implementations of the same protocol may have materially different dependencies. Neither the number of logos nor shared protocol support is sufficient to establish diversification.

A useful industrial assessment would follow each candidate component through five levels: chip design, manufacturing and packaging, firmware provenance, development-tool dependencies and maintenance authority. The public records reviewed identify products and participants but do not support a complete allocation of these dependencies. Claims that NearLink is either wholly dependent on one supplier or already broadly diversified would exceed that evidence.

Developer tools influence the cost of entry and the cost of exit

HiSilicon’s WS63 environment guide describes installation of HiSpark tooling, an embedded Python 3.11.4 environment, associated packages and a RISC-V cross-compilation toolchain. This is more than supporting documentation: a maintained build environment lowers the effort required to begin product development. WS63 Development Environment — HiSilicon — undated. WS63 开发者中心

The same convenience creates a question about long-term control. A manufacturer may own its application source while still depending on a particular compiler package, binary library, configuration system or programming tool. Operational independence requires the ability to reconstruct a supported firmware image and deploy it through an authorised process after the initial development team or supplier relationship changes.

The evidence needed is practical. Can the buyer identify the exact versions used to build a released image? Can the environment be reconstructed without an account or service that might later become unavailable? Which parts of the software are inspectable and modifiable? Which remain precompiled? Who can correct a defect below the application layer?

These questions should not be answered through a generic declaration that an ecosystem is “open.” Access to documentation, access to source, permission to modify, ability to rebuild and authority to distribute an update are separate rights and capabilities.

Table 2.2 — Development independence: evidence beyond source-code access

Dimension	Weak evidence	Stronger evidence	Commercial significance
Documentation	Public API descriptions	Complete versioned implementation and integration documentation	Reduces reliance on informal support
Source availability	Sample applications	Coverage of operationally important components with clear licences	Enables inspection and modification
Build control	A project compiles on one workstation	Reconstructable environment with identified dependencies	Preserves maintainability over time
Binary dependencies	Libraries supplied without provenance detail	Versioned binaries, security support and replacement commitments	Makes lower-layer dependence explicit
Distribution rights	Permission to experiment	Rights to ship and maintain the intended commercial product	Determines practical market access
Update authority	Supplier can provide an update	Documented approval, signing and deployment responsibilities	Determines who can sustain the product
Alternative implementation	Another product uses the protocol	Tested migration preserving required functions	Establishes meaningful substitution

Test infrastructure is an industrial asset

A protocol ecosystem becomes easier to adopt when firms can purchase instruments, reproduce test procedures and resolve implementation disagreements. Triductor’s 2023 account identifies StarPoint’s 9500Pro-SLT and SP9020, RF instruments from Shenzhen Extreme Instrumentation and a protocol tester from Hangzhou Yongxie. These are reported product announcements rather than evidence of independent test coverage, but they demonstrate attention to the supporting measurement market. Testing-equipment announcements — Triductor Technology — July 2023.

Formal specifications also distinguish interface requirements from equipment testing. The alliance lists T/XS 10002-2025, V2.1.1, for the SLE air interface, and T/XS 50003-2025, V1.1.0, for SLE device air-interface requirements and testing, both dated 26 March 2025. Separate identifiers and versions mean that a certificate must be read against its actual test scope. SLE Air-Interface Standard Record — International SparkLink Alliance — March 2025; SLE Device Testing Standard Record — International SparkLink Alliance — March 2025. 国际星闪无线短距通信联盟

For a European purchaser, a useful certification package would identify the tested hardware revision, firmware version, standard edition, optional features and test conditions. Otherwise, conformity can become detached from the actual product under consideration. A radio test may establish transmission behaviour without addressing application authorisation; a successful interoperability test may establish communication between two products without establishing resilience against malicious input.

Intellectual-property openness is conditional

The alliance’s published intellectual-property rules, effective from 28 November 2020, distinguish FRAND licensing from FRAND-RF, which adds royalty-free treatment, and permit members to select between these default obligations. They also address reciprocity, essential claims, disclosure, copyright and certification marks. The retrieved document cannot establish every supplier’s current declaration or commercial licence. NearLink should therefore not be described as universally royalty-free on this evidence. Intellectual Property Management Rules, Articles 3–5 and 29 — SparkLink Alliance — November 2020. cdn.sparklink.org.cn

The business implication is to obtain the actual rights applicable to the intended product. A standards document, a software package and a certification mark may involve different permissions. Before committing to a design, a manufacturer should resolve whether its intended implementation and distribution are covered, what continuing obligations apply and which rights survive a change in commercial relationships.

Integration economics can make adoption rational and dependence costly

NearLink adoption need not reflect a political preference. A manufacturer may find that an available implementation reduces engineering effort or meets a specific product requirement. The industrial-policy concern arises when the initial savings are evaluated without the costs of maintenance, requalification and migration.

HiSilicon’s BS2X upgrade guide illustrates the depth of software integration by describing firmware-package generation and configurable images including the application and flash boot component. The commercial implication is that replacing a wireless component can involve the surrounding firmware lifecycle, rather than a simple exchange of radio hardware. BS2XV100 Upgrade Solution Guide — HiSilicon. HiSpark编程指南 master 文档

Table 2.3 — Cost categories for a defensible acquisition model

Cost category	Required inputs	Risk of omission
Initial hardware	Chip, module, antenna, memory and power requirements	Comparing component prices while missing system changes
Development	Application integration, drivers, tooling and debugging	Underestimating engineering commitments
Verification	Radio, interoperability, security and environmental testing	Treating an evaluation result as production readiness
Maintenance	Supported software branches, fixes and field deployment	Acquiring a product without a sustainable support model
Qualification of alternatives	Hardware redesign, firmware porting and retesting	Mistaking catalogue availability for usable redundancy
Operational migration	Installation work, downtime and retraining	Underpricing the consequences of switching
End-of-life transition	Replacement, decommissioning and credential handling	Extending unsupported operation

No monetary estimates are assigned because comparable, verified commercial inputs are not available in the reviewed record.

Key judgments. Development convenience and test infrastructure can accelerate adoption without requiring exclusive protocol replacement. Effective supplier diversity must be demonstrated through implementation and maintenance independence, while licensing must be established through applicable terms rather than general claims of openness.

What would change the assessment. Current production disclosures, qualified cross-vendor replacements and demonstrably reproducible software maintenance would provide stronger evidence of competitive depth.

Open official record. Comparable chip prices, shipment allocations by supplier, production dependencies and current implementation-specific patent terms remain insufficiently documented for a defensible concentration or cost estimate.

Chapter 3. China’s Standards Strategy: Domestic Coordination and International Reach

The most consequential development in the current official record is NearLink’s incorporation into a Chinese national standards family. This gives the technology an institutional trajectory extending beyond alliance promotion, while leaving commercial adoption, regulatory compulsion and international recognition as separate questions.

September 2026 changed the institutional baseline

China’s national standards platform records GB/T 48336.101-2026, covering architecture and general requirements, as published on 28 September 2026 and scheduled for implementation on 1 April 2027. The record classifies it as a recommended national standard, rather than a mandatory national standard. Its governance involves the national information-technology standardisation committee and the national cybersecurity standardisation committee. GB/T 48336.101-2026 — National Public Service Platform for Standards Information — September 2026. 全国标准信息公共服务平台

The distinction between recommended and mandatory status prevents an exaggerated conclusion: publication does not establish a universal legal requirement to adopt NearLink. Nevertheless, a common national reference can reduce uncertainty for engineering teams, testing organisations and procurement bodies. It can make investment in compatible products easier to coordinate even where adoption remains a commercial choice.

The publication-to-implementation interval is 185 days, calculated from the official dates. At the assessment cut-off of 20 October 2026, 163 days remained before the scheduled implementation date. These intervals describe the standards timetable; they are not forecasts of market penetration.

Table 3.1 — Selected national NearLink standards published in September 2026

Standard	Subject	Publication	Scheduled implementation	Analytical significance
GB/T 48336.101-2026	Architecture and general requirements	28 September 2026	1 April 2027	Common system-level reference
GB/T 48336.102-2026	Media-access-layer identifiers	28 September 2026	1 April 2027	Identification within the communications architecture
GB/T 48336.202-2026	SLB device requirements and test methods	28 September 2026	1 April 2027	Equipment-level testing framework
GB/T 48336.203-2026	SLE device requirements and test methods	28 September 2026	1 April 2027	Low-energy equipment testing framework
GB/T 48336.301-2026	Device discovery and transmission control	28 September 2026	1 April 2027	Coordination beyond the radio interface
GB/T 48336.302-2026	Quality-of-service management	28 September 2026	1 April 2027	Treatment of service requirements
GB/T 48336.402-2026	Cooperative device-set management	28 September 2026	1 April 2027	Management of collaborating devices
GB/T 48336.403-2026	Media control	28 September 2026	1 April 2027	Application-layer media functions
GB/T 48336.404-2026	Position-information management	28 September 2026	1 April 2027	Handling of location-related information
GB/T 48336.406-2026	IP-bearer management	28 September 2026	1 April 2027	Integration with IP-based communication

Official records: Part 102, Part 202, Part 203, Part 301, Part 302, Part 402, Part 403, Part 404 and Part 406. This is a selected inventory, not a claim that these are the only standards in the family. 全国标准信息公共服务平台

The breadth of this inventory matters more than the number of documents. Discovery, service quality, collaborative device management and IP carriage address how products operate together. An ecosystem that coordinates those functions can reduce integration friction across product categories, potentially making its components more attractive to firms that have no interest in replacing their wider communications infrastructure.

The drafting coalition crosses institutional and industrial boundaries

The national architecture record lists standards institutes, research organisations, universities, operators and commercial manufacturers among its drafting organisations. Named participants include CESI, CAICT, CNIS, Huawei, ZTE, China Mobile’s research organisation, Lenovo, vivo, OPPO and several universities. Participation establishes contribution to a particular drafting process; it does not prove that every listed company has adopted the technology throughout its products. Drafting organisations — GB/T 48336.101-2026 — National Standards Platform.

The service-layer record provides additional evidence of cross-sector involvement. The device-discovery and transmission-control standard includes organisations such as Changan Automobile and Guodian Nanjing Automation among its drafters. This demonstrates participation by potential application-sector actors, while leaving actual deployment to be established through product and procurement evidence. GB/T 48336.301-2026 — National Standards Platform — September 2026.

The analytical mechanism is coordination. Standards institutes can formalise requirements; manufacturers can incorporate them into components; application-sector firms can communicate integration needs; testing organisations can help translate requirements into repeatable measurements. That combination can reduce the risk that one participant invests in a capability unsupported by the rest of the ecosystem.

This is also why standards strategy should not be reduced to patent ownership. Influence can arise from control over reference implementations, test procedures, qualification practices and the pace at which revisions become commercially usable. A patent inventory alone would miss those forms of industrial power.

Industrial expansion is being prepared through new projects

On 16 September 2026, the alliance’s requirements and standards group met in Wuxi. CNIS reported approval of three new standards projects addressing electromagnetic interference, environmental adaptability and service-quality evaluation for multi-device cooperation. Its announcement explicitly identifies industrial control, power systems and difficult operating environments as intended areas of relevance. These were approved projects, not completed standards or proof of industrial qualification. CNIS participation in the 21st requirements and standards meeting — China National Institute of Standardization — 22 September 2026. cnis.ac.cn

Table 3.2 — Industrial standardisation projects and the questions they address

Project reported by CNIS	Status at the cut-off	Technical issue	Evidence still needed before deployment claims
Communication resistance to strong electromagnetic interference — general requirements	Project approved	Behaviour in electrically demanding environments	Completed requirements and implementation test results
Environmental adaptability guidelines for NearLink devices	Project approved	Temperature, humidity, vibration and related conditions	Defined operating limits and equipment qualification
Multi-device cooperative service-quality evaluation guidelines	Project approved	Evaluation of coordinated application performance	Final metrics, verification procedures and reproducible results

The importance of these projects is twofold. First, they show that industrial use is being addressed through a formal development programme. Second, they identify areas where a more complete assurance framework is still being constructed. European analysis should retain both findings. Treating project approval as proven capability exaggerates readiness; ignoring the projects understates the direction of development.

Interoperability can support expansion without proving openness

The National Digital Standards Library records T/XS 30025-2026, covering the interconnection of IP-based third-party application protocols, as published and implemented on 1 August 2026. Its stated scope includes mechanisms for connecting third-party devices and services, including discovery, networking and service management. T/XS 30025-2026 — National Digital Standards Library — August 2026. ndls.org.cn

This provides a concrete basis for understanding how NearLink could expand through coexistence. Compatibility with established application environments can make adoption less disruptive. Manufacturers may incorporate a new access technology while preserving familiar services above it.

The resulting strategic effect is conditional. Interoperability can reduce dependence if it enables replacement by independently maintained alternatives. It can also increase adoption while leaving the underlying implementation difficult to replace. The deciding evidence is whether the interface specification and available products permit practical substitution, rather than whether a gateway can connect two environments.

International activity requires similarly precise language. An ITU-hosted October 2025 workshop records a SparkLink Alliance presentation on embodied AI and short-range communications. That establishes participation and agenda promotion. Formal recognition requires an approved institutional instrument with a defined scope; workshop participation cannot substitute for it. ITU-T workshop transcript, pp. 60–63 — ITU — October 2025. www.itu.int

Self-reliance and export expansion can reinforce each other

Domestic technological autonomy and international commercial success are not inherently opposing objectives. A sufficiently complete domestic ecosystem can provide demand, implementation experience and maintenance capacity. Those capabilities may then support exports. International adoption, in turn, can enlarge the market available to component vendors and developers.

The reviewed records are consistent with that mechanism: national standards now cover several layers, industrial-assurance projects are being developed, and third-party interconnection has received a dedicated specification. They do not establish a single centrally directed commercial outcome or a predetermined European dependency.

The strongest competing explanation is that NearLink remains one technically useful option among several, with its adoption constrained by integration requirements, incumbent compatibility and the economics of qualification. That possibility should remain active in the assessment. A strategic warning is strongest when it identifies observable conditions under which the risk would increase or diminish.

Table 3.3 — Indicators of standards influence becoming industrial dependence

Observable development	Interpretation supporting stronger Chinese ecosystem influence	Countervailing evidence
National standards appear in commercial tenders	Institutional references are shaping product requirements	Procurement accepts equivalent independently implemented alternatives
New service-layer features become essential to applications	Influence extends beyond radio compatibility	Applications remain portable across implementations
Industrial projects produce validated test frameworks	Adoption barriers in demanding environments are falling	Implementations repeatedly fail relevant operating requirements
Multiple vendors share the same maintenance dependency	Supplier breadth conceals correlated support risk	Independent maintenance and replacement are demonstrated
Third-party interconnection becomes widely implemented	NearLink can enter existing application environments	Interconnection also enables straightforward migration away
European companies participate in drafting and testing	Early access may improve influence and preparedness	Participation remains informational without effective technical contribution
Formal international instruments reference the technology	Recognition extends beyond promotion	Reference is narrow, optional or does not cover the relevant implementation
Qualified substitutes become scarce for consequential functions	Practical switching costs are increasing	Migration exercises preserve required performance and security

The European industrial implication is earlier technical engagement

For Italy, France, Germany and the United Kingdom, the industrial-policy question is whether domestic firms can assess and influence implementations before product architectures become expensive to alter. This does not require assuming widespread NearLink adoption in any one country. It requires recognising that standards, tools and qualification processes shape the choices available to manufacturers.

A proportionate response would combine technical observation with commercial discipline. Standards participation can clarify forthcoming requirements; independent testing can assess actual implementations; procurement can preserve access to documentation and maintenance; and investment in alternative implementations can protect bargaining power.

The distinction between engagement and dependence is practical. A firm can participate in an ecosystem while retaining control over its application, credentials and migration options. It becomes more exposed when participation delivers market access but leaves the technical and contractual conditions of continued operation outside its control.

Key judgments. The September 2026 national standards constitute a substantive institutional development. Their breadth supports a stronger assessment of ecosystem coordination, while their recommended status and future implementation date limit claims about compulsory adoption or realised capability. Industrial and international expansion remain processes to be demonstrated through completed standards, validated products and actual deployments.

What would change the assessment. Procurement references, independent cross-vendor implementations, completed industrial-assurance standards and approved international instruments would clarify whether coordination is producing durable market influence.

Open official record. The principal unresolved questions concern implementation-level compatibility, the commercial use of the new national standards, current licensing declarations and the extent to which independently maintained alternatives can preserve the same application functions.

---

PILLAR II — EUROPEAN EXPOSURE AND REGULATORY CAPACITY

Chapter 4. How Dependency Forms: Procurement Pathways, Maintenance Authority and Substitution Costs

Europe’s exposure to NearLink will be determined by purchasing and integration decisions made across product supply chains, often before the eventual operator has visibility of the connectivity component. The consequential transition occurs when an implementation becomes necessary to sustain a service, while the contractual rights, technical resources or qualified alternatives required to maintain that service remain outside the operator’s control.

This is an organisational and commercial problem as much as a technical one. A buyer can receive a functioning product, a conformity declaration and a maintenance contract without receiving a sufficiently complete account of the organisations on which continued operation depends. The resulting gap becomes visible when a vulnerability, component change, support withdrawal or replacement programme requires action across several contractual tiers.

Procurement can separate the purchasing decision from its consequences

Official UK connected-places guidance identifies procurement as a lifecycle responsibility, extending from early market engagement to contract management and decommissioning. Its practical relevance to embedded connectivity is that security requirements must reach the supplier before the architecture and commercial relationship have become difficult to alter. The guidance explicitly supplements existing procurement rules rather than replacing them. Procurement and Supply Chain Management — Department for Science, Innovation and Technology — March 2024. GOV.UK

For NearLink, the purchasing channel may determine how much the operator can discover and negotiate. A direct component purchaser can question the chip or module supplier. A buyer of finished machinery usually negotiates with an equipment manufacturer. A municipality buying a managed service may have no direct contractual relationship with either. These arrangements distribute responsibility differently, even when the underlying connectivity implementation is similar.

Table 4.1 — Procurement pathways and the location of accountability

Procurement pathway	Operator’s immediate counterparty	Potential visibility gap	Evidence to obtain before award	Contractual issue requiring resolution
Direct purchase of a radio module	Module supplier or distributor	Underlying silicon, firmware provenance and maintenance dependencies	Identified module revision, firmware supplier and supported lifecycle	Who corrects defects below the module’s published interface?
Purchase of finished equipment	Equipment manufacturer	Connectivity subsystem hidden within the equipment specification	Component inventory linked to equipment model and production revision	Does the manufacturer remain responsible for third-party component changes?
Purchase through a systems integrator	Integrator	Different vendors control equipment, gateways and management software	Responsibility map covering every operationally necessary subsystem	Which party coordinates diagnosis and remediation?
Managed connected service	Service provider	Operator sees service performance rather than the underlying implementation	Infrastructure inventory, subcontractor dependencies and continuity arrangements	Can the service continue if a subcontractor withdraws?
Framework or catalogue procurement	Framework supplier	Assumption that framework inclusion resolves implementation-specific risks	Product-specific security and support evidence	Which requirements must still be assessed at the individual purchase stage?
Imported or rebranded equipment	Importer or own-brand manufacturer	Unclear relationship between brand, original manufacturer and firmware maintainer	Original equipment identity and accountable economic operator	Who can obtain and deliver an authorised security update?
Equipment supplied within a larger project	Main contractor	Connectivity treated as a minor installation detail	As-built inventory and maintenance handover documentation	Does acceptance include the embedded subsystem and its support obligations?
Replacement during maintenance	Maintenance provider	Substitute component differs from the original assessed configuration	Change notice, equivalence assessment and updated inventory	Can the provider change connectivity components without approval?

This table identifies possible procurement structures. It does not assert measured NearLink penetration through each channel.

The final pathway is particularly important. An organisation may carefully assess an initial installation and subsequently lose visibility when components are replaced. A replacement can preserve the advertised function while changing the firmware maintainer, update mechanism or communications capabilities. Consequently, an inventory that is accurate only on the commissioning date provides limited protection over a long equipment lifecycle.

Maintenance control is distributed across several decisions

A maintenance agreement often appears to establish a single point of responsibility. In practice, sustaining an embedded implementation can require several distinct authorities: access to diagnostic information, permission to modify software, production of an accepted firmware image, approval for deployment and validation that the change preserves the equipment’s required behaviour.

These authorities need not belong to the same organisation. Their distribution determines whether the operator can respond quickly when the immediate supplier cannot resolve a problem independently.

Table 4.2 — Maintenance authority and its operational consequences

Decision or capability	What the operator needs to establish	Consequence if unresolved	Suitable evidence
Identify affected equipment	Whether a component-level issue can be mapped to installed products	Delayed or incomplete remediation	Versioned relationship between component, firmware and asset
Diagnose the failure	Whether relevant logs, interfaces and technical assistance are available	Dependence on an external diagnostic bottleneck	Diagnostic documentation and support escalation procedures
Produce a correction	Which organisation can modify the affected software layer	Application supplier cannot repair a lower-layer defect	Maintenance responsibility and engineering-support commitments
Authorise an image	Who approves software accepted by the equipment	A technically available correction cannot be installed	Documented signing and approval arrangements
Schedule deployment	Who controls installation timing and service interruption	Security action conflicts with operational requirements	Agreed maintenance windows and emergency-change procedures
Validate the correction	Who determines whether required functions remain acceptable	Security repair introduces operational or qualification problems	Regression testing and acceptance responsibilities
Recover from failure	Whether an interrupted or unsuccessful update is recoverable	Equipment becomes unavailable during remediation	Demonstrated recovery procedure
Sustain support after a commercial change	What survives insolvency, acquisition or contract termination	Maintenance ends before equipment use ends	Continuity provisions and a practicable alternative support route

These are separate questions from whether a supplier offers a particular number of years of support. A long commitment has limited value if the contractual counterparty cannot obtain corrections from the organisation controlling a necessary software component.

ENISA’s implementation guidance provides an established European reference for this broader lifecycle approach. Its supply-chain section addresses continuing supplier review, responsibility for assets, changes affecting supplied products and arrangements surrounding termination. However, the guidance supports the specific digital-sector entities covered by Implementing Regulation (EU) 2024/2690; it is advisory and should not be represented as a universally binding checklist for every industrial purchaser. NIS2 Technical Implementation Guidance, Chapter 5 — ENISA — June 2025. enisa.europa.eu

Substitution cost is more than the replacement component’s price

The economically relevant comparison is between maintaining the existing implementation and introducing an alternative that preserves the required service. Hardware acquisition may represent only one part of the latter cost.

A defensible replacement assessment should separate expenditure incurred to change the equipment from losses caused by interruption. It should also distinguish calendar time from outage time. An alternative may take months to qualify while the original system continues operating; another may be available immediately but require an unacceptable installation outage.

Table 4.3 — Replacement variables that should remain separate

Variable	Definition	Required input	Common analytical error
Alternative identification time	Time needed to identify a candidate implementation	Market investigation and compatibility requirements	Treating a catalogue listing as a qualified alternative
Engineering time	Time to adapt hardware, software or interfaces	Documented design changes and engineering resources	Assuming protocol compatibility eliminates integration work
Qualification time	Time to demonstrate required security and operational behaviour	Applicable tests and acceptance criteria	Treating a successful demonstration as full qualification
Delivery time	Time to obtain the required quantity	Supplier commitments and production availability	Confusing sample availability with deployment-scale supply
Installation time	Work required to replace or reconfigure assets	Site access, staffing and installation procedures	Applying laboratory replacement time to distributed installations
Service interruption	Period during which the required function is unavailable	Operational migration plan	Equating total project duration with downtime
Residual asset loss	Usable value abandoned through replacement	Remaining useful life and recoverable components	Counting the entire historical purchase price as a new loss
Continuing maintenance cost	Cost of sustaining the replacement	Support contracts and internal capability	Comparing initial prices while excluding lifecycle obligations

No verified European dataset currently supports a single NearLink replacement-cost estimate. The appropriate unit is the implemented system, with its specific operational requirements and contractual arrangements.

The absence of a defensible aggregate does not prevent useful analysis. It changes the question from “How much would Europe pay?” to “Which information must buyers collect now to prevent an unmanageable replacement programme later?” Cost estimates become decision-useful when they identify the equipment population, alternative design, qualification burden and interruption assumptions.

Contract terms should preserve information as the installation changes

A procurement document should connect technical disclosure to continuing obligations. A supplier’s initial response cannot remain authoritative after substantial changes to the product, support organisation or subcontractor chain.

The following provisions are proposed assessment requirements, to be adapted to the applicable procurement framework and the function’s importance.

Table 4.4 — Proposed contractual controls for consequential embedded connectivity

Provision	Intended effect	Evidence of performance	Principal limitation
Component and firmware identification	Link supplied equipment to its embedded implementation	Versioned inventory delivered with each revision	Documentation can become stale without change control
Material-change notification	Expose changes affecting security, support or compatibility	Notices linked to affected product revisions	Requires a clear definition of material change
Vulnerability coordination	Give the operator a reliable route from disclosure to remediation	Named contacts, escalation records and corrective-action tracking	Contact availability does not guarantee engineering capacity
Support-period alignment	Match maintenance to intended equipment use	Explicit dates, scope and supported configurations	A commitment may depend on lower-tier suppliers
Approved-update process	Preserve operator control over consequential changes	Authorisation and deployment records	Excessive approval delays can prolong exposure
Transition assistance	Reduce the burden of changing suppliers	Deliverable documentation and agreed assistance	Rights are ineffective without usable technical resources
Subcontractor transparency	Reveal dependencies below the immediate supplier	Relevant subcontractor and service-dependency records	Commercial confidentiality requires proportionate handling
End-of-support notice	Allow time for migration	Notice period tied to operational transition needs	Notice alone does not create a qualified replacement

The policy implication is that Europe should examine control over change, not merely control over the original purchase. Embedded dependence can deepen after installation when subsequent maintenance choices narrow the alternatives available to the operator.

Key judgments. Procurement structure determines who can obtain information and enforce maintenance obligations. Replacement feasibility must be measured across engineering, qualification, delivery and operational transition. The existence of an alternative component is insufficient evidence of recoverability.

What would change the assessment. Installed-asset inventories linked to contractual support chains and completed migration exercises would allow exposure to be measured rather than inferred.

Open official record. The reviewed evidence does not establish European NearLink deployment volumes by procurement channel, support-provider concentration or validated replacement costs.

Chapter 5. Europe’s Legal Instruments: Product Security, Operator Duties and Supply-Chain Powers

Europe has several relevant legal mechanisms, but they regulate different objects and cannot be treated as interchangeable. Product conformity concerns the conditions under which equipment is supplied. Operator obligations concern the security of services and systems in use. Sectoral rules address particular equipment categories. Supplier-risk measures address dependencies that may remain even when a product satisfies technical requirements.

A coherent assessment must identify the product, the economic operator, the operational function, the jurisdiction and the provision actually applicable. “NearLink-capable” is a technical description; it is not, by itself, a legal category determining prohibition, mandatory third-party assessment or critical-infrastructure status.

Product security and operational resilience address different responsibilities

The Commission describes NIS2 as a framework covering 18 critical sectors, with risk-management, reporting, supervision and management-accountability requirements. Its relevance to embedded connectivity arises where such connectivity forms part of the network and information systems supporting an entity within scope. It does not make every manufacturer or purchaser of a connected product subject to identical obligations. NIS2 Directive: Securing Network and Information Systems — European Commission — updated July 2026. Shaping Europe’s digital future

The Cyber Resilience Act operates at another level: manufacturers must assess product cybersecurity and exercise due diligence when integrating third-party components. The resulting product-level evidence can support an operator’s assessment, but it does not determine whether that product is suitable for every operational environment. The Cyber Resilience Act: Summary of the Legislative Text — European Commission. Shaping Europe’s digital future

Table 5.1 — Regulatory objects and the questions they answer

Instrument or mechanism	Primary object	Relevance to embedded connectivity	What cannot be inferred automatically
Cyber Resilience Act	Products with digital elements and relevant economic operators	Product risk assessment, component due diligence and vulnerability handling	Fitness for every critical operational function
NIS2 and national implementing law	Essential and important entities within scope	Security of operational systems and relevant supply relationships	Universal coverage of every connected-device supplier
Radio Equipment Directive framework	Radio equipment placed on the market	Applicable radio, safety, compatibility and cybersecurity requirements	Independence from a particular maintenance organisation
Sector-specific product legislation	Defined equipment categories	Requirements appropriate to regulated products and functions	A general exemption from all cybersecurity responsibilities
Public procurement conditions	Particular acquisitions under applicable rules	Evidence, maintenance and transition requirements	A general market prohibition
Telecommunications supplier directions	Defined providers, vendors, equipment or functions	Legally specified restrictions and migration obligations	Automatic application to unrelated consumer or industrial products
Proposed revised EU Cybersecurity Act	Proposed Union supply-chain and certification framework	Potential assessment and mitigation of supplier-related risks	Already exercisable powers merely because a proposal exists
Proposed Digital Networks Act	Proposed connectivity framework	Network resilience and preparedness	A universal embedded-component disclosure obligation

The CRA does not require the same assessment procedure for every product

The Commission’s conformity guidance distinguishes the default category, where manufacturer self-assessment is permitted, from important and critical product categories subject to stricter procedures. Examples include operating systems, routers, firewalls, secure elements and hypervisors. The applicable procedure depends on the defined category and circumstances, rather than the mere presence of a particular wireless protocol. Cyber Resilience Act: Conformity Assessment — European Commission. Shaping Europe’s digital future

This distinction prevents two opposite errors. A CE-marked product should not be assumed to have undergone comprehensive independent testing. Equally, a product using self-assessment should not be assumed non-compliant merely because an independent laboratory was not mandatory. Procurement can require additional proportionate assurance where the intended use justifies it, but that requirement must be stated and evaluated separately.

ANSSI’s CRA explanation also confirms that vulnerability handling includes a machine-readable software bill of materials covering at least top-level dependencies. Such an inventory is useful for identifying software exposure; it does not necessarily reveal chip manufacturing provenance, ownership of update authority or every service required for continued operation. CRA Regulatory Framework: Vulnerability-Handling Requirements — ANSSI. ANSSI

Table 5.2 — Evidence products and the limits of each

Evidence	Useful for establishing	Additional evidence still needed
Software bill of materials	Identified software dependencies	Hardware provenance and maintenance-control relationships
EU declaration of conformity	Manufacturer’s declaration against applicable requirements	Scope of supporting tests and suitability for the intended operation
Third-party assessment report	Findings within the assessor’s defined scope	Coverage of optional features, later revisions and deployment conditions
Support statement	Declared maintenance period and responsibilities	Ability to deliver corrections through the complete supplier chain
Product vulnerability notice	Affected versions and available remediation	Mapping to the operator’s installed equipment
Supplier-risk assessment	Exposure associated with the organisation or supply relationship	Product-specific technical behaviour
Operational acceptance report	Suitability for the evaluated use and configuration	Continuing validity after changes

Europe’s transition timetable contains several distinct legal events

The reporting provisions, conformity infrastructure and principal product obligations do not share one application date. Moreover, the existing radio-equipment cybersecurity framework is being coordinated with the CRA.

The Commission records that Delegated Regulation (EU) 2022/30 entered into application in August 2025. It also records publication of Delegated Regulation (EU) 2026/339 on 29 April 2026, repealing that cybersecurity delegated regulation with effect from 11 December 2027 to avoid overlapping requirements when the CRA’s main obligations apply. The repeal concerns the delegated cybersecurity requirements, not the disappearance of the Radio Equipment Directive as a whole. Radio Equipment Directive: Cybersecurity Update — European Commission. single-market-economy.ec.europa.eu

Table 5.3 — Selected European implementation dates

Date	Event	Consequence for assessment
17 October 2024	NIS2 national-transposition deadline	Actual national implementation must still be checked
August 2025	Application of RED Delegated Regulation 2022/30	Relevant categories of radio equipment face activated cybersecurity requirements
11 June 2026	CRA provisions on notification of conformity-assessment bodies apply	Assessment infrastructure develops before principal product obligations
11 September 2026	CRA manufacturer reporting obligations apply	Reporting must be distinguished from full product-requirement application
11 December 2027	CRA principal requirements apply	Product design, conformity and vulnerability-handling obligations become generally applicable within scope
11 December 2027	Repeal of RED cybersecurity Delegated Regulation 2022/30 takes effect	Transition between overlapping product-security mechanisms
11 June 2028	Relevant earlier cybersecurity type-examination certificates and approval decisions reach the transitional endpoint, unless they expire sooner	Existing certificates require case-specific review

Sources: NIS2 overview — European Commission; CRA legislative summary, Chapter VIII — European Commission; RED cybersecurity update — European Commission.

Earlier products require particular care. The Commission explains that products placed on the market before 11 December 2027 are generally brought under the CRA’s principal requirements if subsequently substantially modified; reporting obligations also reach products already made available before that date. Consequently, the framework should not be described either as imposing an immediate universal retrofit or as leaving all earlier products outside its reporting architecture. CRA Transitional Provisions — European Commission.

Reporting a product problem and reporting service disruption are different processes

A manufacturer may become aware of active exploitation affecting a product. An operator may become aware of a significant incident affecting its service. These events can overlap, but the reporting triggers, responsible parties and information available are different.

For CRA manufacturer reporting, the Commission specifies a 24-hour early warning, a 72-hour notification, and different final-report rules for actively exploited vulnerabilities and severe incidents. The distinction should be preserved in incident procedures rather than reduced to a single generic deadline. CRA Reporting Obligations — European Commission. digital-strategy.ec.europa.eu

Table 5.4 — Reporting clocks that should not be conflated

Reporting context	Initial stage	Subsequent stage	Final-stage rule or qualification
CRA: actively exploited vulnerability	Early warning within 24 hours of awareness	Notification within 72 hours	Final report no later than 14 days after a corrective measure is available
CRA: severe product-security incident	Early warning within 24 hours of awareness	Notification within 72 hours	Final report within one month of the 72-hour notification
Italy’s NIS implementing decree: significant service incident, general process	Pre-notification within 24 hours of awareness	Notification within 72 hours	Final report within one month; ongoing incidents have further reporting provisions
Italy: significant incident affecting trust services	General pre-notification framework applies	Specific 24-hour notification rule	Sector-specific exception must be preserved

Italian provisions: Article 25, Legislative Decree 138/2024 — Gazzetta Ufficiale — October 2024. Organisational applicability and implementation arrangements must be assessed separately from these reporting intervals. gazzettaufficiale.it

For an embedded-connectivity incident, the practical implication is that the operator should not wait for a complete component-level explanation before assessing its own notification obligations. Conversely, a manufacturer’s product notification does not prove that every installation has experienced a reportable operational incident.

Proposed supply-chain powers address a different category of concern

The Commission’s January 2026 cybersecurity package proposes a framework for risks associated with third-country suppliers, including dependencies and foreign interference. Its stated approach considers economic effects and market supply. Those considerations are material because an immediate removal requirement can itself create continuity risks where alternatives are scarce or unqualified. Commission Strengthens EU Cybersecurity Resilience and Capabilities — European Commission — 20 January 2026. ec.europa.eu

For NearLink, the analytical distinction is between a technical defect and a supplier-related dependency. A defect may be corrected through a patch. A dependency may persist after patching if an important function still relies on an organisation that cannot be replaced within an acceptable period.

Neither concern establishes a protocol-wide prohibition. A defensible measure must identify its object: a supplier, component category, operational function, procurement or product implementation. The legal authority and evidentiary burden differ accordingly.

Key judgments. Product conformity, operator resilience and supplier-risk assessment are complementary. The CRA does not create universal third-party testing, an SBOM does not reveal every dependency, and proposed legislation cannot be treated as an already operative power.

What would change the assessment. Final supply-chain legislation, implementing decisions, supervisory practice and product-specific scope determinations would clarify the authorities available for particular implementations.

Open official record. No reviewed instrument establishes a general European NearLink ban or a protocol-wide designation automatically converting every compatible module into a restricted component.

Chapter 6. Four National Exposure Profiles: Italy, France, Germany and the United Kingdom

National exposure cannot be ranked defensibly from the available NearLink deployment evidence. What can be compared is the capacity to identify embedded dependencies, assign responsibility, assess suppliers and execute remediation. Official business surveys and regulatory records reveal material differences in those capacities, although their populations and measures are not identical.

The figures below describe general cybersecurity practices or legal implementation. They are not estimates of NearLink use, Chinese-component penetration or technology-specific compromise.

Italy: procurement accountability meets uneven assessment capacity

Italy’s NIS implementing decree provides a direct legal basis for examining supplier relationships. Article 24 requires proportionate technical, operational and organisational measures and expressly includes supply-chain security, secure acquisition, development and maintenance, vulnerability handling and business continuity. Its supplier assessment provisions refer to specific vulnerabilities and the quality of suppliers’ products and cybersecurity practices. Article 24, Legislative Decree 138/2024 — Gazzetta Ufficiale — October 2024. gazzettaufficiale.it

Article 23 places approval and oversight responsibilities on administrative and management bodies and requires cybersecurity training. The relevance to NearLink is that a consequential dependency cannot be treated exclusively as an engineering detail once it affects service continuity or the organisation’s risk-management obligations. Article 23, Legislative Decree 138/2024 — Gazzetta Ufficiale. gazzettaufficiale.it

The implementation challenge is visible in ISTAT’s business-security data.

Table 6.1 — Italy: selected cybersecurity practices, 2024

Practice	Enterprises with at least 10 persons employed	Enterprises with at least 250 persons employed	Calculated difference
Network access control	62.1%	94.3%	32.2 percentage points
Retention of security logs	44.7%	84.1%	39.4 percentage points
Monitoring suspicious activity	39.0%	85.0%	46.0 percentage points
ICT risk assessment	36.9%	80.6%	43.7 percentage points
ICT security testing	31.8%	78.9%	47.1 percentage points
Encryption of data, documents or email	23.9%	64.8%	40.9 percentage points

Source: Enterprises and ICT, 2024, Figure 4 — ISTAT — January 2025. Differences are calculated from the published rounded percentages. The large-enterprise group is part of the overall population, not a separate small-enterprise comparison group. istat.it

The relevant implication is a capacity gap between adopting security measures and conducting the assessments needed to understand an embedded subsystem. Network access controls cannot answer who maintains a module, whether a firmware change affects equipment qualification or whether a substitute preserves the required operation.

For Italy, the strongest collection point is therefore the equipment manufacturer or integrator that can assemble component-level information for multiple downstream customers. Requiring every small purchaser to reconstruct the same supply chain independently would be expensive and likely inconsistent.

A proportionate national approach would make manufacturers and integrators provide reusable, versioned evidence packages: installed component identity, supported firmware, maintenance escalation and material-change notices. Operators would then assess the evidence against their own service requirements.

France: strong institutions coexist with a pronounced firm-size gradient

INSEE reports that 93% of surveyed French enterprises with at least ten employees used at least one listed information-system security measure in 2024. However, the distribution changes substantially when the measure requires sustained assessment or specialist capability. Digital Security, Figure 3 — INSEE, Digital Economy and Society, 2025 Edition. Insee

Table 6.2 — France: security practices by enterprise size, 2024

Practice	10–19 employees	20–49 employees	50–249 employees	At least 250 employees	All surveyed enterprises
Network access control	62%	77%	88%	97%	71%
Security monitoring	41%	51%	60%	84%	47%
Retention of security logs	30%	43%	61%	81%	39%
Regular information-system risk assessment	23%	33%	48%	69%	30%
Information-system security testing	19%	31%	44%	71%	27%
Encryption of data, documents or email	17%	25%	28%	55%	22%

Source: INSEE’s 2024 enterprise ICT survey, covering mainly market sectors outside agriculture, finance and insurance. Measures are self-reported and do not establish effectiveness.

The operational implication resembles Italy’s but should not be converted into a league table. Enterprise definitions, survey scope and question wording require reconciliation before making precise cross-country comparisons. The defensible finding is that smaller organisations are less likely to report several practices relevant to investigating and monitoring embedded dependencies.

France also requires careful temporal treatment. ANSSI made the Référentiel Cyber France, or ReCyF, available on 17 March 2026, describing it as a working document supporting preparation for NIS2. Its current explanatory page presents the reference as non-mandatory by default and linked to the proposed Resilience legislation. That status should not be converted into an assertion that the complete new national framework is already enforceable. NIS2 Directive and ReCyF — ANSSI. ANSSI

For product security, France’s published CRA framework allocates market surveillance to ANFR, with ANSSI responsible for functions including conformity-body notification, technical support and vulnerability coordination. This creates a potential route from laboratory findings to product-level corrective action, while the relevant implementation dates and procedures remain essential. CRA Regulatory Framework — ANSSI.

The French priority should be to make evidence reusable across product and operational supervision. A finding about an implementation should identify affected versions and functions so that operators can determine whether it changes their own risk assessment.

Germany: staged telecommunications measures show why function matters

Germany’s NIS2 implementation law entered into force on 6 December 2025, according to the BSI’s reporting-portal guidance. The agency directs affected organisations to the BSI portal for registration and reporting, while describing transitional arrangements for established reporting channels. About NIS2 Registration and Reporting — Federal Office for Information Security. mip2.bsi.bund.de

Germany’s telecommunications precedent also provides a more precise lesson than a general account of excluding Chinese equipment. In its November 2025 parliamentary answer, the federal government described agreements requiring replacement of relevant core-network components by the end of 2026 and critical network-management functions in transport and access networks by the end of 2029. These are differentiated functional obligations, not evidence that every Chinese-origin component must disappear on one date. Federal Government Answer, Question 5, Bundestag Document 21/2749 — 12 November 2025. dserver.bundestag.de

Table 6.3 — Germany: verified implementation milestones and their limits

Milestone	Date or period	What the record establishes	Limit on interpretation
Agreements with major mobile operators	July 2024	Government-described arrangements addressing specified telecommunications dependencies	Does not establish a NearLink-specific rule
NIS2 implementation law in force	6 December 2025	National registration and reporting framework operational	Entity scope and applicable duties still require assessment
Replacement of relevant core-network components	By end-2026	Function-specific transition deadline described by government	Deadline is not evidence of completed replacement
Replacement of critical management functions in transport and access networks	By end-2029	A later transition for a different functional layer	Does not imply removal of every component of the same origin

The NearLink implication is that Germany should examine the function exercised by an embedded implementation and the authority required to sustain it. A passive or tightly bounded data exchange presents a different dependency profile from a module whose management functions influence a wider operational installation.

For manufacturing and equipment procurement, a useful policy would require a documented assessment when connectivity becomes part of a consequential control or maintenance function. The assessment should identify whether migration requires changes to the machine, the production process or the qualification evidence. Procurement could then distinguish a tolerable dependency from one whose replacement would be incompatible with the installation’s continuity requirements.

Germany’s available legal milestones do not support a numerical national NearLink exposure estimate. They do support an institutional lesson: restrictions can be differentiated by function and implemented over different periods, provided the regulated object and completion evidence remain clear.

United Kingdom: supplier-review data identify a measurable blind spot

The UK’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, used fieldwork conducted between August and December 2025. Its supplier-risk findings are directly relevant to the visibility problem described in Chapter 4, although they concern general cyber-risk review rather than NearLink. Cyber Security Breaches Survey 2025/2026, Section 3.10 — DSIT and Home Office — April 2026. GOV.UK

Table 6.4 — United Kingdom: formal supplier cyber-risk review, 2025/2026 survey

Business category	Immediate suppliers reviewed	Wider supply chain reviewed
Micro businesses	12%	5%
Small businesses	22%	10%
Medium businesses	30%	13%
Large businesses	48%	24%
Businesses overall	15%	6%

Source: survey Figure 3.13. Business sample: 2,112 respondents. These are self-reported review practices; they do not measure review quality or component-level coverage.

The distinction between immediate suppliers and the wider chain is particularly consequential for embedded connectivity. An organisation may review its service provider while remaining unaware of the module vendor or firmware maintainer beneath it. The survey does not establish that such an omission concerns NearLink, but it demonstrates why supplier-level visibility cannot be presumed.

The UK telecommunications regime supplies a separate, legally concrete precedent. The Huawei Designated Vendor Direction specifies several stages, including core-network restrictions after 31 December 2023, restrictions on defined high-data-rate core transmission equipment after 31 December 2025, and the prohibition on Huawei equipment and services in the addressed providers’ 5G networks after 31 December 2027. Huawei Designated Vendor Direction, paragraphs 5(9)–5(11) — UK Government — October 2022. assets.publishing.service.gov.uk

The associated monitoring direction requires Ofcom to obtain information and report on compliance, including a report requested by 31 March 2028 concerning the 2027 5G requirement. This illustrates a necessary distinction between announcing a transition date and establishing a mechanism to verify it. Monitoring Direction under Section 105Z12 — UK Government. ofcom.org.uk

For connected products, the PSTI consumer regime is narrower. Its requirements address passwords, vulnerability-reporting information and minimum update-period disclosure, subject to scope and exclusions. Certain vehicle categories were excluded by amendments effective in February 2025. It cannot be treated as a complete legal framework for all industrial or automotive NearLink applications. Consumer Connectable Product Security — UK Government. GOV.UK

National coordination should preserve differences while standardising evidence

The four countries face a common information problem but should not be treated as one regulatory jurisdiction. Their immediate opportunities lie in aligning the evidence requested from suppliers, so that firms do not have to reconstruct incompatible documentation for each purchaser.

Table 6.5 — National priorities derived from the verified record

Country	Documented institutional or organisational issue	Proposed priority	Concrete output	Principal constraint
Italy	Supplier-risk duties and management accountability; uneven business assessment capacity	Obtain reusable evidence through manufacturers and integrators	Versioned equipment-to-component and maintenance map	Lower-tier information may be incomplete
France	Firm-size gradient in testing and risk assessment; product and operator supervision have distinct roles	Link implementation findings to affected products and operational uses	Shared vulnerability and configuration evidence	Different supervisory functions need compatible records
Germany	National NIS2 framework and staged, function-specific telecom transitions	Identify the functions that create consequential dependence	Function-level migration and qualification assessment	Replacement may involve wider equipment or process changes
United Kingdom	Limited formal review beyond immediate suppliers	Extend assurance to operationally necessary lower tiers	Relevant sub-supplier and support-chain inventory	Large supplier populations make indiscriminate review impractical

Table 6.6 — A common evidence package without a common exposure score

Evidence field	Why all four countries need it	Appropriate verification
Equipment model and installed revision	Identifies the actual affected population	Procurement and as-built records
Embedded component and firmware	Links product-level issues to installations	Supplier declaration checked against technical records
Enabled operational function	Distinguishes capability from use	Configuration inspection and acceptance documentation
Immediate supplier and responsible maintainer	Identifies the actionable support relationship	Contract and escalation records
Necessary lower-tier dependencies	Reveals correlated maintenance or service risk	Proportionate supplier-chain disclosure
Support end date and scope	Establishes maintenance boundaries	Explicit contractual and product documentation
Material changes since acceptance	Prevents reliance on an obsolete assessment	Change notices and configuration history
Qualified migration route	Establishes practical alternatives	Completed test or documented qualification programme
Consequence of interruption	Connects technical exposure to public or commercial impact	Operator-owned business-impact assessment

The central policy distinction is between collecting information and obtaining assurance. A completed questionnaire is an input. Assurance requires evidence that the relevant declarations correspond to the installed implementation and remain valid as the product changes.

For governments, the highest-value early work is therefore a targeted assessment of consequential functions, supported by reusable evidence and selective technical verification. A broad inventory of every compatible consumer device would produce a large count without necessarily identifying the installations where interruption, maintenance withdrawal or costly replacement could have strategic effects.

Key judgments. Italy and France’s official business data show that specialist assessment practices are substantially less widespread than basic security measures, especially outside larger enterprises. The UK survey documents limited review of wider supply chains. Germany and the UK demonstrate that supplier restrictions require defined functions, transition periods and compliance monitoring. None of these findings establishes a national NearLink penetration rate.

What would change the assessment. Verified inventories of consequential installations, linked to support relationships and demonstrated migration options, would permit country-specific exposure estimates and more precise regulatory choices.

Open official record. Comparable NearLink installed-base figures, operational criticality data and validated replacement costs remain unavailable in the reviewed evidence. National exposure rankings would therefore create a precision the record does not support.

---

PILLAR III — STRATEGIC CHOICES AND THE 2031 OUTLOOK

Chapter 7. Alternative Development Pathways: Competitive Coexistence, Concentrated Dependence and Regulatory Fragmentation

NearLink’s European trajectory will depend less on a single decision to accept or reject the technology than on the cumulative interaction between product integration, maintenance economics, standards development and regulatory implementation. By 2031, competitive coexistence, concentrated dependence and regulatory fragmentation could all exist in different sectors. The relevant forecasting task is to identify the conditions under which adoption preserves choice, the conditions under which it restricts choice, and the observations that distinguish those outcomes.

The assessment does not assign numerical probabilities. A defensible probability model would require a defined European adoption baseline, comparable product-level deployment data and evidence about substitution behaviour. Those inputs are not available in the reviewed record. The pathways below are therefore conditional analytical constructions, not quantified predictions.

Europe already has a policy mechanism for examining the wider supply chain

The NIS Cooperation Group adopted an EU ICT Supply Chain Security Toolbox, published on 13 February 2026. The Commission describes it as horizontal, actor-agnostic and non-binding, with measures addressing critical suppliers, multi-vendor strategies and dependencies. It also announced a review of its application after one year. This provides an existing coordination mechanism for embedded-connectivity risks, although it does not independently create enforceable restrictions. ICT Supply Chain Security: EU Adopts a Toolbox to Mitigate Risks — European Commission — February 2026. Shaping Europe’s digital future

The toolbox matters because NearLink does not need to become a dominant consumer protocol to create a consequential dependency. A narrower deployment could become important if it supports a difficult-to-replace operational function. Conversely, substantial sales could remain compatible with manageable risk where implementation, maintenance and substitution remain competitive.

The Commission published the toolbox alongside coordinated assessments of connected and automated vehicles and detection equipment. These assessments establish that European supply-chain analysis already extends beyond public telecommunications infrastructure. They do not constitute NearLink-specific findings. Toolbox to Improve ICT Supply Chain Security — European Commission — February 2026. Shaping Europe’s digital future

Table 7.1 — Conditional development pathways to 2031

Pathway	Conditions required	Likely commercial behaviour if those conditions hold	Strategic consequence	Observation that would weaken the pathway
Competitive coexistence	Useful implementations, accessible interfaces, qualified alternatives and sustainable maintenance	Manufacturers adopt NearLink selectively while retaining other implementation options	Adoption expands without a corresponding loss of operational choice	Essential functions become tied to an unavailable or irreplaceable implementation
Concentrated dependence	Integration deepens around a narrow maintenance or software base; migration remains untested	Buyers continue purchasing compatible products because switching disrupts applications or qualification	Commercial convenience becomes a constraint on future decisions	Independent maintenance and successful migration become routine
Regulatory fragmentation	Authorities and purchasers require materially different evidence or impose incompatible conditions	Manufacturers maintain separate product configurations, assessment packages or support arrangements	Compliance costs increase and cross-border deployment becomes harder	Authorities accept common evidence and explain local exceptions
Mixed sectoral outcome	Different operational requirements and supplier structures persist	Consumer products, industrial equipment and sensitive systems follow different adoption patterns	A single European market-share figure becomes a poor measure of strategic risk	Comparable evidence shows similar dependence mechanisms across sectors

These pathways are not mutually exclusive. They should not be added together or assigned percentages without a suitable forecasting model.

Competitive coexistence requires interoperability that supports substitution

The first pathway would emerge if NearLink becomes a useful additional implementation option while applications remain portable. Commercial adoption could then improve competition by giving manufacturers another way to meet a defined requirement.

The decisive condition is that interoperability works in both directions. It must enable entry into existing systems and preserve the possibility of leaving the selected implementation. A gateway that connects two environments can simplify adoption without making their components interchangeable. Likewise, an application can retain familiar interfaces while depending on a particular lower-layer software package.

Under this pathway, buyers would be able to demonstrate that an alternative preserves the required function, rather than merely showing that it can establish a connection. Maintenance organisations would have access to sufficient documentation and supported tools, while product revisions would remain traceable to their security evidence.

The implication for Europe would be commercially constructive. Firms could use useful innovation without surrendering control over future architecture. Public policy would concentrate on evidence quality, market access and operational assurance, with targeted restrictions where particular implementations fail the relevant tests.

Concentrated dependence can develop without exclusive protocol use

The second pathway does not require NearLink to replace every competing connection. Dependence could arise where a product supports several protocols but one required function works only through a particular stack, credential arrangement or maintenance channel.

The concentration could also be difficult to observe from supplier counts. Several brands might depend on common software or technical support. A buyer could diversify its immediate contracts while retaining a shared lower-tier point of failure.

ENISA’s 2025 NIS investment study illustrates the broader environment in which such dependencies could develop. Its survey covered 1,080 organisations, with 83% large enterprises and 17% SMEs, across EU sectors of high criticality. The findings are not NearLink measurements and should not be treated as representative of all European businesses. NIS Investments 2025, Methodology and Findings — ENISA — December 2025. enisa.europa.eu

Table 7.2 — Selected findings from ENISA’s 2025 critical-sector survey

Indicator	Reported result	Relevance to the outlook
Specific third-party or supply-chain controls	90%	Formal safeguards are widespread in this sample
Suppliers required to meet standards or maintain certifications	63%	Certification is a common assurance mechanism
Supplier assessments or audits	54%	Direct examination is less widespread
Cybersecurity requirements in supplier contracts	48%	Contractual coverage remains incomplete
No cybersecurity assessment in the previous year	30%	Important operational blind spots can persist
More than three months to apply critical patches	28%	Remediation can lag behind available corrections
Supply-chain management identified as a difficult NIS2 requirement	37%	Implementation remains demanding

Self-reported organisational findings. These percentages describe different questions and must not be combined into a single maturity score.

The lesson for the scenario is that formal controls can coexist with operational dependence. A certificate, supplier assessment or contract clause may be valuable without resolving the time required to diagnose, correct and deploy a repair.

If NearLink adoption expands within that environment, dependence would be most likely to deepen where organisations evaluate the original purchase more rigorously than subsequent maintenance. Continued use could become the least disruptive short-term option even as the cost of eventual replacement increases.

Fragmentation could make security more expensive without making it more effective

The third pathway would arise if European jurisdictions or major purchasers demand different documentation structures, interpret the same assessment evidence inconsistently or require duplicate testing without explaining its purpose.

Some variation is necessary. A hospital, a vehicle manufacturer and a municipal infrastructure operator do not have identical operational requirements. Fragmentation becomes counterproductive when differences concern evidence format or repeated assessment of the same unchanged property, rather than a material difference in use.

Under that condition, larger manufacturers could absorb the cost of maintaining multiple compliance configurations more easily than smaller firms. An intended diversification policy could therefore narrow the supplier pool. Separate firmware branches and deployment configurations might also make maintenance more complex.

This is a conditional mechanism, not a finding that NearLink has already caused such fragmentation. Its early indicators would be duplicated assessment requests, inconsistent treatment of equivalent evidence and product variations created solely to satisfy incompatible purchasing requirements.

A more coherent approach would distinguish a reusable technical core from application-specific assessment. The former could identify the implementation and establish tested properties. The latter would determine whether those properties are adequate for a particular function.

Table 7.3 — Variables distinguishing coexistence from dependence

Variable	Pattern consistent with competitive coexistence	Pattern consistent with concentrated dependence	Evidence needed
Application portability	Required functions survive implementation changes	Migration removes required functions or requires major redesign	Completed migration test
Maintenance capability	Several capable organisations can sustain the implementation	One indispensable organisation controls correction	Supported maintenance arrangements
Supplier diversity	Alternatives have materially independent dependencies	Different brands share the same maintenance bottleneck	Dependency mapping below immediate suppliers
Qualification	Replacement evidence is reusable and achievable	Qualification must be reconstructed at prohibitive cost	Alternative implementation assessment
Product evolution	Revisions preserve documented interfaces and security properties	Updates progressively narrow compatibility	Version and change records
Regulatory treatment	Common evidence is accepted with justified exceptions	Unchanged properties are repeatedly assessed differently	Procurement and supervisory decisions

The sequencing of decisions will shape the outcome

The period to 2031 contains several different decision windows. These should be treated as planning horizons rather than predictions about when a market threshold will be reached.

In the first window, buyers can still influence specifications and documentation. In the next, production deployments generate evidence about maintenance, reliability and interoperability. Later, accumulated installations make migration planning more consequential.

The public-policy objective is to collect the right evidence before procurement volume becomes a substitute for assessment. Waiting for a large installed base would make the measurement easier while potentially making corrective action more expensive.

Table 7.4 — Proposed analytical horizons

Horizon	Main question	Evidence that should accumulate	Decision enabled
Late 2026–2027	Which implementations support consequential functions?	Product identity, enabled functions and accountable support chains	Define a bounded assessment population
2028–2029	Do declared safeguards work through product revisions and incidents?	Remediation records, change histories and independent tests	Confirm or revise acceptance conditions
2030–2031	Has operational choice remained practical as deployments mature?	Migration exercises, qualified alternatives and lifecycle costs	Sustain adoption, diversify or replace

Key judgments. Competitive coexistence is achievable if interoperability preserves substitution and maintenance remains sustainable. Concentrated dependence can develop within a multi-protocol product market. Regulatory fragmentation would be most damaging where duplicate compliance costs reduce the number of viable suppliers.

What would change the assessment. Evidence of independent maintenance, production-scale migration and common acceptance of technical evidence would strengthen the coexistence pathway. Repeated failures to obtain corrections or replace important implementations would strengthen the dependence pathway.

Open official record. The principal forecasting gap remains the absence of a verified European baseline linking active NearLink functions to support dependencies and qualified alternatives.

Chapter 8. Preserving European Options: Testing Capacity, Diversification and Standards Participation

Europe should invest first in capabilities that improve decisions across several possible futures: identifying consequential implementations, verifying their behaviour, sustaining maintenance and qualifying alternatives. These measures retain value whether NearLink becomes widely adopted, remains concentrated in specialist uses or develops differently across sectors.

The purpose is to preserve effective choice. That requires more than restricting one supplier, promoting one alternative or collecting a larger inventory. It requires enough technical and commercial capacity to act on the information collected.

Testing capacity should be organised around questions that purchasing documents cannot resolve

A useful European testing programme would separate four functions: implementation characterisation, security evaluation, operational validation and migration assessment. Combining them under an undifferentiated certification label would obscure what has actually been established.

The European cybersecurity certification framework already provides a basis for specifying product categories, requirements, evaluation methods and assurance levels. EUCC became applicable on 27 February 2025 and operates across the EU on a voluntary basis under that framework. This is an existing institutional resource, not a NearLink-specific approval mechanism. EU Cybersecurity Certification Framework — European Commission. Shaping Europe’s digital future

For embedded connectivity, the relevant policy question is whether laboratories and assessors can examine the implementations that buyers actually use. General certification capacity does not automatically provide expertise in a particular firmware stack, diagnostic interface or operational application.

Table 8.1 — Distinct testing functions and their outputs

Testing function	Question answered	Required output	Principal boundary
Implementation characterisation	What is present and enabled?	Identified hardware, firmware, interfaces and services	Does not establish resistance to attack
Security evaluation	Do defined protections withstand specified tests?	Findings linked to test methods and configuration	Applies within the evaluated scope
Operational validation	Does the implementation satisfy the intended function?	Evidence against timing, reliability and recovery requirements	Does not automatically establish supplier independence
Migration assessment	Can an alternative preserve the required service?	Tested transition procedure and residual limitations	Valid only for the evaluated alternative
Revision assessment	What changed and which earlier findings remain valid?	Change-impact analysis and required retesting	Depends on accurate revision information
Incident reproduction	Can an observed problem be reproduced and bounded?	Affected configurations, mechanism and remediation evidence	Reproduction may not establish the full incident population

A coordinated programme should encourage reproducible methods and comparison of results between laboratories. Where assessors reach different conclusions, the discrepancy should be investigated through configuration, test conditions and interpretation before it is attributed to a fundamental technology problem.

Shared methods would also reduce the burden on smaller suppliers. A manufacturer should be able to reuse valid evidence about an unchanged implementation while supplying additional evidence for a new application.

Diversification should be measured through independent recovery routes

A multi-vendor procurement strategy can reduce exposure, but only if the alternatives do not reproduce the same critical dependency. The objective should be diversity in the capabilities needed to sustain a function.

There are several possible routes. A buyer may qualify a different component using the same protocol, an alternative protocol preserving the application, or a different system architecture. It may also establish a second maintenance route for the existing implementation. These measures address different failure modes and should not be counted as equivalent.

Table 8.2 — Diversification strategies and the dependence each addresses

Strategy	Dependency reduced	Evidence of meaningful diversification	Residual weakness
Alternative component, same protocol	Particular hardware supplier	Required function works on independently supported hardware	Shared firmware or standards dependency may remain
Independent software implementation	Particular stack or maintenance base	Alternative can be built, maintained and deployed	Hardware qualification may still constrain migration
Alternative protocol	Protocol-specific integration	Application requirements remain satisfied	New integration and qualification costs
Alternative maintenance provider	Single support organisation	Provider can diagnose and deliver authorised corrections	Lower-layer proprietary dependencies may remain
Alternative architecture	Concentration in the original system design	Required service survives a different technical arrangement	Larger transition burden
Operational fallback	Immediate service interruption	Tested degraded or manual operating mode	May sustain only limited functionality

Diversification also has costs. Maintaining several implementations can increase training, testing and configuration-management requirements. The appropriate choice depends on the consequence of disruption and the independence actually achieved.

A second supplier should therefore be treated as an operational capability to be verified, rather than a procurement statistic. The relevant question is whether that supplier can take over the required function under the disruption scenario being considered.

Financial support can make assessment accessible without creating a NearLink subsidy programme

The Commission identifies testing, conformity assessment, training and technical assistance among the ways Member States may support smaller manufacturers implementing the CRA. It also lists Digital Europe projects providing related financial and technical support. CRA: Microenterprises and Small and Medium-Sized Enterprises — European Commission — updated July 2026. Shaping Europe’s digital future

A concrete example is the SECURE second open call, whose published window runs from 1 October to 11 December 2026. Its terms provide an estimated €11.5 million call budget and grants of up to €30,000, co-financing 50% of eligible project costs. These are announced funding conditions, not awarded expenditure or an entitlement for a particular applicant. Second SECURE Open Call — SECURE Project — 2026. secure4sme.eu

Table 8.3 — Selected SECURE second-call terms

Parameter	Published condition	Interpretation
Estimated call budget	€11.5 million	Available programme envelope, subject to the published arrangements
Maximum grant	€30,000 per project	Ceiling rather than guaranteed award
Co-financing rate	50%	Remaining eligible expenditure requires other financing
Eligible expenditure corresponding to the full grant ceiling	€60,000	The guidelines state that the grant remains capped above this level
Maximum project duration	180 calendar days	Limit in the application guidelines
Application window	1 October–11 December 2026	Published second-call period

Sources: Call page and Application Guidelines, sections 1.1–1.3. Applicability depends on the full eligibility and evaluation rules.

The call’s eligible-activity document includes vulnerability testing, laboratory testing, penetration testing, supply-chain assessment and product-continuity work. This demonstrates a potential route for financing bounded assurance projects. It does not establish that every proposed NearLink assessment or every entity discussed in this report would qualify. CRA Scope and Eligible Activities, Chapter 2 — SECURE Project — Second Call. Call2

The policy lesson is that support can be directed towards outputs that remain useful after the funding ends: reproducible tests, usable component records, maintenance procedures and qualified alternatives. Funding documentation alone would not provide the same enduring capability.

Standards participation should produce technical influence

European participation is most valuable before specifications and test procedures become difficult to change. Attendance without a defined contribution provides information but limited influence.

The Commission’s High-Level Forum has identified resource shortages as an obstacle to effective European participation in international standardisation and published recommendations on funding. CEN-CENELEC’s account of the Forum’s March 2026 meeting identifies workstreams addressing global standards, skills and dual-use technologies. These mechanisms provide institutional channels through which embedded-connectivity concerns could be examined. High-Level Forum on European Standardisation — European Commission; Fourth High-Level Forum Meeting — CEN-CENELEC — March 2026. single-market-economy.ec.europa.eu

A productive participation programme would assign specialists to specific deliverables. It would track whether contributions improve testability, portability, security requirements or implementation access. The number of meetings attended would be a weak proxy for any of those outcomes.

Table 8.4 — Standards objectives and evidence of achievement

Objective	Technical contribution	Evidence of achievement	Limitation to recognise
Improve testability	Clear conditions and reproducible test procedures	Adopted text and successful cross-laboratory reproduction	Publication does not ensure implementation
Preserve portability	Defined interfaces and behaviour across implementations	Cross-vendor application tests	Optional features can still constrain migration
Clarify security profiles	Explicit requirements for the intended application	Unambiguous conformance criteria	Correct configuration remains necessary
Support lifecycle maintenance	Versioning and change-impact requirements	Traceable revisions and assessment updates	Supplier execution still matters
Improve transparency	Accessible implementation and licensing information	Usable documentation and applicable terms	Document access alone does not confer maintenance rights
Enable smaller firms to participate	Supported expert contributions	Contributions reaching relevant working groups and deliverables	Funding cannot substitute for technical competence

Policy options should specify authority, burden and reversibility

The following options are recommendations, not claims about measures already adopted specifically for NearLink. Their sequence reflects the need to establish evidence before imposing costly changes.

Table 8.5 — Courses of action

Option	Responsible actor or authority	Intended effect	Implementation burden	Indicative planning horizon
Targeted exposure assessment	Sector authorities and operators within their mandates	Identify consequential active implementations	Technical inventory and supplier engagement	Initial six-month programme
Shared evidence specification	Public purchasers, industry and technical bodies	Reduce inconsistent disclosure requests	Agreement on scope, versions and confidential information	Six to twelve months
Independent testing programme	Laboratories, manufacturers and commissioning bodies	Establish implementation behaviour	Expertise, equipment and access to representative products	Phased over twelve months
Qualification of alternatives	Operators and equipment manufacturers	Create a practical migration route	Engineering, testing and operational validation	Product-dependent; begin before expansion
Maintenance-continuity arrangements	Buyers and responsible suppliers	Preserve support through commercial disruption	Contract negotiation and technical preparation	At award and major renewal
Standards contribution programme	National bodies, companies, researchers and EU coordination mechanisms	Improve future specifications and tests	Sustained specialist participation	Continuing through 2031
Targeted deployment restrictions	Competent authorities under applicable law; purchasers within lawful discretion	Contain a demonstrated unacceptable exposure	Legal justification, alternatives and continuity planning	Triggered by evidence
Supplier or system replacement	Operators under applicable obligations or risk decisions	Remove an unresolved consequential dependency	Potentially substantial engineering and transition costs	Determined by validated migration needs

Planning horizons are proposed programme targets, not forecasts or statutory deadlines.

Table 8.6 — Reversibility and principal downside

Option	Reversibility	Principal downside	Condition for proceeding
Exposure assessment	High	Administrative work without actionable findings	Define consequential functions and evidence needs first
Shared disclosure	High	Excessive information demands or disclosure of sensitive details	Limit collection to a justified purpose
Independent testing	High	Duplicate tests or findings detached from production configurations	Identify tested versions and intended uses
Alternative qualification	Moderate	Cost of supporting an unused alternative	Demonstrate a material continuity benefit
Maintenance arrangements	Moderate	Rights that cannot be exercised technically	Verify the underlying capability
Standards participation	High	Sustained effort with little effect on final text	Assign concrete contributions and review outcomes
Targeted restriction	Variable	Reduced competition or avoidable service disruption	Establish authority, exposure and proportionate mitigation
Replacement	Low after execution	Stranded assets and interruption	Validate the alternative and transition before withdrawal

A stronger intervention is not automatically a better intervention. The appropriate response is the least burdensome measure that reliably addresses the demonstrated consequence. Where evidence establishes that a critical function cannot be sustained, stronger restrictions may be justified; where the issue is incomplete documentation, the first requirement should be to resolve that gap.

Key judgments. Testing, qualified alternatives and maintainable implementations are durable capabilities. Financial support can help smaller manufacturers produce them. Standards participation should be evaluated through technical outcomes. Restrictions require an identified exposure and a workable continuity plan.

What would change the assessment. Evidence that voluntary or contractual measures repeatedly fail would strengthen the case for more prescriptive intervention. Demonstrated independent maintenance and substitution would support continued adoption under proportionate conditions.

Open official record. The reviewed sources do not establish the quantity, specialisation or geographic distribution of laboratory capacity available specifically for production NearLink implementations.

Chapter 9. Indicators and Net Assessment: Thresholds, Evidence Gaps and Decisions

The decisive indicator of strategic dependence is an inability to sustain an important function through a credible disruption, despite nominal ownership of the equipment. Shipment totals, membership counts and compatible-device lists may describe ecosystem development, but they cannot independently establish that condition.

Europe therefore needs a monitoring system that connects installed functions, accountable organisations and demonstrated recovery options. Its purpose should be to support decisions, not to generate a single composite score whose precision exceeds the evidence.

Define the assessment population before calculating percentages

The denominator should be a documented set of relevant assets or functions. Mixing consumer devices, evaluation boards and operational controllers would produce a count with little strategic meaning.

An asset inventory and a function inventory answer different questions. Several devices may support one function; one gateway may support several functions. Counting equipment without recording those relationships can either exaggerate or conceal concentration.

A suitable register should therefore preserve the relationship between the asset, its enabled function, the service it supports and the organisations necessary for maintenance. It should also identify the date and scope of verification.

Table 9.1 — Definitions for a NearLink exposure register

Term	Operational definition	Counting rule
Compatible asset	Equipment declared capable of NearLink operation	Do not count as active use without further evidence
Active implementation	Installed configuration in which the relevant capability is enabled and used	Record hardware and firmware revision
Consequential function	Function whose interruption exceeds the operator’s defined tolerance or affects a material safety/security requirement	Record the operator-owned justification
Maintenance dependency	Organisation or resource necessary to diagnose, correct or deploy a required change	Distinguish immediate contractor from lower-tier maintainer
Qualified alternative	Tested implementation preserving the defined requirements	Catalogue availability is insufficient
Verified fallback	Tested arrangement sustaining an acceptable degraded service	Record duration and limitations
Unresolved record	Asset or function whose relevant attributes remain unverified	Preserve as unknown rather than assigning zero exposure

Metrics should reveal uncertainty rather than conceal it

The following indicators are proposed measurement definitions. No current European values are assigned because the necessary installed-base data are unavailable.

Table 9.2 — Proposed operational indicators

Indicator	Numerator or measured quantity	Denominator or comparison	Unit	Interpretation
Implementation visibility	Active implementations with verified hardware and firmware	Active implementations in the assessed population	Percentage	Coverage of technical identification
Function mapping	Active implementations linked to documented operational functions	Active implementations in scope	Percentage	Whether technical presence is connected to consequence
Support accountability	Consequential functions with identified maintenance responsibility	Consequential functions using the implementation	Percentage	Visibility of the support chain
Maintenance horizon alignment	Functions supported throughout their planned operating period	Consequential functions in scope	Percentage	Exposure to premature support expiry
Alternative qualification	Functions with a qualified replacement	Consequential functions in scope	Percentage	Practical substitution coverage
Fallback coverage	Functions with a verified acceptable fallback	Consequential functions in scope	Percentage	Continuity under disruption
Remediation time	Elapsed time from confirmed applicability to validated mitigation	Report distribution across relevant cases	Calendar days	Ability to translate information into action
Evidence age	Time since the implementation was last verified	Report by asset or function category	Calendar days	Risk of relying on stale records
Unresolved exposure	Records lacking a necessary assessment attribute	Relevant records in scope	Percentage	Explicit uncertainty
Shared maintenance concentration	Consequential functions requiring the same maintenance authority	Consequential functions assessed	Percentage	Common support dependency
Migration duration	Validated time to introduce the qualified alternative	Compare with the function’s continuity requirement	Calendar days and outage hours separately	Feasibility of replacement
Change-assessment coverage	Material revisions assessed before operational acceptance	Material revisions introduced	Percentage	Whether assurance survives product evolution

These indicators should not be mechanically combined. A high identification rate cannot compensate for an absent recovery route. A low device count cannot make a severe operational consequence unimportant.

A particularly useful report would show both the measured value and the underlying evidence quality. Where data are incomplete, the reader should be able to distinguish a bounded assessed population from an unsupported estimate of the entire sector.

Decision thresholds should follow consequences

Universal numerical cut-offs would be premature. The same percentage of dependent devices can have different implications in two installations because the functions, redundancy and replacement conditions differ.

Thresholds should instead connect an observation to a decision. A missing record may justify further investigation. A demonstrated inability to restore an important function may justify restricting expansion. Evidence of a serious exploitable failure may require immediate containment under the applicable operational and legal framework.

Table 9.3 — Proposed evidence-to-decision thresholds

Observation	Interpretation	Immediate decision	Further evidence required
Important deployed function has no identified maintainer	Accountability gap	Suspend expansion of that implementation pending clarification	Responsible organisation and support capability
Supplier cannot map an issue to affected installed revisions	Remediation population is uncertain	Require identification and interim containment assessment	Verified affected-asset list
Required correction cannot be authorised or installed	Maintenance route is ineffective	Activate continuity arrangements and assess restriction	Tested repair or migration route
Alternative fails a mandatory operational requirement	Substitution is not yet qualified	Do not represent the alternative as operational redundancy	Revised implementation and successful validation
Multiple suppliers depend on one indispensable lower tier	Apparent diversification is correlated	Reassess the common disruption scenario	Independent support or replacement capability
Material update changes previously assessed behaviour	Earlier assurance may no longer apply	Conduct change-impact assessment	Findings covering the new configuration
Credible exploit affects a consequential enabled function	Technical issue may create immediate operational risk	Contain according to the incident process	Applicability, mechanism and validated mitigation
National requirements demand duplicate tests of unchanged properties	Possible regulatory inefficiency	Seek reuse or explanation of the additional requirement	Documented difference in scope or use
Independent migration preserves required service	Operational choice is demonstrated	Reassess restrictions and contingency requirements	Continued validity as products evolve

These are analytical decision rules. They do not replace statutory thresholds, safety requirements or incident procedures.

Monitor the response system as well as the technology

A dependency assessment can become obsolete even when the product does not change. The laboratory may lose expertise, the maintainer may be acquired, the alternative may leave production or the operator may extend the equipment’s planned life.

The monitoring framework should therefore track whether Europe retains the capability to act. This includes the availability of specialist assessment, the usability of evidence and the continuity of technical participation.

Table 9.4 — Indicators of European response capacity

Capacity	Evidence of strengthening	Evidence of deterioration	Policy implication
Technical assessment	Reproducible findings across competent laboratories	Long delays or incompatible results without resolution	Expand specialist capacity and method comparison
Maintenance	Supported fixes reach affected installations	Corrections remain blocked below the immediate supplier	Address the maintenance dependency
Diversification	Alternatives survive qualification and migration	Backup suppliers share indispensable dependencies	Reassess effective independence
Evidence reuse	Valid unchanged findings accepted across purchasers	Repeated reassessment without a material scope difference	Improve coordination
SME participation	Smaller firms can access testing and contribute evidence	Assurance costs exclude otherwise viable suppliers	Target support at reusable capabilities
Standards influence	Technical contributions improve adopted requirements	Participation produces little usable output	Reallocate effort towards defined deliverables
Supervisory action	Decisions identify affected functions and tested remedies	Broad measures lack implementation evidence	Improve proportionality and enforceability
Operational recovery	Exercises demonstrate acceptable continuity	Plans remain untested or depend on unavailable resources	Treat recovery as an unresolved capability

Collection priorities should be ranked by their effect on decisions

The highest-priority gap is not necessarily the largest missing dataset. It is the missing observation that could change an acceptance, containment or investment decision.

A European consumer shipment estimate would improve market understanding, but a verified finding that an important installation lacks a maintenance route could be more immediately consequential. Collection should therefore proceed from critical functions outward, while retaining broader market observation.

Table 9.5 — Priority collection programme

Priority	Evidence gap	Collection target	Decision changed by the result
Immediate	Consequential active uses	Operators, equipment manufacturers and as-built records	Which implementations require focused assessment
Immediate	Ability to deliver authorised remediation	Maintainers and responsible suppliers	Whether continued operation is supportable
Immediate	Common lower-tier dependencies	Relevant supplier chains	Whether nominal diversification is effective
Next stage	Qualified alternatives	Manufacturers, laboratories and operators	Whether migration is feasible
Next stage	Actual transition burden	Completed exercises and deployment planning	Timing and cost of corrective action
Continuing	Product and standards evolution	Version records and technical committees	Whether earlier findings remain valid
Continuing	Market penetration	Product declarations and representative surveys	Scale and sector distribution
Continuing	Regulatory consistency	Supervisory and procurement decisions	Where coordination could reduce unnecessary duplication

Confidence should be attached to individual judgments

The public record supports different levels of confidence for different propositions. It does not justify transferring confidence from a well-documented standard or product feature to a poorly measured deployment claim.

Table 9.6 — Final judgment and confidence

Judgment	Confidence	Basis	Principal limitation
NearLink has an organised technical and industrial development base	High	Official standards records, development documentation and named implementation resources examined in Pillar I	Does not establish equivalent maturity across products
European mechanisms can already support structured supply-chain assessment	High	Published toolbox, certification framework and support programmes	Capability and enforcement remain implementation-dependent
Formal supplier controls do not by themselves establish operational resilience	High	Distinction between documentary controls and tested recovery; supporting organisational evidence	Product-specific performance still requires examination
NearLink could create concentrated dependence in selected important functions	Moderate	Identifiable integration and maintenance mechanisms	European deployment and substitution evidence remain incomplete
Competitive coexistence is feasible	Moderate	Several diversification routes are technically and institutionally conceivable	Their production effectiveness must be demonstrated
Europe is already systemically dependent on NearLink	Not established	No sufficient installed-base and consequence dataset	Requires evidence beyond global ecosystem scale
NearLink adoption will produce a specific European market share by 2031	Not supportable quantitatively	No adequate baseline or forecasting model	Numerical precision would be artificial

Final net assessment

NearLink should be treated as an emerging test of Europe’s ability to govern embedded connectivity before integration decisions narrow its room for manoeuvre. The technology’s development creates a credible strategic question, but the available evidence does not establish an existing Europe-wide dependency or justify treating every compatible product as equivalent.

The most important distinction is between technological participation and loss of operational choice. European firms can participate in an ecosystem while retaining control over applications, maintenance and migration. Exposure becomes strategically consequential when an important function cannot be sustained or replaced within its operational requirements.

Europe’s response should therefore combine three commitments. It should obtain implementation-level evidence for consequential uses, maintain the technical capacity to verify and act on that evidence, and qualify alternatives before withdrawal or disruption makes them urgent. These commitments remain useful across all three principal pathways: coexistence, concentration and fragmentation.

The net judgment is that Europe retains an opportunity to shape the conditions of adoption. Its strongest position in 2031 would be one in which buyers can use NearLink where it meets their requirements, authorities can identify and constrain unacceptable implementations, and neither commercial integration nor regulatory inconsistency prevents a tested transition when circumstances change.

---

Copyright of debuglies.com – Even partial reproduction of the contents is not permitted without prior authorization Reproduction reserved