The German government is set to get new powers to bar risky Chinese technology suppliers from its critical infrastructure.

Lawmakers in the federal Bundestag parliament on Thursday approved legislation that would give new tools to the Interior Ministry to ban the use of components from specific manufacturers in critical sectors over cybersecurity risks. The measures resemble what European countries have done in the telecom sector, but the new German bill applies to a much wider range of sectors, including energy, transport and health care.

The law comes as German Chancellor Friedrich Merz on Thursday signaled a tougher stance against Chinese tech giant Huawei, telling a business conference in Berlin that he “won’t allow any components from China in the 6G network.” Merz is set to discuss the issue at a major digital sovereignty summit co-hosted by Germany and France next week.

The fresh scrutiny for supply chain security in the EU’s largest economy — a manufacturing powerhouse with a complex relationship with China — comes at a time when the European Union is considering how best to tackle cyber risks in supply chains dominated by Chinese firms.

Governments are looking beyond the telecom sector, pushing for action in areas such as solar power and connected cars. European cybersecurity officials are finalizing an ICT Supply Chain Toolbox to help governments mitigate the risks, and the European Commission is preparing an overhaul of its Cybersecurity Act to address the issue, expected in January.

The German legislation implements the EU’s NIS2 Directive, a critical infrastructure cybersecurity law. The Bundesrat, Germany’s upper legislative chamber, still has to sign off on the bill, which is expected next Friday.

The key question is whether Germany is willing to use its powers, said Noah Barkin, a senior advisor at Rhodium Group, a think tank. On telecoms, “this helps lay the groundwork for pushing Huawei out of the 5G network, but it doesn’t guarantee that the political will will be there to take that decision,” he said. 

The Interior Ministry could already block telecom operators from using particular components under an existing German IT security law. The law’s 2021 revision was widely seen as an attempt to get Chinese firms like Huawei and ZTE out of telecom network due to fears of cybersecurity and security risks. The Interior Ministry intervened in 2024, but it has never formally blocked the use of specific components under that law.

For its new cyber law, the government originally proposed to extend the measures applying to the telecom industry to the electricity sector as well. But parliament’s version now applies to all critical sectors, which under the EU’s NIS2 law includes areas such as transport, health care and digital infrastructure. 

German center-left lawmaker Johannes Schätzl, the digital policy spokesperson for the SPD, said this is a “logical step, because cyber and hybrid threats do not stop at sectoral boundaries.”

The Interior Ministry will be required to consult with other arms of government when considering bans or blocks of certain suppliers, the bill said. In the past, some ministries like the digital and economy departments have been more reluctant to banning Chinese components, in part due to fears of economic retaliation from Beijing.

Industry, too, could resist the new measures. German technology trade association Bitkom on Thursday said that the new rules could be unpredictable and therefore “detrimental.”