The EC's proposed changes to the Cybersecurity Act, which has surprised some, centre around the removal of network equipment from high-risk vendors, a process that will come with significant costs. We assess the review and analyse the potential implications for affected operators.