In June 2025, a Chinese state-owned utility put out a tender covering the replacement of the control systems for 67 wind turbines at the Kangbao wind farm in Hebei. The turbines were not broken or outdated. The problem was their controllers, which were imported from Europe. The tender warned not only of high costs and long procurement cycles, but also of a risk of being “controlled by foreign forces”. The prescribed solution was replacement with domestically produced technology.
The Kangbao case is not unusual. A new study by the Centre for Eastern Studies (OSW) of the Chinese wind sector analysed more than 1,600 publicly available procurement documents and found nearly 300 calling for foreign equipment to be replaced. European manufacturers and component suppliers are among those named in the notices as risks to be removed.
The analysis shows that Beijing’s drive to make its energy infrastructure “self-reliant, safe and controllable” is security-focused and discriminates against foreign suppliers, including European ones. And while European suppliers are written out of Chinese critical energy infrastructure, Chinese companies push for expansion in Europe.
It is widely known that China’s leadership under Xi Jinping strives for China to be less reliant on technology imports, especially in critical infrastructure. OSW’s findings describe how this is being done and how European firms are affected. They show a coordinated effort, more than a decade in the making, to identify foreign technological dependencies that could become vulnerabilities, build domestic alternatives and gradually remove the foreign technology itself.
The findings should reassure Europeans already moving towards a more restrictive approach. Reciprocity used to mean asking Beijing to open its market, follow rules and stop discriminating. This notion no longer fits the reality. Europeans need to re-evaluate their understanding of security in critical infrastructure, and to shift what they mean by “reciprocity”: not waiting for China to match Europe’s openness, but matching China’s protective measures.
China’s path to technological self-reliance and control
The OSW research shows that as early as 2012 Chinese State Council documents warned that core information technologies depended on other countries. The 2015 National Security Law made the development of “self-reliant and controllable” critical technologies a national-security objective. In 2016, Xi Jinping described having core technologies controlled by others as China’s “greatest hidden danger”.
What followed was a three-stage process: creating alternatives, ensuring demand and replacing vulnerabilities. The 14th Five-Year Plan called for manufacturing to become “self-reliant and controllable, safe and efficient”. The 15th Five-Year Plan extended this into industrial-control software, precision bearings, motors, control systems and energy equipment—all areas where European companies retain important capabilities.
At the same time, Beijing has understood that diversification away from non-Chinese inputs could not just be ordered. Someone had to buy the alternatives to ensure the investments were worthwhile. Regulation securing that demand followed: operators were required to prioritise “secure and trustworthy” products; acceptable technologies for electricity systems were set out in official whitelists; and state-owned enterprises were obliged to support indigenous technological innovation.
The last stage is across-the-board substitution, and the OSW study shows the concrete manifestation of this in the energy sector. Since 2022, major state-owned energy utilities have translated the policy approach into their own procurement requirements. Their objections to imported systems are partly practical—poor reliability, slow spare-part delivery—and partly political: not “secure and controllable” and vulnerable to control by “foreign forces”.
In the wind sector, the campaign focuses on systems used to operate and control power assets. The technologies being targeted point to perceived risks of remote disruption and loss of control over power generation stemming from foreign presence in software, databases and other connected elements of critical infrastructure.
Use China’s risk map to identify Europe’s vulnerabilities
The EU should treat China’s localisation agenda as a guide to how Beijing assesses strategic risk. China does not seek to localise every technology at once. Instead, it sets short- and long-term localisation objectives, and concentrates resources on selected capabilities and parts of the technological stack. Those choices therefore offer a window into which dependencies Beijing considers most dangerous. It is a playbook from which the EU can take inspiration as it weighs its own trade-offs—which dependencies are worth the cost of removing and which are not.
The useful lesson is in the prioritisation: where Beijing is prepared to accept foreign dependence, where it seeks to reduce it and where it is willing to spend heavily to eliminate it. The Chinese leadership’s focus on the threat of remote disruption and loss of control to foreign actors over power generation points, in reverse, at the strategic vulnerability that Chinese technologies with remote access create in Europe.
When Beijing judges a technology sensitive enough to demand domestic control, European authorities should ask themselves what vulnerability it is seeking to close and whether Europe faces an equivalent exposure through Chinese suppliers. Europe should pay as much attention to what Chinese companies are eliminating from their own critical systems as to what Beijing wants to sell abroad.
Decide on high-risk suppliers at EU level
Designating high-risk suppliers and third countries, and imposing mitigation measures, should sit at the EU level. Information and communications technology (ICT) risks cross national borders. In energy, disruption to grid infrastructure or generation assets can have cascading effects beyond the country where it originates, as the 2025 Iberian blackout demonstrated. EU-level mitigation measures close the loophole that fragmented implementation creates: a supplier judged to pose an unacceptable security risk in one member state must not be able to simply shift its business to another.
EU-level designations also take the political pressure off individual member states. The 5G Toolbox, the European Commission’s non-binding framework for mitigating cyber-security risks in telecommunications infrastructure, is the lesson in what happens otherwise. Five years after its adoption, only 13 of the EU’s 27 member states had imposed restrictions on high-risk suppliers, though 22 had the legal powers to do so. Parts of Europe’s 5G infrastructure remain dependent on high-risk vendors, with Germany the most prominent example. Eight years after the debate about these vulnerabilities started, about 60% of its radio access network is still provided by Chinese vendors. The share of European vendors present in China’s critical advanced communication systems has since fallen to less than 3%.
Radically rethink reciprocity
“Beijing criticises the revised Cybersecurity Act as unfairly targeting Chinese companies, while its own procurement notices explicitly name European companies as supply-chain risks to be removed from critical infrastructure.”
Beijing’s complaints about Europe’s risk mitigation actions should be met with a plain and pragmatic observation: China does the same, more extensively and less transparently. Beijing criticises the revised Cybersecurity Act as unfairly targeting Chinese companies, while its own procurement notices explicitly name European companies as supply-chain risks to be removed from critical infrastructure. Its grounds go well beyond technical faults or security incidents: a supplier’s foreign origin is itself disqualifying under a top-down localisation drive.
Under the revised Cybersecurity Act, whether a third country itself excludes EU-origin products from critical infrastructure should be considered when the EU assesses non-technical cyber risks. The EU should stress its own “legitimate right”, in Beijing’s own phrase, to protect critical infrastructure, and use the evidence of China’s localisation drive to address asymmetric procurement conditions through the International Procurement Instrument. Trust cannot be a one-way street. Chinese companies should not compete freely for EU public contracts while European firms face systematic exclusion or replacement in China.
Europe is facing a less integrated world: supply chains are already concentrated in a few places, while global technology and energy systems are fragmenting. Openness itself is no longer a virtue, but increasingly a vulnerability. Those trends are not going to reverse any time soon. By eliminating European exposure in its own energy infrastructure, the Chinese leadership has set the tone. It is on Europe to take the message.