Politics of de-risking: how the EU confronts vulnerabilities in critical digital infrastructures

Rising geopolitical tensions are compelling the European Union (EU) to address vulnerabilities arising from external dependencies. The EU has thus embraced a policy of economic de-risking in sensitive policy fields, such as critical digital infrastructures (CDI). However, its responses to external dependencies in CDI have varied considerably. In semiconductors, the EU has adopted a strategy of strengthening domestic capabilities, while it has opted for a regulatory response to address dependencies in 5G networks. We argue that different risk structures translate into different types of threats, which in turn shape the EU's de-risking approaches. We contend that threats of intrusion, where adversaries could exploit dependencies from within, lead to regulatory responses, while threats of exclusion, where the EU risks being cut off from critical resources, lead to capacity-building policies. The institutional setting in which these policies are developed – whether supranational or intergovernmental – moderates their specific design. We support our arguments with a structured comparison of how the EU has addressed vulnerabilities in 5G networks and semiconductors. Our findings enhance the understanding of how the nature of external dependencies and associated threat types influence the EU's de-risking strategies in the critical area of CDI and beyond.