Argentina Tightens Security Rules for State Telecom Purchases

Argentina has approved new supply-chain security requirements for telecommunications equipment used in critical public infrastructure, directing federal agencies and state-owned companies to incorporate the controls into relevant procurement contracts. The measure, published in the official gazette on November 6, does not itself impose a blanket prohibition on Chinese equipment or immediately extend the rules to private telecommunications networks.

Disposición 7/2026, issued by the National Cybersecurity Centre (Centro Nacional de Ciberseguridad, CNC), establishes technical requirements for equipment acquisition, contracting, installation and operation in national public-sector critical telecommunications infrastructure. Article 2 requires purchasing bodies to incorporate the safeguards into tender documents and contracts, with any certification demands justified by the equipment's assessed criticality. The instrument was signed on November 5 by CNC executive director Walter Fabián Agüero and published the following day.

The measure draws on the Telecommunications Industry Association's SCS 9001 supply-chain security standard, which assesses supplier and manufacturer processes rather than certifying the technical security of every individual product. The regulatory text also addresses component traceability, software and firmware vulnerabilities, supplier support, remote access and software bills of materials. It provides for a risk-based approach rather than declaring that every existing network device has failed a security test.

The distinction between public and private networks matters. Article 2 says the requirements are mandatory for the national public sector, including state enterprises. Private entities may become subject to relevant conditions through public contracts, subsequent rules issued by the telecommunications regulator ENACOM, or voluntary adoption. Article 9 asks ENACOM to evaluate whether to extend the framework to equipment approvals and licence-holder obligations; it is not itself a completed private-sector rule.

The CNC is also directed to identify critical information infrastructure and assign criticality levels to categories of equipment within 90 days of the regulation taking effect. That classification, along with the detailed annex and the treatment of existing equipment and future procurement, will determine how the requirements work in practice.

Argentine outlets including Infobae and ConverCom have examined whether the US-developed certification framework could limit the eligibility of some suppliers, including Chinese manufacturers, in public procurement. Those are possible market consequences of certification and eligibility rules, not proof that the Argentine government has formally banned any named company from all domestic telecom networks. The regulation itself does not name Huawei or ZTE as prohibited suppliers.

The next public-interest tests are the CNC's published criticality categories, the precise certification or equivalent-compliance requirements used in federal tenders, any ENACOM decision affecting private operators, and evidence of how competing suppliers are assessed. Procurement documents and regulator decisions, rather than assumptions about geopolitics, will show the practical effect on competition, cost and network security.