2. Analysis

Images: Johannes Jansson and Maud Lervik / norden.org

Balancing different mandates

The GIA states that “limited access and insufficient network expansion can deepen social inequalities, thus creating a new digital divide between people who are able to benefit fully from an efficient and secure digital connectivity, allowing them to access a wide range of services, and people who are unable to do so. In that regard, the roll-out of VHCNs in rural, remote and scarcely populated regions, as well as in social housing, should be a priority for public investment projects, as a key aspect of social inclusion.” (The European Parliament & the Council of the European Union, 2024, p.1). The GIA thereby highlights the deep interconnection between social and digital inclusion and draws renewed attention to the persistent challenges linked to the urban-rural digital divide.

Accordingly, the GIA can be regarded as both a digital policy instrument and as a regional development facilitator. By accelerating the implementation of gigabit-speed networks and fifth-generation mobile services in underdeveloped areas, the GIA has the potential to promote economic revitalisation in sparsely populated areas by supporting innovative business models – such as those related to green energy, remote healthcare and smart logistics solutions – and providing the necessary infrastructure to attract labour, thereby fostering growth in previously underserved regions. Furthermore, the GIA may also contribute to broader cohesion objectives by more closely integrating cross-border and transnational regions into the EU's digital and economic framework (The European Parliament & the Council of the European Union, 2024).

However, the very features that make the GIA ambitious – in particular, its commitment to transparency and market facilitation – also give rise to a series of security challenges. The Act requires operators to provide detailed, and often publicly accessible, information about where infrastructure is being deployed, who is building it and how coverage is progressing (European Commission, 2025b). While such openness is crucial for coordination, collaboration, investment and democratic accountability, it also increases the exposure of sensitive infrastructure components – especially in areas close to critical national assets, border zones or regions with known hybrid threat activity (European Commission, 2023a).

Across the Nordic-Baltic region, critical infrastructure is defined through various national approaches, which are increasingly being harmonised by EU directives such as the NIS2 and the Critical Entities Resilience (CER) Directive (European Commission, 2025d). In Sweden and Finland, centralised, legislation-based models are applied. For example, Finland explicitly lists both public and private entities, including ICT service providers and regional broadband networks (Traficom, 2025). By contrast, the Baltic states and Denmark employ more decentralised or risk-based approaches. Latvia's legislation empowers multiple authorities to designate operators based on risk assessments, while Estonia’s approach centres on sectoral regulators and ad hoc coordination measures (Cobalt, 2024; Information System Authority, 2022).

Certain legal acts take precedence over the EU Gigabit Infrastructure Regulation (European Commission, 2025b). In Sweden, this hierarchy is addressed in the “Gigabit Enquiry Report”, published as part of the Swedish Government Official Reports, which states that “If a provision in Directive 2002/77/EC, the Code, or the NIS2 Directive conflicts with the GIA, the provisions of the directives shall take precedence. This means, in our view, that the Electronic Communications Act and the legislation that will implement the NIS2 Directive take precedence over the GIA, to the extent that the Swedish legislation transposes the said directives.” (SOU, 2025, p.107).

Furthermore, several authorities in Sweden note that ensuring sufficient expertise in cybersecurity and supervision poses a major challenge. They report that it is difficult to recruit appropriately qualified specialists, particularly for newly established supervisory authorities. In addition, the authorities need resources to maintain and develop employees’ skills over time (Statskontoret, 2025).

Strengthening cyber defence will require substantial investment to maintain a high and consistent level of cybersecurity. KL, the interest organisation of the Danish municipalities, expects municipal expenditures to be significant, while noting that the exact amount will depend on future sector-specific rules (KL, 2024).

Municipalities must balance the transparency requirements under the GIA with the stringent cybersecurity obligations under the NIS2 without placing excessive strain on local resources. According to an Estonian respondent, this can be achieved by adopting a need-to-know approach to data sharing. While certain information should remain publicly accessible to fulfil the transparency objectives of the GIA, technical details should be available on a need-to-know basis. For example, in the case of Single Information Points (SIP), data may be presented at an aggregated level, with more detailed technical specifications available exclusively upon direct request to the infrastructure owner (Estonian respondent).

Variations in implementation

In Finland, the Ministry of Transport and Communications (Traficom) is tasked with preparing the government’s proposal for an amendment to national legislation, which is presently based on the Broadband Cost Reduction Directive (BCRD). The new legislation, which is aligned with the GIA, entered into force on 12 November 2025. To meet the requirements of both the BCRD and the GIA, Traficom has proactively developed a Single Information Point (SIP), which has operated in accordance with the GIA since 2017. According to Finnish authorities, the new national legislation based on the GIA is largely consistent with existing frameworks regarding data security and transparency. Access to data is primarily restricted under national law in relation to critical infrastructure. Notably, no significant challenges have been reported in balancing these aspects within the GIA context. The established SIP does not include detailed physical infrastructure location data; instead, requests for such data are transmitted to the relevant network operator, and strong electronic identification is required for SIP users. This approach has helped avoid conflicts between requirements under the GIA and national security or public data access legislation (Finnish respondent).

The differing approaches to the NIS2 influence how infrastructure is classified and protected. In Finland, a regional broadband provider might automatically be subject to critical infrastructure obligations, whereas in Estonia its designation may depend on factors such as size, sectoral risk or national interest (Finnish respondent & Estonian respondent). These variations shape how the NIS2 obligations are operationalised, determining which entities are subject to cybersecurity rules, how responsibilities are assigned and what resources are available for compliance. This issue is particularly pertinent in the context of the GIA, under which entities such as local utilities, infrastructure owners or regional broadband providers – which may or may not be classified as critical under national law – are now expected to open up physical infrastructure for shared use while also securing it to the standards required by the NIS2.

For example, a municipally owned broadband provider in rural Latvia – without clear designation as a critical entity – might be required under the GIA to grant access to its network ducts to third-party providers yet lack the cybersecurity protocols mandated by the NIS2 to manage potential risks or prevent unauthorised tampering. Conversely, a regional network operator in Finland, already classed as a critical entity under national law, could face conflicting obligations: under the NIS2, it may restrict data access or infrastructure sharing to preserve system integrity, while the GIA obliges it to accommodate co-deployment or disclose asset maps to other providers.

In Lithuania, the Ministry of Defence is responsible for transposing the NIS2 into national legislation, with primary legislation – specifically the cybersecurity law – already amended accordingly. As of spring 2025, the GIA had not yet been fully implemented. Practical measures are being coordinated across several Lithuanian ministries to ensure that the articles of the EU regulation are not only implemented but also workable in practice. While the regulation is directly applicable, these ministries are actively involved in developing operational steps to make its provisions functional (Lithuanian respondent).

In countries with clear designation mechanisms, GIA stakeholders may already be subject to critical entity rules and equipped to manage the associated obligations. In other countries, gaps in designation or coordination can leave rural operators uncertain about how to balance transparency and security in practice – an issue that particularly affects rural regions (European Commission, 2024b). These tensions could have consequences that significantly shape the long-term impact of the GIA. Delays or reluctance to grant access due to security concerns may slow broadband expansion in underserved rural areas, undermining the GIA’s core objective. At the same time, higher costs associated with meeting both transparency and cybersecurity requirements could reduce incentives for infrastructure sharing or raise prices for end users (Frontier Economics, 2022).

Furthermore, inconsistent enforcement across countries risks fragmenting the single market for broadband infrastructure, with some regions embracing openness and others restricting access. Insufficiently secured infrastructure sharing could increase vulnerability (NIS Cooperation Group, 2024). On the other hand, these challenges also present opportunities: they may catalyse stronger Nordic-Baltic collaboration on harmonised cybersecurity standards, enhanced joint threat intelligence sharing and coordinated incident response (Nordic Council of Ministers, 2024a).

This dynamic is further underscored by real-world threats. Ransomware attacks on Swedish municipalities (Region Norrbotten, 2025), DDoS campaigns targeting Estonian public services (Information System Authority, 2023) and infrastructure disruptions in Lithuania (Kottasová et al., 2024) have exposed the vulnerability of local-level actors. These developments highlight the importance of harmonising national definitions, ensuring local compliance capacity and embedding infrastructure development within a robust, regionally coordinated security framework to facilitate digital expansion through the GIA.

Local implications and considerations

While complementary, these regulatory regimes may still inadvertently stall progress. Local actors – tasked with implementing rollout plans, partnering with vendors and reporting on progress – may face ambiguity over what information can be shared and what must be secured. In regions already struggling with underinvestment and limited administrative capacity, such friction can delay projects, discourage private-sector involvement and expose communities to unmanaged risk (Regeringskansliet, 2023; Sveriges Kommuner och Regioner, 2023a).

Several countries have reported delays arising from unclear guidance and transparency obligations associated with the NIS2’s cybersecurity requirements (European Commission, 2025e). The burden on municipalities and regions is acute. Many local governments – especially those in sparsely populated or economically lagging areas – lack the technical expertise, legal advisory capacity and financial resources to navigate the dual demands of infrastructure openness and cybersecurity compliance (European Commission, 2023b). Ongoing examinations and policy dialogue across the Nordic-Baltic region are beginning to unpack these tensions. For example, in Denmark, municipalities are now classed under the NIS2 but reportedly lack the expertise, budget and staff to meet the new cybersecurity requirements, especially in smaller or rural communities (CBS, 2025).

The municipal burden is not merely a matter of compliance paperwork but reflects deeper structural capacity challenges. Smaller municipalities in the Nordic-Baltic region often operate with limited IT departments, and cybersecurity is frequently managed as an add-on responsibility rather than as a dedicated function (European Commission, 2023b). This creates a double bind: while the GIA obliges local authorities to facilitate infrastructure access and transparency, the NIS2 classifies them as essential service providers, thereby requiring investments in advanced security measures, incident reporting and risk management systems. For wealthier urban municipalities, these requirements can be absorbed through existing administrative frameworks; for rural or underfunded regions, they impose additional strain on already constrained budgets (CBS, 2025; Sveriges Kommuner och Regioner, 2024).

Estonia intends to provide financial assistance to entities that are new to Estonian cybersecurity law, including the majority of providers of public electronic communications networks and publicly available electronic communications services. This support will not extend to municipal entities, as they are already required to comply with existing cybersecurity obligations. The funding will primarily cover two areas: (1) conducting a review of current cybersecurity measures and developing a roadmap to achieve the required standards, and (2) supporting the implementation of activities identified within that roadmap (Estonian respondent).

For example, in Sweden, all municipalities and regions will be subject to the NIS2 requirements – not only for those sections of their activities that fall under NIS2 sectors but also for the organisation as a whole. This presents significant challenges for smaller municipalities. Recognising the financial constraints associated with implementing cybersecurity measures in line with the NIS2, the Swedish government has decided on permanent budget increases for all municipalities and regions (Swedish respondent). In addition, the Swedish government considers that maintaining a consistent level of cyber resilience among key operators may generate long-term cost savings for these operators, although short-term expenditures may be required to meet the requirements of the NIS2 (Regeringen, 2025).

In Finland, Traficom reports that the main impact has been the development and monitoring of the SIP to ensure network operators submit their information as required. According to Finnish respondents, the use of decentralised systems – where requests for detailed infrastructure data are transmitted directly to the relevant parties – is encouraged. The monitoring of SIP usage is facilitated through strong electronic identification, thereby enhancing security and accountability. Sensitive infrastructure details are not stored within the SIP itself; rather, the SIP is designed to function as a gateway, allowing controlled access to such data. This approach, as described by the Finnish sources, has proven effective in safeguarding critical information while enabling efficient processing of legitimate requests (Finnish respondent).

The result is a growing discrepancy in implementation capacity. Some municipalities are able to advance GIA rollout plans relatively smoothly, while others postpone or scale back projects until national authorities provide clearer interpretive guidance or additional financial support. In practice, this means that the areas most in need of rapid broadband deployment – remote or rural areas and sparsely populated communities – are also most likely to experience delays. Such uneven capacity risks widening existing regional digital divides. Scalable governance frameworks that can balance openness with resilience are therefore needed. Without a harmonised interpretive framework at the EU level, local actors remain vulnerable to legal uncertainty and operational fragmentation.

In relation to both the GIA and the NIS2, national authorities play a crucial role in ensuring effective implementation at the local level. Through the provision of guidelines, dissemination of information and structured communication, they can offer essential support to municipalities in interpreting and complying with EU and national legislation, as well as in understanding the obligations these frameworks impose (Swedish respondent).

To fully unlock the development and strategic potential of the GIA in the Nordic-Baltic region, it is therefore essential to clarify its implications for cybersecurity, particularly in rural and remote areas. This will require clear interpretive guidance, stronger alignment between digital and regional policy goals and concrete support for local actors on the frontlines of building and securing Europe’s digital frontier.

National governments should provide clear guidance and disseminate best practices on these matters, complemented by the organisation of workshops and seminars to build capacity. While financial support is also important, budgetary constraints may limit the extent to which governments can offer such assistance, necessitating careful evaluation of this option. It is anticipated that EU funds could be utilised for this purpose; in such cases, the requirements for accessing financial support should be designed to minimise administrative burdens, ensuring applicants are not subjected to excessive bureaucracy (Estonian respondent).