European Electronic Communications Code (EECC) — Directive (EU) 2018/1972
Issuing body / enforcer: European Parliament and Council; enforced by national regulatory authorities (NRAs) in each Member State, coordinated by BEREC (Body of European Regulators for Electronic Communications). Jurisdiction: European Union / European Economic Area — providers of electronic communications networks and services (ECN/ECS).
1. What it is
The EECC (in force December 2018, transposition deadline December 21, 2020) is the EU's consolidated telecoms framework, merging the Framework, Access, Authorisation, and Universal Service directives into one code. It governs market entry, spectrum management, access obligations, consumer/end-user rights, universal service, and numbering — the regulatory operating system for fixed, mobile, and (in expanded scope) certain OTT/interpersonal-communications providers in Europe.
2. Scope, triggers, thresholds
- Who is covered: providers of electronic communications networks (fixed, mobile, satellite) and services, including number-based interpersonal communications (traditional voice/SMS) and — a deliberate expansion — certain number-independent interpersonal communications services (e.g., large messaging/VoIP platforms), which picked up lighter-touch obligations (notably around security and, in some states, emergency calling).
- General authorisation: providers operate under a general authorisation (notification to the NRA), not individual licenses, except for rights of use for spectrum and numbering, which remain individually granted.
- Key pillars:
- Spectrum: harmonized, technology- and service-neutral assignments; push for timely 5G pioneer-band availability (700 MHz, 3.6 GHz, 26 GHz) with long-duration rights of use (20+ years) to encourage investment.
- Access regulation: significant-market-power (SMP) remedies, symmetric access obligations, and co-investment frameworks for very-high-capacity networks (VHCN — fiber/5G).
- End-user rights: contract transparency and summary templates, maximum 24-month contract terms, switching/portability within one working day, and emergency communications (112) obligations including caller location.
- Universal service: affordable adequate broadband and voice at a fixed location; Member States may designate providers and fund via public money or sector levies.
- Security: providers must manage network/service security risks and report significant incidents to competent authorities (now substantially reinforced by NIS2 — see section 5).
- Trigger: providing ECN/ECS in any Member State — notification to that state's NRA is the entry step.
3. Key requirements and compliance obligations
- Notification and authorisation conditions (Annex I): comply with the standard conditions attached to the general authorisation (interoperability, consumer protection, lawful intercept cooperation, emergency access).
- Security and incident reporting: risk-management measures and notification of significant security incidents — now operating in tandem with NIS2 (Directive (EU) 2022/2555), under which telecom is an essential sector with its own incident-reporting clocks and management-accountability provisions.
- Consumer-code compliance: contract summaries, spend controls, switching rules, and out-of-court dispute resolution.
- Spectrum licence conditions: coverage obligations, rollout milestones, and fee terms attached to rights of use.
- Numbering and portability: number-allocation rules and one-day porting.
4. Penalties and consequences
Set by Member States under the Code's requirement for effective, proportionate, dissuasive sanctions: administrative fines (several states set telecom fines in the millions or as a percentage of turnover), licence/rights-of-use revocation or modification, and periodic penalty payments for continued non-compliance. NIS2 adds its own fine regime (up to €10M or 2% of worldwide turnover for essential entities) on the security side.
5. Version status and live changes (verified 2026-09-30)
- Stable core: the EECC itself has not been recast in the verification window; change is arriving through adjacent instruments:
- NIS2 (applicable October 2024) is the live security overlay: telecom operators as essential entities face 24-hour early-warning / 72-hour notification incident reporting to CSIRTs, supply-chain security duties, and management-body liability. The EECC/NIS2 incident-reporting boundary is an active compliance-design question — [Flag: confirm the current national implementation, as Member States allocate EECC vs. NIS2 reporting duties differently.]
- Gigabit Infrastructure Act (Regulation (EU) 2024/1781) — in force, applying from November 2025 — replaced the Broadband Cost Reduction Directive to accelerate VHCN rollout (permit tacit approval, in-building fiber, access to physical infrastructure). Directly relevant to network-build economics.
- Digital Networks Act: the Commission's planned follow-up telecoms reform (consultation 2025) — [Flag: legislative status not confirmed as of 2026-09-30; track before advising.]
- Copper switch-off and 2G/3G sunsets continue under national plans within the EECC framework — relevant to IoT device lifecycles.
6. Related certifications
No catalogue flagship certification tests the EECC. Practically adjacent: CCNP/CCIE Enterprise (for the network engineers building the regulated networks), CISSP (for the NIS2 security-governance side), and BICSI RCDD (for the physical network-build side). Telecoms regulatory competence in the EU is counsel/consultancy-led.
7. Practical notes
- Entering a new Member State: the notification is simple, but the consumer-code and security-reporting details differ by state — budget local counsel per market, not one EU-wide template.
- The security obligations are where engineers feel the EECC/NIS2 complex: incident-detection and 24-hour notification capability must be engineered into NOC/SOC operations, not bolted onto legal.
- For IoT/M2M providers: check whether your service qualifies as ECS in each target state — the classification drives the entire obligation stack.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.