Data processing, CCTV cameras, facial recognition systems and Chinese contracts in the Balkans. These are all factors against which to assess EU enlargement. Serbia is the most advanced and well-documented case: Huawei has launched a ‘Safe City’ project for Belgrade and potentially for the whole country, whilst the European Commission continues to raise concerns about the lack of safeguards regarding the use of biometrics.
...
This is not a peripheral issue. It concerns the Adriatic, European infrastructure, police cooperation, logistics corridors and the credibility of enlargement.
...
In January 2019, a Huawei publication stated that the Serbian Ministry of the Interior intended to develop a ‘leading Safe City’ scheme covering Belgrade and, in the long term, the whole country. An integrated platform involves more than just the purchase of cameras: it can include sensors, networks, servers, storage systems, control software, facial recognition, number plate recognition, movement analysis, maintenance and links to public databases. It is the integration, not the optical device itself, that transforms video surveillance into strategic infrastructure.
...
The most sensitive issue is maintenance. These systems rely on firmware updates, licence renewals, digital certificates, archive optimisation and technical interventions. Support accounts may have higher privileges than those of police officers. If the supplier retains exclusive control over updates, recovery keys or proprietary formats, the state formally owns the system but does not have full control over its continuity. Huawei’s 2025 annual report states that the group has assessed the cyber and privacy risks of over 4,000 suppliers and holds more than 890 security and data protection certifications.
...
The protests that began in Serbia following the collapse of the bus shelter at Novi Sad station on 1 November 2024 [the shelter was built by a Chinese contractor], which claimed the lives of 16 people, have turned into a nationwide campaign for transparency and accountability. In August 2025, United Nations experts reported allegations of intimidation, assaults and surveillance targeting the student movement. These are allegations that require investigation; they are neither verdicts nor accusations levelled at the Huawei platform. In 2026, the Parliamentary Assembly of the Council of Europe expressed concern over revelations regarding the surveillance of Serbian journalists and activists, calling for effective investigations and accountability.
...
It will not be enough [for Serbia and other EU candidate countries] to simply adopt laws that are formally in line with EU requirements: it will be necessary to demonstrate which modules are installed, which databases are connected, who controls updates, and whether the system can operate without the original supplier.
...
Serbia is the best-documented case, but not the only vulnerable environment. In 2025, the Commission noted that Montenegro’s data protection legislation was not yet aligned with EU standards; that in North Macedonia, there remained a low level of awareness and insufficient IT safeguards within public bodies; and that in Albania, the Total Information Management System continued to present security and data protection vulnerabilities. Candidate countries set to integrate progressively into the European area could connect infrastructure that is not fully verifiable to border systems, digital identity, judicial cooperation and information exchange. Enlargement without technical convergence would bring vulnerabilities as well as new members.
...