The Opinion of Advocate General ?apeta in Elisa Eesti (Case C-354/24) of 19 March 2026 is one of those cases that looks, at first glance, highly technical, almost niche, and then suddenly reveals itself as something much larger. On the surface, the dispute concerns an Estonian authorisation regime for telecom equipment. In substance, it is about a question that now sits at the centre of Europe’s digital condition: when a Member State invokes national security to restrict the use of equipment in critical communications infrastructure, does EU law step aside, or does it remain in the room? The Advocate General’s answer is clear, and rather important. EU law remains very much in the room.
The facts are relatively straightforward. Elisa Eesti, one of the three nationwide mobile telecommunications operators in Estonia, asked for authorisation to continue using Huawei hardware and software already present in its 2G to 4G edge network and to introduce Huawei equipment into its 5G edge network. Under the Estonian Electronic Communications Act, operators must obtain prior authorisation for hardware and software used in their communications networks if that equipment may pose a risk to national security. The Estonian authorities, after consulting the Cybersecurity Council of the Security Committee of the Government, treated Huawei as a high risk supplier and granted only a time-limited permit, until 31 December 2025 for 5G and until 31 December 2029 for 2G to 4G. Elisa challenged those decisions, arguing, among other things, that the authorities had not demonstrated a concrete risk, that the measure was disproportionate, and that it interfered with property rights.
The legal issue, however, is much more interesting than the factual pattern might suggest. Estonia argued, in essence, that it was acting in the field of national security, an area that remains the sole responsibility of the Member States under Article 4(2) TEU. That argument has obvious force. Telecommunications networks, particularly 5G, are no longer just commercial infrastructure. They are part of the strategic architecture of the State. They carry data, enable public services, support economic life, and increasingly underpin the operation of critical systems. The temptation, therefore, is to say that once national security is invoked, the matter exits the normal disciplines of EU internal market law. That is precisely the temptation the Advocate General resists.
Her starting point is that the Estonian regime falls within the scope of the European Electronic Communications Code. That is not a marginal point. It means that measures designed to ensure the security of electronic communications networks are not somehow external to the EECC. They belong to it. The Advocate General explains that the Code aims not only to facilitate the internal market in communications services, but also to ensure the security of networks and services. Article 40(1) and Article 41(1) expressly require Member States to ensure that providers manage security risks and that competent authorities have powers to issue binding instructions where significant threats are identified. On that basis, an ex ante authorisation regime for hardware and software is, in her view, one possible national method of implementing those obligations.
But here comes the crucial move. The fact that a national measure is adopted for national security reasons does not place it outside EU law. The Advocate General says this in unmistakable terms: the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt Member States from complying with EU law. Article 4(2) TEU, in her reading, confirms that the Union has no competence to decide for the Member States what national security requires. It does not, however, create a legal black hole into which all security measures disappear. National security remains a justification, not a magic formula of immunity.
That point alone makes the Opinion notable. It pushes back against a growing habit in Europe, and not only in Europe, to treat “security” as a kind of constitutional solvent, capable of dissolving ordinary legal controls. The Advocate General adopts a more disciplined position. Member States may protect their telecommunications infrastructure. They may act against high risk suppliers. They may take account of geopolitical vulnerabilities and strategic dependencies. But when those choices affect a field regulated by EU law, they must still pass through EU law’s grammar.
The next step in the Opinion is equally important. The Advocate General rejects the argument that the Estonian authorisation regime is simply a neutral “condition” for operating in the telecom market. Instead, she characterises it as a restriction on the freedom to provide electronic communications networks and services under Article 12(1) EECC. That is a subtle but decisive distinction. If the measure were merely a built-in condition of access, it would enjoy a kind of structural normality. By calling it a restriction, the Advocate General subjects it to justification and proportionality review. Prior authorisation, she notes, makes market access more difficult and less attractive, and measures of that kind are, in principle, obstacles to free movement.
Still, she does not go to the opposite extreme. She does not suggest that Estonia’s security concerns are pretextual or illegitimate. Quite the contrary. The Opinion recognises that the security of communications networks is a fundamental interest in contemporary democratic societies. A trustworthy telecom infrastructure is necessary for democracy, freedom of expression, social stability, and the functioning of the wider economy. The Court has already accepted that the security of telecommunications infrastructure may form part of public security, and the Advocate General fully embraces that logic. There is no naivety here. No airy digital universalism. She accepts that network security is serious business.
What she insists upon, however, is that seriousness does not eliminate method. A restriction of this kind may be justified only if the risk is genuine, present and sufficiently serious in the particular case. A Member State cannot simply invoke national security in the abstract. The legislation must require the competent authorities to assess whether the particular equipment genuinely poses such a risk. That is perhaps the sharpest line in the Opinion. Suspicion, even sophisticated suspicion, is not enough on its own. The legal system demands a translation from general geopolitical concern into a specific and reviewable finding about the equipment at issue.
This is where the Opinion becomes especially rich. The referring court had asked whether proportionality requires the authorities to examine whether the risks associated with the manufacturer are projected onto the specific hardware and software, whether the risks associated with the manufacturer’s home State are projected onto the manufacturer, and whether the location, function, and importance of the specific equipment in the network matter. The Advocate General answers, in substance, yes. National legislation must oblige the competent authorities to conduct exactly this sort of assessment. She adds that courts reviewing such decisions must be given reasonable explanations for the finding of risk, even if this may require “different judicial techniques” because of the technical, political, and security-sensitive nature of the material involved. That observation is understated, but telling. It acknowledges the shadow presence of intelligence, classified assessments, and security expertise, while refusing to let them dissolve judicial review altogether.
The Opinion also addresses two ancillary issues with a measured hand. First, on notification, the Advocate General considers that because the authorisation regime is a restriction under Article 12(1) EECC, it should in principle have been notified to the Commission. Yet even if notification did not occur, that would not automatically make the national rules inapplicable in the same way as under the TRIS Directive. Second, on property, she rejects the idea that Elisa was deprived of its possessions within the meaning of Article 17(1) of the Charter. In her view, the contested decisions regulate the use of property rather than deprive the operator of it. Still, she leaves open the possibility that if the transition period was too short, and thus insufficient to allow adaptation to the new legal regime, some form of reasonable compensation might need to be considered.
The deeper significance of Elisa Eesti lies here. The case is not really about Huawei alone, and not even only about Estonia. It is about the legal architecture of digital sovereignty in Europe. The Advocate General accepts that telecom infrastructure can be governed as a site of security. But she also insists that security governance in the Union cannot become legally self-sealing. National security remains sovereign in purpose, but not lawless in form. That is the most valuable lesson of the Opinion. It does not deny the strategic turn in European telecommunications policy. It domesticates it, juridically. And in the present climate, that is no small thing.