The Court of Justice of the European Union is set to clarify how far EU law constrains national security measures, following an Advocate General's opinion in the Elisa Eesti case. The opinion, delivered in Luxembourg, addresses a question that has divided national authorities and telecoms operators for years: when a member state invokes national security, where does the boundary of EU competence actually lie?

The case, brought by Estonian telecommunications operator Elisa Eesti, asks the Court to determine whether measures taken by a member state on national security grounds fall outside the scope of EU law entirely, or whether they remain subject to EU law requirements — at least where they affect sectors, such as electronic communications, that the EU regulates comprehensively.

The Advocate General's opinion now before the Court proposes a framework for answering that question. As is customary, the opinion is not binding on the Court, but in the majority of cases the judges follow the Advocate General's essential reasoning. A judgment will follow in due course, typically within three to six months of the opinion.

The stakes are considerable. National security has long functioned as a carve-out — a domain where member states claim exclusive competence and where EU institutions have trodden carefully. At the same time, security-motivated measures increasingly operate inside markets the EU regulates: telecommunications, data protection, critical infrastructure, foreign investment screening and public procurement. Operators and market participants affected by such measures have pressed for clarity on whether they can invoke EU law — free movement, proportionality, judicial review — against them.

The Elisa Eesti reference reaches the Court from Estonia, where the telecoms operator challenged a national security measure affecting its business. The referring court asked the CJEU to rule on the interplay between the member state's security powers and its obligations under EU law. The Advocate General's proposed answer, according to legal commentary published by the international firm Jones Day, will guide the Court toward a definition of the outer boundaries of the national security derogation.

For practitioners, the forthcoming judgment will matter on several fronts. First, it will shape litigation strategy for any company challenging a security-based measure — from network shutdowns and licence restrictions to exclusion decisions — by determining which legal arsenal applies. If the Court holds that such measures remain within the scope of EU law, claimants gain access to EU law principles of proportionality and effective judicial protection. If the Court accepts a broad carve-out, challenges will remain confined to national courts and national constitutional standards.

Second, the ruling will affect how member states draft and justify security measures. Governments that anticipate EU-level scrutiny will need to build stronger evidentiary records demonstrating why a measure is necessary and proportionate. Third, regulators in regulated sectors — notably electronic communications authorities — will need to reassess the interface between security directives and the sectoral rules they administer.

The opinion also lands amid a broader debate in Brussels over security-related instruments, including rules on high-risk vendors in 5G networks, the Foreign Subsidies Regulation and investment screening. A judgment narrowing the security carve-out would give those EU instruments additional traction against national measures that sideline them; a judgment endorsing a wide carve-out would reinforce member state discretion.

The Court has not yet scheduled the date of its judgment. Parties and intervening member states will watch the final text closely for the precise test the Court adopts — whether it follows the Advocate General's framework in full, modifies it, or declines to define a general boundary at all. Whatever the outcome, Elisa Eesti is positioned to become the reference point for national security exceptions in EU law for years to come.