Introduction: Cyber security and the division of competences under EU constitutional law
The European Commission’s proposal for a second Cybersecurity Act (“CSA2” or “CSA2 proposal”) represents a significant development in the European Union’s approach to regulating digital infrastructure.
At the heart of CSA2 lies the idea of a mechanism at Union level capable of classifying ICT providers, manufacturers or entire supply chains as security risks, coupled with binding exclusionary effects throughout the internal market.
Although the proposal is formally presented as a measure to strengthen the internal market for ICT products and services, it goes far beyond technical harmonisation. This applies in particular to the provisions on high-risk suppliers in Title IV of the CSA2 proposal. These regulations not only coordinate national regulatory practices, but also empower the European Commission to classify suppliers as high-risk, particularly if they originate from a third country that is considered a high-risk country. Being classified as a high-risk supplier has far-reaching implications both for the company concerned and for customers (such as network operators) who have integrated components from the affected entity into their systems.
By centralising the classification of high-risk suppliers, the CSA2 proposal also has a direct impact on the division of regulatory powers between the European Union and its Member States. The legal framework for this division is shaped by the interplay of three key provisions of the Treaties. Article 114 TFEU confers on the Union the competence to harmonise national legislation for the purpose of creating and functioning of the internal market. Article 4(2) TEU expressly assigns the safeguarding of national security to the exclusive competence of the Member States. Article 5 TEU, in turn, limits the exercise of the Union’s competences by the principles of subsidiarity and proportionality
From the perspective of the European Union’s constitutional framework, it is therefore not decisive whether cyber security is a legitimate and important policy objective. Rather, the question is whether the Treaties of the European Union permit the Union to assume responsibility for identifying security risks as such, or whether such identification is, under constitutional law, reserved for the Member States.
Article 4(2) of the TEU: National security as a reserved competence
The Court of Justice has characterised national security as an essential function of the State, closely linked to the constitutional identity and fundamental political responsibilities of the Member States (ECJ, Privacy International, C-623/17, para. 44). Against this background, national security interests have long been protected under EU law and may, in particular, be invoked to justify interference by EU Member States with the rights and freedoms guaranteed by the European Union.
Article 4(2) of the TEU, which was introduced in 2009 by the Treaty of Lisbon, further anchors this protection. This provision obliges the European Union to “respect” a number of interests, such as the equality of Member States and their national identities. Furthermore, Article 4(2) expressly provides that national security remains within the ‘exclusive competence’ of each Member State. According to prevailing opinion, this attribution of exclusive competence is understood to mean that legislative competence in matters of national security is reserved for the Member States; legislative activity by the European Union in this area is excluded.
Although the European courts have not yet ruled on the exact scope of the limits on jurisdiction imposed by Article 4(2) of the TEU, case law in other areas allows certain conclusions to be drawn regarding the scope of the national security exception. In data protection cases, the Court of Justice of the European Union has ruled that activities serving to safeguard national security, to which the GDPR does not apply, include, in particular, activities serving to protect essential State functions and fundamental societal interests (Court of Justice of the European Union, Austrian Data Protection Authority v WK, C-33/22, para. 46). In the field of national security, the EU’s legislative powers, in particular those of a horizontal nature, must be interpreted in such a way that they do not encroach upon the exclusive competence of the Member States pursuant to Article 4(2) of the TEU.
In recent years, the European Union has recognised resilience as a central policy objective. A number of measures to strengthen resilience, adopted on the basis of the internal market competence under Article 114 TFEU, are clearly relevant to national security. This applies, for example, to legislation in the field of cybersecurity (NIS2 Directive (EU) 2022/2555), on the resilience of critical infrastructure (Directive (EU) 2022/2557), and the recent proposal for greater harmonisation in the area of screening of foreign direct investment (Council of the EU 6254/26). In these areas, EU legislation aims to set minimum standards and ensures coordination between Member States to guarantee consistent application.
By conferring on the European Commission the power to classify third countries and individual providers as high-risk, the CSA2 proposal goes beyond these examples. Given the explicit reservation of competence in matters of national security in favour of the Member States, it remains questionable whether Article 114 TFEU can be interpreted as permitting such a delegation of powers to the Commission.
Article 114 TFEU: Competence in relation to the internal market
CSA2 is formally based on Article 114 of the TFEU, which the European Commission invokes as the legal basis for harmonising national rules and thereby ensuring the establishment and functioning of the single market for ICT products, services and supply chains.
Article 114 TFEU enables the Union to harmonise national legislation, provided that such measures genuinely serve the establishment and functioning of the internal market. The Court of Justice has consistently recognised the scope of this competence, particularly in areas characterised by technological complexity and regulatory fragmentation (ECJ, Germany v Parliament and Council (Tobacco Advertising I), C-376/98, paras 84–86).
Within these limits, the EU legislature enjoys a wide margin of discretion, including the power to impose far-reaching regulatory restrictions or even marketing bans, provided that such measures remove actual barriers to trade or prevent significant distortions of competition (ECJ, British American Tobacco, C-491/01, paras 60–62). At the same time, Article 114 TFEU does not constitute a catch-all provision or confer a general legislative competence. The Court of Justice has repeatedly emphasised that it cannot be invoked where the substantive subject-matter of a measure lies outside the scope of market integration.
Whilst Article 114 TFEU does not, therefore, require that market integration be the sole objective of the European Union’s actions, it cannot serve as a legal basis if the measure’s principal subject matter lies within another policy area (ECJ, C-376/98, Germany v Parliament and Council, paras 84–86; C-380/03, Germany v Parliament and Council, paras 37–39).
Security risks are not objective facts that exist independently of any legal assessment. They are the result of normative, situation-specific and forward-looking assessments that take into account technical characteristics, systemic relevance, governance structures, geopolitical dependencies and national perceptions of threat.
Classifying an ICT provider, product or supply chain as a security risk therefore represents a paradigmatic exercise of national security responsibility. It inevitably involves decisions regarding probability, severity and acceptable risk against the backdrop of the specific national security environment. Furthermore, the criteria for risk assessments of third countries set out in Article 100 of the CSA2 proposal clearly show that the classification is not intended merely to reflect the risk of technical vulnerabilities. Rather, suppliers are classified as high-risk on the basis of their country of origin if that country “poses a serious and structural non-technical risk to ICT supply chains”.
An EU-wide mechanism that identifies risks arising from foreign policy and intelligence does not merely harmonise national cybersecurity approaches; it replaces them. This raises the question of whether such a measure can in fact be based on the competence relating to the internal market under Article 114 TFEU, or whether it rather falls within the remit of the European Council, as set out in Chapter 2 of the TEU on the Common Foreign and Security Policy.
Article 5 TEU: Proportionality and subsidiarity as structural restrictions
Furthermore, the exercise of the Union’s competences remains subject to the general limitations laid down in Article 5 TEU, in particular the principles of subsidiarity and proportionality.
According to established case law, EU measures must be appropriate, necessary and proportionate in the strict sense. In areas affecting public or national security, the Court of Justice has ruled that exceptions and derogations must be justified by concrete and context-specific considerations and must not be based on abstract or merely speculative arguments (ECJ, Commission v Finland, C-284/05, paragraphs 45–47; joined cases C-203/15 and C-698/15, Tele2 Sverige, paragraphs 99–101; joined cases C-511/18 et al., La Quadrature du Net, paragraph 99).
EU-wide provider classifications exclude case-by-case assessment at the legislative level. The resulting lack of proportionality thus arises as early as the stage of legislative drafting. Even though this is a doctrinal inference rather than a finding expressly made by the Court of Justice, it follows from the Court’s consistent requirement that essential elements of risk assessment must not be ruled out in advance where particularly sensitive interests are at stake (ECJ, Joined Cases C‑203/15 and C‑698/15, Tele2 Sverige, paragraphs 99–101; Joined Cases C‑511/18 et al., La Quadrature du Net, paragraph 99).
Under Article 5(3) of the TEU, Union action is permitted only where the objectives pursued cannot be sufficiently achieved by the Member States. However, national threat landscapes, network architectures and exposure profiles vary considerably. Levelling out this diversity through centralised classifications therefore risks undermining, rather than strengthening, effective security management.
Key clarification by Advocate General Ćapeta in the case of Elisa Eesti (C-354/24)
The Opinion of Advocate General Ćapeta in the Elisa Eesti case provides a doctrinally precise analysis of the interplay between single market law and national security within the constitutional law of the European Union.
Firstly, the Advocate General confirms that measures taken on grounds of national security are not excluded from the scope of EU law purely on the basis of that objective. Article 4(2) TEU preserves competence, not legal isolation. National security measures therefore remain subject to the proportionality test under EU law where they concern harmonised areas (Opinion, paras. 54–57).
Secondly, it makes clear that the protection afforded by Article 4(2) TEU depends on individualised, device-specific and context-sensitive risk assessments (paragraphs 101–111). A genuine, present and sufficiently serious risk must be established, which is linked to the specific hardware or software, its function, its use and its role within the network. Abstract, provider-related assumptions are insufficient under constitutional law (paragraphs 108–110).
Thirdly, the principle of proportionality requires that the competent authorities be able to justify and explain their risk assessments, even where sensitive information is involved (paragraphs 114–115). Judicial review is not allowed to be reduced to mere restraint.
The logic of Elisa Eesti therefore precludes categorical classifications of providers at Union level. Such mechanisms render individual assessment superfluous, supersede national responsibility and do not meet the requirements of proportionality laid down in Articles 4(2) and 5 TEU.
Conclusion: Constitutional issues raised by the CSA2 proposal
Viewed against the constitutional framework described above, CSA2 raises complex issues that go beyond questions of the extent of regulation or technical design.
Firstly: What is the nature and scope of the reservation clause provided for in Article 4(2) of the TEU, under which ‘national security’ remains the responsibility of the Member States? Whilst this reservation does not relieve the European Union of its competence to harmonise national legislation even where it relates to national security, the question arises as to whether the EU can centralise the risk assessment and classification of high-risk providers by delegating this power to the European Commission.
By granting the European Commission the power to make binding determinations on geopolitical and intelligence-related security risks, the CSA2 proposal appears to go beyond the mere harmonisation of the internal market and encroach upon the constitutionally sensitive area of national security governance, which, pursuant to Article 4(2) of the TEU, is reserved for the Member States.
Secondly: although Article 114 TFEU has previously been used as a legal basis for legislative acts in the field of cybersecurity, its applicability depends on the measure’s primary focus actually being on the harmonisation of the internal market (ECJ, Digital Rights Ireland, C-293/12, paras. 65–69). Article 114 TFEU is therefore typically triggered by considerations of uniformity, efficiency or the avoidance of regulatory fragmentation. Such considerations may underpin the harmonisation of technical requirements or the coordination of procedures.
By contrast, CSA2 is not primarily driven by market fragmentation or divergent national technical standards. Rather, its operational logic is based on the identification of security risks. The primary function of such a measure is to eliminate risks to critical infrastructure. The risks taken into account are not of a technical nature, but relate primarily to foreign policy and intelligence-related threats arising from the provider’s country of origin. It therefore seems plausible that the focus of the measure lies not in the internal market, but in the sphere of national security.
Thirdly: The CSA2 proposal raises questions regarding the principles by which the European Union is bound in the exercise of its powers, namely the principles of proportionality and subsidiarity embodied in Article 5 TEU.
In particular, there are significant concerns regarding the principle of subsidiarity. According to this principle, the Union shall take action only if and insofar as the objectives of the proposed measure cannot be fully achieved by the Member States, but are better achieved at Union level. In accordance with this principle, Union measures should leave as much scope as possible for national decisions, in so far as this is compatible with the achievement of the measure’s objectives and compliance with the requirements of primary Union law (ECJ, Luxembourg v Parliament and Council, C-176/09, para. 77). However, it seems doubtful whether action at Union level would in fact be better suited to achieving the objective of avoiding dependence on high-risk providers, not least in view of the well-known reluctance of the Member States’ intelligence services to share their findings with the institutions of the European Union.
With regard to proportionality, the recent opinion of Advocate General Ćapeta on the classification of high-risk suppliers by Member States makes it clear that such decisions must be based on an individualised assessment that takes into account the equipment in question, the manufacturer and the manufacturer’s country of origin. By contrast, the assessment under the CSA2 proposal is primarily country-based. Whilst the EU legislator enjoys broad discretion within the framework of the proportionality test under Article 5 TEU, it nevertheless seems doubtful whether a mechanism for safety classification which, if adopted by a Member State, would fail the test of proportionality, can be effectively introduced by the Union.