CJEU Advocate General Outlines Strict Safeguards for National Security Exclusions in EU Public Procurement

The case concerns Lithuanian legislation adopted following Russia's invasion of Ukraine, permitting the exclusion of economic operators from public procurement on national security grounds. Two undertakings excluded in 2024 challenged their removal, and the Lithuanian Supreme Court referred preliminary questions to the CJEU.

In summary, the Opinion emphasizes four key principles:

• National security does not render EU law inapplicable. Member States retain discretion in defining national security measures but remain bound by the EU principles of proportionality, non-discrimination, transparency, and the right to an effective remedy. However, exclusion grounds fall outside the procurement directives so that the safeguards of Article 57 of Directive 2014/24, including self-cleaning and the cap on the exclusion period, do not apply.
• Binding national security assessments. A body competent to carry out a national security assessment may issue binding opinions resulting in automatic exclusion from public procurement, provided that the body itself complies with fundamental EU law requirements.
• Rigorous proportionality. Exclusion decisions must rest on a specific, individual assessment establishing a real, present, and sufficiently serious security threat. The assessment must be based on up-to-date information, consider the threat's relevance to the specific contract, and set an individually determined duration of exclusion, subject to periodic review.
• Due process. Excluded undertakings must be afforded the opportunity to present evidence and to receive reasoned decisions. Their exclusion must be subject to comprehensive and effective judicial review, including independent examination of classified materials.

While non-binding, the Opinion will be closely watched beyond Lithuanian procurement law. Read alongside the Elisa Eesti Opinion addressing analogous issues in telecommunications (see our March 2026 Alert), the Autovici Opinion reinforces an emerging line of reasoning at the CJEU that security-based exclusions must meet strict proportionality and due process standards―principles that are likely to shape the upcoming judgments.

This may have significant implications for two pending EU legislative proposals: the Public Procurement Act (see our September 2026 Alert), which would codify broad grounds for security-based exclusion from public procurement, and the Cybersecurity Act 2.0 (see our February 2026 and July 2026 Alerts), which would empower the Commission to designate "high-risk suppliers" and exclude them from critical ICT supply chains. As both proposals advance through the legislative process, the Autovici and Elisa Eesti Opinions and forthcoming judgments are poised to serve as key reference points in shaping the final texts.

Businesses active in EU public procurement and critical supply chains should monitor these developments closely.