Law EU Cybersecurity Act could expose member states to costly investment treaty claims, legal opinion warns A new legal opinion by leading international investment law expert Professor Christoph Schreuer warns that the European Commission's proposed Cybersecurity Act (CSA) could place EU member states in a difficult legal position, potentially exposing them to compensation claims from Chinese investors under existing bilateral investment treaties (BITs). The opinion, commissioned by international law firm Gaillard Banifatemi Shelbaya Disputes and dated 4 May 2026, examines the legal consequences of a potential conflict between the proposed EU cybersecurity legislation and investment protection agreements that almost all EU member states maintain with China. Under the draft legislation, the European Commission would gain extensive powers to identify and exclude so-called "high-risk suppliers" from European information and communications technology (ICT) markets. The proposed measures could affect suppliers involved in key digital infrastructure, including 5G networks, telecommunications systems and other strategic ICT assets. Potential legal collision According to Schreuer, the central issue is that while the Cybersecurity Act would be directly applicable across the European Union, EU member states remain bound by their separate bilateral investment treaties with China. These treaties generally guarantee protections against expropriation, discriminatory treatment and unfair treatment of Chinese investments. The opinion concludes that compliance with EU legislation would not automatically shield member states from liability under international law. "Member States would remain bound by their respective BITs with China in the event of a conflict between their obligations under the CSA and those arising under the BITs," Schreuer writes. The analysis argues that international law does not allow to invoke domestic legislation—including EU law—as a justification for breaching treaty obligations. As a result, if measures taken under the Cybersecurity Act adversely affect Chinese investors, member states could still face international arbitration claims. Chinese investors could