Changes to the UK National Security and Investment Regime

The UK Government has announced likely legislative change to exclude certain types of low risk acquisitions from the national security and investment regime, as well as a consultation on the sensitive sectors of the UK economy which can trigger mandatory notifications. It has also issued its annual report. Here we outline the proposals and offer some views.[1]

Internal reorganisations and insolvency situations out of scope

Pat McFadden, the senior minister in charge of the regime, has announced that “certain internal reorganisations and the appointment of liquidators, special administrators, and official receivers”[2] will no longer have to be notified. This will require legislation in due course. We will need to keep an eye on whether these exemptions will be for all, or only a subset, of such transactions.

This proposed reform accords with our experience that internal reorganisations are very unlikely to have any bearing on national security, and yet notification causes undue burden and delay on businesses. Meanwhile, when insolvency measures trigger mandatory notifications, the Government can and does use its discretion to expedite reviews, but this is merely discretionary and even an expedited review may be particularly burdensome in such urgent circumstances.

Even if, as reformed, such transactions are no longer mandatorily notifiable, this does not preclude the Government calling them in on its own initiative in rare cases, albeit without the benefit of automatic visibility.

Other potential reforms are not on the cards. There is no indication, at present, that the Government intends to relax the regime for acquirers from certain jurisdictions, notably the UK or friendly foreign countries. This possibility is envisaged in the original legislation, and is a hallmark of other investment screening regimes, such as CFIUS in the US. It could be a bargaining tool in trade negotiations. There is also no indication that the Government will introduce a de minimis safe harbour for investments falling below a certain absolute amount.

Consultation on mandatory sector regulations

The consultation proposes some notable, yet not radical, changes to the regulations which define the boundaries of the currently 17 sensitive sectors of the economy in which investments may trigger a mandatory and suspensory review by the UK Government.[3] These changes are mostly definitional housekeeping. Indeed, the ministerial foreword states that “[t]hese changes do not amount to a major change in policy and will not substantially change the types of entities and activities in scope”.[4] The number of sensitive sectors would nominally increase from 17 to 19, but Water would be the only genuinely new sector; the change in numbers otherwise simply reflecting the reformulation of the existing sectors. The overall impact forecast is merely “between 10 fewer and 35 more”[5] mandatory notifications per year.

The response deadline is 14 October 2025, so there is plenty of time for businesses and advisors to comment and potentially shape the consultation outcome.

The key proposed changes are as follows:

• Artificial Intelligence will be redefined, given that the sector has developed so rapidly since the original schedule was drafted. Barely any business these days does not profess to be adopting AI, which in our experience has complicated the assessment as to whether a target business is caught by the mandatory regime. However, the Government sensibly acknowledges that it does not wish review investments in businesses using AI for low-risk activities. The Government expects a decrease in the number of notifiable acquisitions caught by the Artificial Intelligence sector definitions as revised.

According to the consultation document, “where consumer AI is being used as a tool within internal processes (without any further material research and development of that technology being performed by the licensee)”, this will be out of scope.[6] The draft definition in the schedule defines this by its opposite, i.e. “where that artificial intelligence systems is not available to consumers”.[7] However, the borderline between consumer and non-consumer may be blurred, as there is a spectrum ranging from businesses simply using off-the-shelf AI to those which develop bespoke systems of varying sophistication. The borderline ought to be clarified.

The definition of “artificial intelligence system” will be refreshed. The new definition removes the previously cumbersome reference to systems which “perceive environments through the use of data”. It also notable expands the range of outputs which define such a system to include “predictions, digital content, recommendations, decisions or other similar outputs”, as well as capturing those which “influence a physical or virtual environment”.[8] 

Where the AI system is a non-consumer one, the proposed activities in scope include creating or improving an AI system, creating a new or changed capability in an AI system, or increasing the speed at which an AI system operates. Whether or not the AI system is a consumer one, testing and evaluating its safety or security, its disinformation or misinformation capabilities, or its risk to health and safety, will be in scope.

• Water is a new proposed sector, which would capture investments in the regional water and/or sewage monopolies. This reflects Government concerns about threats to the UK’s water infrastructure.

• Data Infrastructure: this notably brings into scope third-party operated data centres, including certain Cloud Service Providers and Managed Service Providers. This is to address current confusion as to which data centres are in scope. The change is expected to increase the number of notifications per year.

Other important yet secondary proposals include:

• Critical Minerals is to have its own standalone schedule. This will be carved out of the existing Advanced Materials schedule. The list of in-scope minerals will include those identified by the UK Critical Minerals Intelligence Centre in its annual UK Criticality Assessment. The list will retain others considered to be necessary and important for defence or scientific purposes. The proposal also adds “extraction, processing and recycling”[9] to the list of in-scope activities. In practice, these changes are not expected to materially increase the number of notifications, as the UK mostly imports critical minerals, but this could differ in the future.

• Semiconductors is to have its own standalone schedule. This will be carved out of the existing Advanced Materials schedule and merged with the Computing Hardware one. The Government proposes adding “advanced packaging techniques” and activities involving the design of semiconductors, such as R&D, to the definition. These changes are not expected to increase the number of mandatory notifications.

• Advanced Materials will have parts re-allocated to Semiconductors and Critical Minerals, while also having some new materials added to the list.

• Communications: the main change is a technical yet helpful amendment of the definition of “Associated Facility”, so that it no longer requires an acquirer to determine the turnover of a target’s (third-party) clients who provide public electronic communication networks and services, in order to assess whether to notify.

• Critical Suppliers to Government: as a tidying up exercise, public sector authority data provision is being moved from the Data Infrastructure schedule. The corresponding public authorities in scope will be narrowed to the 24 ministerial departments currently in the scope of the Critical Suppliers to Government schedule.

• Energy will see some small yet useful definitional changes, including a provision on multi-purpose interconnectors and a large cumulative capacity threshold, as well as aligning the definition of aggregator more closely with Ofgem’s.

• Suppliers to the Emergency Services will see immediate sub-contractors, with staff who must hold “NPPV Level 2” clearance or above, added to the scope. This is narrower than the once mooted change of adding all sub-contractors in the supply chain, which would have resulted in a significant number of acquisitions being caught, as is the case for the Defence sector.

• Synthetic Biology: some definitional simplifications are envisaged, including to the exemptions for gene therapies and cell therapies. However, this will remain a schedule requiring close consideration with a target business’ technical experts.

Annual Report

The Government has also published its latest annual report on the regime. This identifies a material increase in notifications from 847 to 1,079 since the last reporting period.[10] This is likely to reflect both deal flow and mix, as well as better identification of mandatory notifications by advisors. The proportion of notifications called in for an in-depth review has remained about the same, i.e. 4.5% compared to 4.4% in the previous period.[11]

The largest proportion of notifications were again associated with the Defence sector.[12] This is likely because the definition captures sub-contractors in the supply chain ending with the Ministry of Defence, a much wider net than in the case of the other sector definitions. We note that the consultation is not proposing to narrow this.

The largest proportion of accepted notifications were associated with UK acquirers.[13] This simply reflects the fact that much UK investment is domestic and is a reminder that the UK’s national security and investment regime is not a “foreign” direct investment regime, as many others are.

China continues to over-index when it comes to cases raising national security concerns: it accounted for 32% of call-ins,[14] compared to less than 2.5% of accepted notifications.[15] China also accounted for a large proportion (23%) of so-called final notifications,[16] i.e. cases which are ultimately cleared unconditionally but only following in-depth scrutiny. While high, these figures have decreased since the previous reporting period, which may be attributable to deal flows, possibly including certain deals involving Chinese acquirers no longer being pursued.

A relatively high proportion of notifications of Chinese investments are voluntary filings (for all other countries the vast majority are mandatory).[17] Presumably these are asset acquisitions, or potentially entity deals in other sectors, and advisers are (sensibly) recognising a high chance of call-in for a Chinese deal, and therefore covering off that risk up-front.

The report notes that, while the Government did not impose any penalties or conclude any criminal prosecutions, the Government did identify 60 offences of completing notifiable acquisitions without approval.[18] In such cases, parties were sent warning letters and required to specify steps taken to avoid a recurrence. We expect most of these offences were flushed out by companies making so-called retrospective validation applications (55 being received during the period[19]) – i.e. notifications designed to remedy past omitted mandatory notifications – although some may have come to light through the Government’s own initiative call-ins.[20] It also appears that the vast majority of retrospective validation applications did not raise substantive national security concerns – only one of 47 was subject to a call-in.[21] In our view, these were likely innocuous acquisitions mistakenly overlooked by businesses and their advisors, rather than malign attempts to circumvent the regime.

As regards timing, it is taking a median of 7 working days for mandatory notifications to be accepted as complete, i.e. before the statutory review period of 30 working days commences.[22] This ought to be factored into deal timetables.

Michael Reiss

---