TRW & Co · Foreign investment and national security
National Security and Investment Act: Mandatory Notification Explained
The National Security and Investment Act requires buyers to notify the UK government and obtain approval before acquiring control of an entity active in one of 17 sensitive areas. Deals completed without approval are void. Outside those areas, the government can still call in deals for up to five years. This guide explains thresholds, timelines, penalties and the 2026 reforms.
Key pointThe NSI Act has no turnover threshold and applies to UK acquirers and intra-group reorganisations, so a share transfer between two companies in the same group can be a notifiable acquisition if the target operates in a sensitive area.
At a glance
17 sensitive areas
Mandatory notification currently covers 17 areas, from Advanced Materials and Artificial Intelligence to Energy, Defence and Transport, defined in detailed regulations.
Trigger thresholds
Crossing more than 25%, more than 50% or 75% or more of shares or votes, or gaining power to pass or block resolutions, triggers notification.
Review timeline
The government has up to 30 working days after acceptance to clear or call in; assessment then runs 30 working days, extendable by 45.
Void and penalties
Completing a notifiable acquisition without approval makes it void; civil penalties reach the greater of 5% of worldwide turnover or £10 million.
2026 reforms
Government confirmed in March 2026 a new water schedule, standalone semiconductors and critical minerals schedules and a narrower AI schedule, via later regulations.
Swipe or scroll →
The short answer: when the National Security and Investment Act requires a filing
The National Security and Investment Act 2021 (NSI Act) requires buyers to notify the UK government, and obtain approval before completing, when they acquire certain levels of control over an entity active in one of 17 sensitive areas of the economy. These are "notifiable acquisitions". Completing one without approval makes the deal void and exposes the acquirer to civil and criminal penalties.
Outside mandatory notification, the government can still "call in" any qualifying acquisition of an entity or asset, in any sector, if it reasonably suspects a national security risk. Parties can file voluntarily to obtain certainty. There are no turnover thresholds and no small-deal exemption, and the Act applies to acquirers of every nationality, including UK buyers.
The regime came into force on 4 January 2022. It is administered by the Investment Security Unit (ISU) in the Cabinet Office, and the decision-maker is the Chancellor of the Duchy of Lancaster. As of October 2026, the government has confirmed changes to the list of sensitive areas, but the original 17 areas still apply until amending regulations take effect.
The legal framework: qualifying acquisitions and the 17 areas
The National Security and Investment Act 2021 creates two layers. The broad layer is the call-in power over "qualifying acquisitions" of entities or assets. The narrow layer is mandatory notification for acquisitions of qualifying entities carrying on specified activities in the UK, defined in the Notifiable Acquisition Regulations (NARs).
The 17 sensitive areas
According to the Cabinet Office's guidance on acquisitions, the mandatory regime currently covers: Advanced Materials; Advanced Robotics; Artificial Intelligence; Civil Nuclear; Communications; Computing Hardware; Critical Suppliers to Government; Cryptographic Authentication; Data Infrastructure; Defence; Energy; Military and Dual-Use; Quantum Technologies; Satellite and Space Technologies; Suppliers to the Emergency Services; Synthetic Biology; and Transport.
Each area has a detailed schedule describing the activities caught. The definitions are technical, and whether a target falls inside them often turns on precise facts about its products, customers or research. Being "in" a sector in a commercial sense is not the same as carrying on a specified activity.
Trigger events and thresholds
For entities, the mandatory regime is triggered when an acquirer's shareholding or voting rights cross certain thresholds (more than 25%, more than 50%, or 75% or more), or when the acquirer gains voting rights that let it pass or block resolutions governing the entity's affairs. Acquiring "material influence" over an entity's policy is a qualifying acquisition that can be called in, but it does not by itself trigger mandatory notification. Acquisitions of assets, such as land, tangible moveable property and intellectual property, can be called in but are not subject to mandatory notification.
Entities and assets outside the UK can be caught if they have a connection to the UK, for example through UK activities or the supply of goods or services to UK customers.
The process and statutory timelines
Filings are made through the online notification service. There is no filing fee. The statutory clock counts working days and excludes weekends and public holidays in any of the four UK nations.
- Scope assessment. Analyse the target's activities against each NARs schedule, the level of control being acquired and any UK nexus. Record the reasoning, whichever way it goes.
- Prepare and submit. File a mandatory or voluntary notification with information on the acquirer, its ownership, the target and the transaction. Incomplete filings are rejected.
- Acceptance. The government must decide whether to accept or reject the notification as soon as reasonably practicable. There is no fixed statutory period for this stage.
- Review period. Once accepted, the government has up to 30 working days to clear the deal or call it in.
- Assessment period. If called in, there is an initial period of 30 working days, which can be extended by a further 45 working days and then by agreement with the acquirer. Information and attendance notices stop the clock.
- Outcome. The government either issues a final notification clearing the deal or makes a final order imposing conditions, or in rare cases blocking or unwinding it.
Interim orders can restrict integration or information sharing while an assessment runs. Build NSI Act timing into the conditions precedent and long-stop date of the transaction documents; our guide to the UK M&A process explains how regulatory conditions fit into the deal timetable.
Preparing the notification
Much of the time in a filing under the National Security and Investment Act is spent gathering information about the acquirer rather than the target. Expect to provide details of the acquirer's ownership chain up to its ultimate controllers, its other UK and overseas holdings, any links to foreign governments, and the rights it will obtain under the transaction documents.
For funds, that can mean information about general partners, significant limited partners, co-investors and any side letters giving investors governance or information rights. Prepare this pack early and keep it updated, because serial acquirers can reuse much of it across deals.
The target's contribution is usually a description of its activities, products, customers and any government or defence contracts, framed against the relevant schedule. Consistency matters: what the parties say in the NSI Act filing should match what they tell the CMA, lenders and other regulators.
How the NSI Act interacts with merger control
The National Security and Investment Act is separate from competition review under the Enterprise Act 2002. A deal can require an NSI Act filing without meeting any CMA threshold, and vice versa. Where both apply, the processes run in parallel with different decision-makers, timetables and tests, so the deal timetable must accommodate whichever takes longer. Public interest merger powers on national security grounds were largely replaced by the NSI Act when it came into force.
Call-in risk for deals that are not notified
For qualifying acquisitions outside mandatory notification, the government can call in a deal up to five years after it completes, and within six months of becoming aware of it. That five-year longstop does not protect a notifiable acquisition that completed without approval.
The call-in power is guided by a published statement setting out three risk factors: target risk (what the target does and could be used for), acquirer risk (who the acquirer is and its links to hostile actors), and control risk (how much control is acquired). A voluntary notification can be sensible where the target sits close to a sensitive area, the acquirer has links that may attract attention, or the deal is significant enough to be reported publicly.
The National Security and Investment Act applies to UK and overseas acquirers alike, and to internal reorganisations that change who holds the relevant shares or votes. Intra-group restructurings involving a target in a sensitive area can be notifiable even though ultimate ownership does not change. Check before you move shares between group companies.
Mandatory, voluntary or no filing: options compared
| Route | When it applies | Consequence of not filing | Typical use |
|---|---|---|---|
| Mandatory notification | Control thresholds crossed in an entity carrying on activities within one of the 17 areas | Deal is void; civil and criminal penalties possible | Required before completion |
| Voluntary notification | Any qualifying acquisition of an entity or asset not subject to mandatory notification | Deal stands but can be called in for up to five years | Gaining certainty where risk factors are present |
| Retrospective validation application | A notifiable acquisition completed without approval | Deal remains void until validated | Remedying a missed filing |
| No filing | Acquisition not notifiable and low national security risk | Residual call-in risk | Most transactions |
Penalties and consequences
A notifiable acquisition completed without approval is void. That can unravel share transfers, board appointments and financing structures. The acquirer can apply for retrospective validation, but validation is not guaranteed and may itself lead to a full assessment.
The guidance states that a civil penalty can be up to 5% of the organisation's worldwide turnover or £10 million, whichever is greater. Completing without approval is also a criminal offence, and the Act allows penalties for failing to comply with orders or information requests. Courts have upheld final orders requiring divestment, which shows the government is willing to use its powers on completed deals.
Final orders are not limited to blocking deals. Conditions in final orders can include, for example, restrictions on access to sensitive information and sites, requirements to maintain UK capabilities or supply, and governance commitments such as security-cleared directors. These conditions can last for years and affect how the acquirer integrates and manages the business, so model them before signing. Breach of a final order is itself an offence, and the acquirer's compliance with conditions should be tracked as an ongoing obligation, not a closing formality.
The 2026 reforms: water, semiconductors, critical minerals and AI
On 12 March 2026 the government published its response to the consultation on the Notifiable Acquisition Regulations. It confirmed that it will:
- create a new mandatory schedule for the water sector, focused on water and sewerage undertakers;
- separate Semiconductors and Critical Minerals from the wider Advanced Materials schedule into standalone schedules;
- narrow the Artificial Intelligence schedule so that it focuses on entities that develop or modify AI systems, with exclusions for routine business use and licensed third-party systems; and
- make targeted clarifications to areas including Communications, Critical Suppliers to Government, Data Infrastructure, Energy and Suppliers to the Emergency Services.
The response stated that secondary legislation would be laid in Parliament later in 2026, with updated guidance. Until the amending regulations are in force, the existing schedules apply. Deals that will sign before, and complete after, the change need analysis under both versions. Check the Cabinet Office NSI Act collection for the current position before relying on any new definitions.
Illustrative scenario: a minority investment in an AI start-up
This scenario is illustrative only and does not describe any real client or case.
An overseas venture fund plans to take 30% of a UK start-up that develops computer vision software for logistics clients. The fund will also have one board seat and veto rights over the annual budget.
Crossing 25% of the shares in an entity whose activities fall within the Artificial Intelligence schedule would make this a notifiable acquisition, so the investment cannot complete without clearance. The parties should check the schedule carefully, including whether the start-up develops AI as defined, and allow for the review period in the term sheet. If the start-up merely used third-party AI tools, the analysis might differ, particularly once the narrower AI definition takes effect. Our venture capital team sees these questions regularly in growth-stage rounds.
Risks and common mistakes
Assuming UK acquirers are exempt
The National Security and Investment Act is not limited to foreign investment. A UK buyer acquiring a notifiable stake in a qualifying entity must notify in the same way as an overseas buyer. Acquirer risk is assessed differently, and UK acquirers with no concerning links may be cleared quickly, but the filing obligation and the voidness consequence still apply. Domestic private equity funds and corporate groups have been caught out by assuming otherwise.
Reading the sector schedules too loosely
The NARs schedules are detailed and technical. Some catch businesses that would not describe themselves as being in the relevant sector, such as a supplier of specific components or a data hosting provider. Others exclude businesses that seem obviously connected. A short written analysis against the exact schedule wording, ideally with input from the target's technical team, is the best protection. Where doubt remains, the ISU can sometimes be approached informally.
Forgetting about internal reorganisations and financing
Moving shares between group companies, appointing new holding entities or enforcing share security can all cross control thresholds. There has been discussion of reducing the burden for some of these events, but until the law changes, check each step of a reorganisation or restructuring against the mandatory regime. Lenders taking share security should also consider whether enforcement would be a notifiable acquisition.
Leaving NSI Act analysis too late in the deal
Because the review period only starts once the notification is accepted, late filings can delay completion by weeks. Run the analysis at the term sheet stage, collect acquirer information early, and agree in the transaction documents who prepares the filing, how information requests are handled and what happens if conditions are imposed. The same applies to any parallel UK merger control analysis.
Cross-border angle and next steps
Investors from South Asia, the Gulf and East Asia frequently acquire UK businesses in energy, technology, logistics and manufacturing. The NSI Act asks about the ultimate ownership of the acquirer, so funds and family offices should prepare clear ownership charts and information about limited partners, state links and co-investors. Our foreign investment and NSIA team works with colleagues in TRW & Co's Dhaka, Dubai, Singapore and China offices to prepare that information efficiently.
- Screen every UK acquisition and minority investment against the 17 areas at the term sheet stage.
- Track the 2026 amending regulations and analyse deals that straddle the change.
- Build NSI Act clearance into conditions precedent and long-stop dates.
- Consider a voluntary notification where risk factors are present.
- Check intra-group reorganisations and security enforcement for notifiable events.
For advice on a filing or a call-in, speak to our M&A team or contact our London office at Holborn Gate, 330 High Holborn, London WC1V 7QH, or email info@trw.co.
Frequently asked questions
01What is the National Security and Investment Act?
It is the UK's investment screening law, in force since 4 January 2022. It requires mandatory notification and approval of certain acquisitions of entities active in 17 sensitive areas, and gives the government power to call in other acquisitions of entities or assets that may raise national security concerns. It is administered by the Investment Security Unit in the Cabinet Office. It applies to acquirers of any nationality, including UK investors, and has no turnover thresholds.
02Which deals must be notified under the NSI Act?
A deal must be notified where the acquirer gains control of a qualifying entity that carries on specified activities in the UK within one of the 17 sensitive areas. Control means crossing more than 25%, more than 50% or 75% or more of shares or voting rights, or acquiring voting rights that enable the acquirer to pass or block resolutions. Asset acquisitions and material influence stakes are not subject to mandatory notification but can be notified voluntarily or called in.
03How long does an NSI Act review take?
After a notification is submitted, the government decides whether to accept it as soon as reasonably practicable. Once accepted, it has up to 30 working days to clear the deal or call it in. If called in, the assessment period starts with 30 working days, which can be extended by 45 working days and then further by agreement. Information and attendance notices pause the clock. Most notified deals are cleared at the review stage, but timing should be built into the deal documents.
04What happens if you complete a notifiable acquisition without approval?
The acquisition is void, meaning it has no legal effect. The acquirer may face civil penalties of up to 5% of worldwide turnover or £10 million, whichever is greater, and criminal liability. The parties can apply for retrospective validation, but the government may conduct a full assessment before deciding and validation is not guaranteed. The usual five-year time limit on call-in does not protect a notifiable acquisition completed without approval.
05Can the government call in a deal that was not notified?
Yes. For qualifying acquisitions that were not subject to mandatory notification, the government can call in a deal up to five years after completion, provided it acts within six months of becoming aware of it. Its decision is guided by a statement of policy intent that looks at target risk, acquirer risk and control risk. Voluntary notification removes this uncertainty for deals where risk factors are present.
06What changes to the NSI Act were announced in 2026?
In March 2026 the government confirmed, following consultation, that it will add a new water sector schedule, separate semiconductors and critical minerals into standalone schedules, narrow the artificial intelligence schedule to entities that develop or modify AI, and clarify several other definitions. The changes require secondary legislation, which the government said it would lay later in 2026. Until the amending regulations are in force, the existing 17 areas and definitions continue to apply.
Sources and official materials
- National Security and Investment Act 2021 — The primary legislation
- Cabinet Office: Check if you need to tell the government about an acquisition — Guidance on the 17 areas, thresholds, timelines and penalties
- National Security and Investment Act 2021 collection — Official guidance, forms and updates
- Government response to the consultation on the Notifiable Acquisition Regulations — March 2026 sector changes
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.