The National Security And Investment Act 2021: Five Years On – What You Need To Know

Five years of reviewing investments, mergers and acquisitions

The National Security and Investment Act 2021 (NSIA) came into force on 4 January 2022, creating a standalone regime giving the UK Government broad powers to scrutinise – and potentially intervene in – acquisitions and investments on the grounds of protecting national security. Nearly five years on, the NSIA regime is well established. It replaced the national security aspects of the UK Government’s intervention powers under the Enterprise Act 2002 and operates alongside the UK merger control regime.

The scope of the NSIA is broad and the consequences of non-compliance are significant. Failure to notify and obtain approval for a mandatory acquisition renders the transaction void and may subject the acquirer to civil and criminal sanctions.

When the NSIA came into force, the UK Government estimated that the new regime would result in between 1,000 and 1,800 notifications, and around 100 “called-in” transactions, per year. Five annual reports on, that has proved broadly right on volume but not on intervention: the Investment Security Unit (ISU) received 1,324 notifications in 2025/26 (up around 15% on the prior year), but an average of around 55 transactions have typically been called in each year – roughly half the original estimate. Outright blocking of transactions has, as predicted, been rare: the UK Government issued only nine final orders in 2025/26 (eight allowing the transaction to proceed subject to conditions, and one outright prohibition), broadly in line with the original expectation of around ten remedies a year. Chinese-linked acquirers have, however, been the subject of disproportionate scrutiny: in 2025/26 they accounted for a small proportion of accepted notifications (the UK Government’s own figures fold China into a residual “Others” category, which together made up under 13% of accepted notifications), but around a third of all call-ins and final orders.

What transactions fall within the scope of the NSIA?

The NSIA establishes a mandatory notification regime for acquisitions of qualifying entities (i.e. share acquisitions) carrying on specified activities in 17 sensitive areas of the economy (outlined in the table below). It also establishes a wider voluntary notification and call-in regime which can apply outside those areas and to qualifying asset acquisitions.

The UK Government has published regulations containing detailed definitions of the activities within each of the 17 mandatory areas (though, rather unhelpfully, “national security” remains undefined).

The UK Government has confirmed that this list of sectors will expand to 19, with new standalone schedules for Critical Minerals and Semiconductors (the latter absorbing the current Computing Hardware sector) and Water, and a narrower Artificial Intelligence definition that excludes routine or “off-the-shelf” use of third-party AI systems. This requires secondary legislation which, at the date of this note, had not been laid before Parliament, with implementation expected later in 2026 – the sector table below reflects the regime as it currently stands.

There are no minimum turnover or share of supply thresholds for notification and, at present, no general exemption for small transactions or intra-group reorganisations. However, the UK Government has confirmed a targeted exemption for genuine intra-group reorganisations (and, separately, for certain insolvency appointments such as liquidators and administrators), which will take such transactions outside the mandatory regime once the relevant secondary legislation is in force – until then, the notification obligation continues to apply in the usual way.

The regime applies to both UK and non-UK acquisitions and investments. For mandatory notification, an overseas entity is caught if it carries on the specified activity in the UK. The wider call-in regime can also apply where an overseas entity carries on activities in the UK (whether through a UK subsidiary or otherwise) or supplies goods or services to persons in the UK.

Notification processes

1. Mandatory notification

The mandatory notification regime applies to acquisitions of qualifying entities (in essence, share acquisitions, including increases in current holdings) carrying on specified activities in any of the 17 areas where the acquirer gains control through: an increase in shares or voting rights from 25% or less to more than 25%; from 50% or less to more than 50%; from less than 75% to 75% or more; or voting rights that enable it to secure or prevent the passage of any class of resolution governing the affairs of the entity.

Completing a notifiable acquisition without approval renders it void. The acquirer can also face a civil penalty of up to £10m or 5% of global turnover – whichever is greater – and criminal liability. Individual officers of the acquirer may also be liable in relevant circumstances; the maximum sentence for completing a notifiable acquisition without approval is five years’ imprisonment.

2. Voluntary notification

The voluntary notification regime and the Secretary of State’s call-in power apply to qualifying acquisitions of both entities and assets, including outside the 17 mandatory areas. Qualifying assets include land, tangible moveable property and certain IP. Assets outside the UK can be caught where they are used in connection with activities carried on in the UK or supplies of goods or services to persons in the UK.

Parties can also notify voluntarily where the acquisition gives material influence over the policy of a qualifying entity. There is no fixed percentage threshold: material influence is fact-sensitive and can arise below 25% depending on matters such as shareholding, board representation and other rights. A voluntary notification may be appropriate where there is a material call-in risk, as clearance provides certainty that the acquisition will not subsequently be called in (absent false or misleading information).

3. Notification process and timing

The UK Government has 30 working days to decide whether to clear or call in the acquisition, once the notification has been accepted (there is no fixed statutory period for the initial acceptance stage during which the ISU checks that a notification is complete: in 2025/26 the median was 11 working days for mandatory notifications and 13 for voluntary notifications). If called in, the assessment period is a further 30 working days, extendable by 45 working days and, with the acquirer’s agreement, by a further voluntary period. Information or attendance notices can pause the assessment clock. Parties should therefore budget for a realistic end-to-end timetable of around 8-10 weeks from submission to clearance for a straightforward, non-problematic case.

Unlike in the case of competition clearance notifications, NSIA notifications will be confidential. Only notices of final orders made by the UK Government will be published, with sensitive information removed.

Parties can seek advice from the ISU for informal guidance on the implications of the regime for a particular transaction before submitting a notification. In practice, where there is any doubt as to whether the NSIA applies, the parties will often make the decision to make a notification in order to start the clock ticking rather than further delay waiting for a response from the ISU.

Notifications are submitted via the NSIA online service using prescribed forms. The forms require information about the transaction, the target’s activities and the ownership structures of the relevant entities, including the acquirer and target. There is no application fee.

4. Secretary of State call-in powers

The NSIA notification requirements are combined with a broad power enabling the Secretary of State to call in qualifying acquisitions that may present a risk to UK national security. For completed acquisitions, the power is generally subject to a five-year longstop and a six-month period from the Secretary of State becoming aware of the acquisition. The five-year limit does not apply to a notifiable acquisition completed without mandatory approval. For certain acquisitions completed between 12 November 2020 and 3 January 2022, the longstop is 4 January 2027, subject to the separate six-month period from the Secretary of State becoming aware of the acquisition.

The UK Government’s May 2024 statement on the exercise of the call-in power identifies three primary risk factors:

5. Retrospective validation applications

Alongside mandatory and voluntary notifications, parties should also be aware of the retrospective validation route. Where a notifiable acquisition completes without the Secretary of State’s prior approval, the transaction is void at law unless and until it is retrospectively validated. Any party to the transaction can apply to the ISU for retrospective validation, asking the Secretary of State to treat the acquisition as if it had been validly approved.

Retrospective validation is not guaranteed – the UK Government may still carry out a full national security assessment before granting it – and the parties remain exposed to civil and criminal penalties in the meantime. It should therefore be treated as a compliance fix of last resort, not as an alternative to notifying (or seeking informal ISU guidance) before completion.

Enforcement and litigation

Since the NSIA came into force, the UK Government has issued a number of final orders, most imposing conditions but occasionally requiring full divestment or prohibiting a transaction outright. Two such orders have been tested before the courts, unsuccessfully in both cases.

In R (L1T FM Holdings Ltd) v Chancellor of the Duchy of Lancaster, the High Court (and, on appeal, the Court of Appeal) upheld an order requiring LetterOne – ultimately owned by sanctioned Russian nationals – to divest its shareholding in

fibre broadband provider Upp Corporation Limited, holding that forced divestment without additional compensation did not breach its human rights.

In R (FTDI Holding Ltd) v Chancellor of the Duchy of Lancaster, the High Court likewise upheld a final order requiring FTDI – ultimately owned by Chinese funds with a Chinese state-backed private equity firm as general partner – to divest its 80.2% stake in a UK semiconductor company, rejecting every ground of challenge bar one (insufficient reasons), which did not invalidate the order.

Both decisions confirm the considerable deference the courts will give the executive on matters of national security.

Forthcoming reforms

Following a public consultation, the UK Government confirmed in March 2026 that it intends to bring forward secondary legislation to:

• expand the list of mandatory sectors from 17 to 19 by carving out standalone schedules for Critical Minerals and Semiconductors (absorbing the current Computing Hardware sector) and adding a new Water sector;
• narrow a number of existing sector definitions – including Artificial Intelligence – so that routine or “off-the-shelf” use of third-party technology falls outside scope; and
• introduce targeted exemptions removing genuine intra-group reorganisations and certain insolvency appointments (such as the appointment of liquidators, administrators and official receivers) from the mandatory notification requirement.

These changes had not been laid before Parliament as at the date of this note, but implementation expected later in 2026; we will update this note once the relevant regulations are made.

Separately, the Secretary of State is required by section 61 of the NSIA to review the operation of the Act within five years of its commencement and lay a report before Parliament – that statutory review therefore falls due around January 2027 and may itself prompt further reform.

Key considerations for acquirers and investors

1. Regular investors and serial acquirers should adopt a consistent NSIA screening process at the outset of transactions, including analysis of the target’s actual activities against the detailed mandatory definitions.
2. Due diligence should address both mandatory notification and wider call-in risk, including the target’s UK activities, sensitive technology, IP and data, customers and supply chains, as well as the control rights being acquired.
3. Parties should remain mindful of the extra-territorial reach of the NSIA. The mandatory regime can catch overseas targets carrying on specified activities in the UK, while the wider call-in power can apply to overseas entities that carry on activities or supply goods or services to persons in the UK and to overseas assets with a relevant UK connection.
4. Parties should prepare ownership and control information early, particularly where private equity or venture capital structures may make the notification process more involved.
5. Parties should address NSIA risk in the deal documentation, including warranty and indemnity protection.
6. For mandatory notifications, unless the parties are content to pre-notify ahead of signing, transaction documentation will generally need to provide for split exchange and completion. Deal documentation will need to include conditions precedent, cooperation and information obligations and appropriate longstop dates.
7. For voluntary notifications, the parties will need to evaluate the risks of the likelihood of the transaction being called in. The risks can be mitigated by making a voluntary notification, seeking guidance informally from the ISU prior to completion and / or starting the clock on the six-month period by publishing details of the deal immediately following completion to make the Secretary of State “aware” of the transaction (though the NSIA does not prescribe what will constitute awareness for this purpose).
8. Deal timetables should factor in the reality that ISU processing times have lengthened as notification volumes have grown – particularly for transactions that are called in – and parties should not assume an outcome will necessarily fall within the shortest statutory windows.
9. Transactions involving higher-risk acquirers, or falling within sectors such as Military and Dual-Use, Advanced Materials, Communications and Data Infrastructure, have consistently attracted a disproportionate share of call-ins and final orders relative to their notification volumes; by contrast, Defence generates by far the most notifications but converts to call-ins and final orders at a comparatively lower rate. This should be factored into risk assessment and deal planning from the outset, particularly given the high bar the courts have set for successfully challenging a final order (see above).
10. Parties should keep the forthcoming sector and exemption reforms under review, as these may narrow (or, in the case of the proposed Water sector, widen) the range of transactions caught by the mandatory regime once implemented.

Originally published 20 Aug 2026.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.