2026 Annual Report on the UK National Security and Investment regime

On 14 July 2026, the UK Cabinet Office published the fifth Annual Report on the National Security and Investment Act 2021 (NSI Act) (the Report). The Report provides summary information and statistics relating to the review of transactions and investments on national security grounds in the UK during the period 1 April 2025 – 31 March 2026.

Unlike the 2024-2025 Annual Report, which paints a picture in the foreword of “a fracturing of the old liberal order” and “conflict”, the 2025-2026 Report does not refer to “global instability”.  Indeed, it appears to take a deliberately measured tone in a world where scrutiny of deals on national security grounds is becoming an ever-greater focus in many board rooms. This perhaps reflects, as the UK government acknowledges in its foreword, the need for inward investment to drive growth (and the consequently careful balance that the UK government suggests it seeks to strike with its primary duty of keeping British people safe). 

The Report stresses that many of the mandatory notification sectors are in high growth areas of the economy; this may be one of the drivers of the increase in notifications noted by the Government which has led to “a small increase in time taken to accept notifications” that it “… is taking steps to reduce”. However, the Report also notes in its short foreword that due to “our fast-changing world and increasingly interconnected economy”, the Government is adapting NSI legislation to make sure it remains as relevant as possible.

Notifications continue to increase with the vast majority cleared with no further action 

The Investment Security Unit (ISU) received 1,324 notifications during the 2025-26 reporting period, compared with 1,143 in 2024–25 – an increase of 15% year-on-year and 46% by comparison with the 2023/24 reporting period. This is in line with other European foreign direct investment (FDI) regimes which are also seeing a steady increase in the number of notifications. For example Italy, France, Germany and Spain have also seen increases in notifications in the region of 14 to 30% in their most recent reporting periods. Indeed, press reports suggest that there was a further increase in 2025 in French FDI notifications (to 415, the highest number ever received). However, in the United States where the FDI regime (CFIUS) has been established for longer, the number of notifications has decreased slightly each year in the three years to 2024. 

The upwards trend in EU Member States seems likely to continue given not only the new EU FDI Screening Regulation but national legislative changes including Spain’s extension of its FDI regime for prior authorisation of EU and EFTA investors to the end of 2026, the planned consolidated German FDI screening legislation and lowering of the intervention threshold (expected this year) and plans to broaden the scope of regimes reportedly under consideration (Austria, France and the Netherlands) and/or to lower notification thresholds (Austria and Norway). This was certainly the result of the 2023 changes to the Swedish FDI regime (which significantly broadened its scope); Sweden is now the jurisdiction which receives the most notifications in the EU (1,987 in 2025).

Of the 1,324 notifications received by the ISU, 1,242 were accepted and 37 were rejected. The split between mandatory notifications (1,135), voluntary notifications (147), and retrospective validation applications (47) has remained broadly consistent, with a slight decrease in the number of retrospective validation applications. This slight decrease, from approximately 5% of all applications received in 2024-2025 to approximately 3% of all applications received in 2025-2026 suggests that 2024-2025 was the high-water mark for retrospective validation applications (see table below). This may reflect investors and advisors’ increased awareness of the regime as it becomes more established and a desire for parties to address any risks to deal certainty at an early stage of the transaction process. 

As in previous years, the large majority of notifications reviewed were cleared without further action. Of the 1,220 notified acquisitions reviewed in 2025-26, 95.6% (1,166) were cleared with no further action, and 4.4% (54) were called-in for further assessment – this is consistent with the previous reporting period, during which a 4.5% call-in rate was recorded. In addition to the 54 notified transactions that were called-in during the 2025-2026 period, a further six, non-notified, acquisitions were issued with call-in notices; this clearly demonstrates the potential risks of failing to notify. 

The Government issued 44 final notifications during the 2025-2026 period – 28 related to mandatory notifications, 13 followed voluntary notifications and three related to non-notified acquisitions.

Acquirers from the UK, China and the US continue to make up the largest proportion of called-in deals

Of the 1,324 notifications received, the largest proportion involved acquirers associated with the UK (72%), followed by the US (28%), France (6%) and Luxembourg (6%). However, these proportions are not replicated in the number of call-in notices: of the 60 acquisitions called-in during 2025–26, just over half involved acquirers from the UK (52%), followed by China (30%) and the US (23%). This is similar to the previous period in which the largest proportion of called-in acquisitions involved acquirers associated with the UK (48%), followed by China (32%) and then the US (20%). This reflects the UK regime’s application to all rather than just “foreign” investors and its multi-factorial approach to risk assessment, which not only takes into account the identity of the acquirer but also the level of sensitivity of the target and the level of control being acquired. 

Whilst not all jurisdictions give the same level of transparency on the origin of investor for notifications and in-depth reviews, based on the information available we are seeing a broadly similar picture in other FDI regimes (such as the Netherlands) where domestic investors are within scope; in 2025 53% of cases involved Dutch acquirers. For those regimes where only third-country investors are within scope and which report on investment origin, the US is frequently the largest foreign inward investor (e.g., FDI regimes in Australia, Germany, Ireland or Spain).

The Report suggests that investments originating from China continue to be subject to particular scrutiny by the UK government; given China accounted (in 2025/26) for only 2% of notifications received by the UK government, it appears that a significant proportion of these were called-in.  This again aligns with the particular scrutiny that EU member state FDI authorities appear to have been giving to Chinese acquisitions in recent years, as reflected in a number of high-profile remedy or prohibition decisions (discussed below). 

Defence continues to dominate the acquisitions that are called-in

The defence sector has consistently accounted for the largest proportion of call-in notices since the regime was introduced, and this trend has continued in 2025-2026. Of the 60 acquisitions called-in, 47% related to Defence, 33% related to Critical Suppliers to Government and 33% related to Military and Dual-Use. 

However, of the nine final orders made during the reporting period, five related to Advanced Materials, three related to Data Infrastructure and two related to Military and Dual-Use. While the reporting issued by other FDI regimes does not necessarily allow for direct comparison, there are suggestions that this is consistent with areas of particular concern for other FDI authorities. For example, in January 2026, the French government blocked the acquisition of Eutelsat’s ground antenna business by EQT, given both the company’s strategic significance as a competitor in satellite internet provision and the antennae’s use for both civilian and military communications. Similarly, in Italy, structural remedies were imposed in relation to Advent and Nextalia’s acquisition of Tinexta, a digital technology company which required the spin-off of its defence/cybersecurity business into a blind trust for subsequent on-sale to a government approved buyer.

Review timeframes: small increase in time to accept notification

In line with every prior reporting period, the Government took all decisions on whether to call-in or clear notified acquisitions within the statutory 30 working day review period.

There was a general perception amongst practitioners in the early part of 2026 that it was taking considerably longer for notifications to be accepted. This is reflected in the average figures for 2025-2026 which show that it took on average 11 working days from receipt of a mandatory notification to acceptance, 13 days for voluntary notifications, and 10 days for retrospective validations. This is materially longer than in the previous reporting period when it took an average of 7 working days from receipt of a mandatory notification to acceptance, 8 days for voluntary notifications and 6 days for retrospective validations. The Government notes in its Annual Report that this was due to the increase in the number of notifications it received and that “it is taking steps” to reduce the time to accept notifications.

In 2025-26, the ISU took an average of 69 statutory working days – or 97 calendar days – between calling-in an acquisition and issuing a final order, compared with 70 statutory working days (approximately 100 calendar days) in 2024-25. This may suggest that once a notification has been accepted, there has been little change in the length of the review period or that longer delays later in the process have not yet impacted the average annual figures.

In the US, CFIUS continues to adhere to its statutorily prescribed review deadlines (e.g., 45 calendar days for initial Notice review, with another 45 calendar days for second stage review if required by CFIUS). However, the recent 76-day partial US government shutdown, which ended on 30 April 2026, continues to impact CFIUS timings in some cases, with lingering delays seen particularly in the start of formal review periods as CFIUS continues to work through the filing backlog.

Appeals, compliance and enforcement 

In the period covered by the Report, a total of 9 approvals were issued subject to conditions and one acquisition was blocked (10 final orders in total). This is a decrease from 17 final orders made in the previous period. It is not clear whether this is due to a dampening effect of the regime on certain investments or a general softening of the number of in-scope acquisitions in the last year. Of the nine approvals, three related to mandatory notifications, one related to a voluntary notification, two were made following retrospective validation applications and three related to non-notified acquisitions. Five final orders were associated with acquisitions in Advanced Materials, three final orders related to Data Infrastructure and two related to Military and Dual-Use. This is a change from the previous year when nine of 17 final orders related to acquisitions associated with the Defence sector. 

By origin of investment, a similar picture emerges in 2025-2026 as in the previous year, with the majority (56% or five out of nine) of remedies being required in acquisitions involving investors associated with the UK (compared with 65% or 11 out of 17 of the final orders in 2024-2025) and a third (three out of nine) of the final orders being made in acquisitions involving investors associated with China (compared with 41% or 7 out of 17 of the final orders in 2024-2025).

The only transaction that was blocked in 2025-2026 related to a joint venture between a UK advanced materials company and a Chinese advanced materials company acquiring tangible and intangible assets relating to the production and use of graphene. The concerns included the security of know-how and intellectual property relating to the production and use of graphene for dual-use applications. The final order was later revoked when the acquisition was abandoned.

Whilst not all jurisdictions publish full data on the outcome of transactions, the single prohibition in the 2025-26 reporting period appears in line with outcomes in other major FDI regimes where the blocking of a transaction is rare. It also appears to align with another trend; that prohibitions not infrequently relate to transactions involving Chinese investors. While investors originating from a range of other jurisdictions have had transactions prohibited (as the Eutelsat case mentioned above or the 2025 block under the Australian regime of Mayne Pharma’s acquisition by US-based Cossette Pharmaceuticals make clear), it is notable that the two transactions prohibited by CFIUS in the 2025-26 period, Germany’s most recent prohibition (in 2024) and, indeed, the Czech FDI authority’s first prohibition (in 2025) all related to Chinese investors or (in CFIUS’s case) were motivated by US-China competitive and strategic considerations. 

The picture on outcomes may not reflect the true picture as parties may withdraw their notification and abandon a transaction if “the writing is on the wall”; it is unclear whether this was the case in any of the 4 withdrawals in the 2025-6 reporting period covered by the Report. However, it is worth noting that in 2024 Italy prohibited 2 transactions but a further 5 were withdrawn, while in the Netherlands and Spain there were no prohibitions in 2025 but 8 and 7 withdrawals respectively. 

The UK Government required remedies in deals across a variety of sectors in 2025-26, including the Internet of Things, graphene-based technology, microelectronics, telecommunications and quantum computing. Common conditions imposed during 2025-26 have included requirements to maintain certain functions within the UK and continue to supply certain products or services to the UK Government and requirements to limit licensing or sharing of intellectual property and data with the acquirer or third parties.

During the 2025-2026 period, the Government identified 42 potential offences of completing a notifiable acquisition without approval. This is down from the last reporting period when 60 such incidents were identified. However, like the previous period, no penalties were imposed and again the relevant parties were simply required to provide reassurance that steps had been taken to prevent any recurrence. 

It is notable that even in more recently established FDI regimes, fines are starting to be issued for failure to file - a fine was issued in the Netherlands in its most recent reporting period for a failure to notify a transaction that fell within the scope of the Vifo Act. CFIUS is perhaps the most aggressive enforcer in this respect, having in recent years taken action against companies it found had violated US regulations as well as certain mitigation agreements issuing civil monetary penalties ranging (per public reports) from US$100,000 to US$ 60 million. It is still too early to say whether, in future years, the UK will start to take this approach for cases of failure to file.   

Looking ahead: what does this mean for UK investors?

For investors looking at UK-based targets, the Report demonstrates that the UK Government is continuing to increase its scrutiny of transactions involving UK entities active in sensitive sectors and that acquirers linked to certain jurisdictions remain more likely to come under particularly close scrutiny (but could manage to secure a clearance). 

With proposed new legislation in the UK expanding the sectors covered expected to come into force when the parliamentary timetable allows, a continued increase in the number of notifications in the coming years seems likely. A similar continued upward trend in the number of notifications across EU Member States’ FDI regimes also seems likely as, in addition to implementing the requirements of EU FDI Screening Regulation over the next eighteen months, many are broadening the scope of the sectors they cover and/or lowering the trigger thresholds. 

It is also noteworthy that a number of transactions that have been cleared conditionally recently have involved the acquisition of intangible assets such as intellectual property and data, with remedies including restrictions on how that information can be shared or used. This suggests that the UK regime may be seeking to put in place pragmatic remedies that seek to bridge commercial and national security needs. The small number of transactions either prohibited or which the UK government required to be unwound (both in absolute terms and as a proportion of notifications) suggests that the UK government is, as its commentary on the Report suggests, continuing to tread carefully the line between encouraging inward investment to drive UK economic growth and, where necessary, protecting the UK’s national security interests.