The National Security and Investment Act 2021 (NSI Act) is one of the most significant regulatory developments affecting UK mergers and acquisitions, foreign direct investment and corporate transactions. Under certain circumstances, a failure to comply with the regime can render an acquisition legally void and expose parties to substantial financial penalties.

Imagine acquiring a promising artificial intelligence start-up, celebrating completion, and then discovering months later that the transaction is legally void and potentially subject to a multi-million-pound penalty and government intervention.

This is not theoretical. It reflects the regime created by the National Security and Investment Act 2021 (NSI Act), which gives the UK Government significant powers to review and intervene in transactions that may pose a risk to national security.

For businesses, investors and corporate advisers, understanding the NSI Act has become an essential part of dealmaking. Questions about the regime now routinely arise during M&A due diligence, transaction structuring and investment assessments, even where the Act is ultimately unlikely to apply.

NSI Act at a Glance

Key points to know about the NSI Act:

• The Government can review acquisitions that may affect UK national security.
• Certain acquisitions involving entities operating in 17 sensitive sectors require mandatory notification before completion.
• Failure to obtain approval where required can result in a transaction being legally void.
• Civil penalties can reach 5% of worldwide turnover or £10 million, whichever is greater.
• The regime applies to both UK and overseas investors.
• The Government also has "call-in" powers to review some transactions retrospectively.

What Does the NSI Act Do?

The NSI Act allows the Government to scrutinise, review and, where necessary, intervene in acquisitions that could pose a risk to UK national security.

The regime applies to both UK and overseas investors and captures a wide range of transactions, including acquisitions of:

• companies and shares
• voting rights
• land
• intellectual property
• other qualifying assets

Certain acquisitions involving entities operating in one of 17 sensitive sectors require mandatory notification and approval before completion. These sectors include artificial intelligence, defence, energy, communications, data infrastructure, quantum technologies and synthetic biology.

Failure to comply with the mandatory notification regime can have serious consequences.

Who Needs to Consider the NSI Act?

The NSI Act is relevant to a wider range of organisations than many businesses initially realise. Parties that should consider whether the regime applies include:

• Private equity firms
• Venture capital investors
• Corporate acquirers
• Foreign investors
• Technology companies
• Defence contractors
• Infrastructure investors
• M&A advisers and legal advisers

The requirement to assess NSI risk is increasingly viewed alongside tax, competition law and financial due diligence as a standard component of transaction planning.

What Happens if You Ignore the NSI Rules?

The penalties under the NSI Act are deliberately severe.

If a transaction that should have been notified completes without approval:

• it may be legally void, meaning it has no effect in law
• civil penalties of up to 5% of worldwide turnover or £10 million (whichever is higher) may apply
• individuals may face criminal liability, including potential imprisonment

The key point is that national security considerations must be addressed before completion, not afterwards.

Example 1: Acquiring an AI Business

Consider a private equity firm acquiring a UK-based artificial intelligence business specialising in machine learning systems used by emergency responders. The transaction value is modest, and the parties move quickly to complete.

Months later, it becomes apparent that the target's activities fall within a mandatory notification sector.

The consequences could include:

• the acquisition being declared void
• significant financial penalties
• conditions restricting access to technology or sensitive data
• a detailed government review well after completion

The important point here is that the value of the deal is not what matters. Even a smaller transaction can fall within the NSI Act if the business being acquired operates in a sensitive sector.

Example 2: Acquiring Intellectual Property

It is a common assumption that the NSI Act only applies to company acquisitions. That is not the case.

For example, a defence contractor acquiring encryption software developed by a UK technology business may not be purchasing the company itself, but only its intellectual property.

Because the Act extends to asset acquisitions, the Government may still review whether the transfer gives rise to national security concerns. This broader scope could surprise investors who are more familiar with traditional merger control regimes.

Example 3: Overseas Investment in Data Infrastructure

Consider an overseas infrastructure fund acquiring a business that operates data storage facilities supporting public sector organisations.

While the transaction may appear commercially straightforward, data infrastructure is a specified sensitive sector under the NSI regime. The Government may therefore require notification and assess issues such as:

• access to sensitive information
• cyber resilience
• control of critical infrastructure

Importantly, this review is based on national security rather than competition concerns. A transaction can therefore be scrutinised even where there are no traditional competition issues.

Real-World Impact of the NSI Act

The NSI regime is actively used. The Government receives more than 1,000 notifications annually, demonstrating how embedded the regime has become within UK investment and acquisition activity.

Although only a relatively small proportion of transactions ultimately result in conditions being imposed or deals being blocked, the Government regularly exercises its call-in powers to review acquisitions that may raise national security concerns.

The regime is therefore not a theoretical risk. It is an established part of the UK's investment screening framework.

As a result, NSI analysis now sits alongside tax, competition law and financial due diligence as a core part of transaction planning.

Key Lessons for Businesses and Investors

The NSI Act has materially altered the UK deal landscape. Three key points should be kept in mind:

• Small deals are not exempt. National security risk is more important than transaction value.
• Assets can be caught as well as companies. Intellectual property, technology and land may all fall within scope.
• The consequences of non-compliance are significant. Transactions can be void and penalties can be substantial.

Additionally, businesses should remember that:

• The regime applies to both UK and overseas investors.
• Transactions involving emerging technologies often require closer scrutiny.
• NSI considerations should be assessed at the earliest stages of transaction planning rather than immediately before completion.

Frequently Asked Questions About the NSI Act

What transactions require mandatory notification under the NSI Act?

Certain acquisitions involving entities that operate in one of the Government's 17 sensitive sectors require mandatory notification and approval before completion.

Can a transaction be void under the NSI Act?

Yes. If a transaction subject to mandatory notification completes without approval, it may be legally void.

Does the NSI Act apply to foreign investors?

Yes. The regime applies to both UK and overseas investors.

Does the NSI Act apply only to company acquisitions?

No. The Act can also apply to acquisitions of qualifying assets, including intellectual property, land and certain technologies.

What is the purpose of the NSI Act?

The purpose of the Act is to allow the Government to review and, where necessary, intervene in acquisitions that could pose a risk to UK national security.

The National Security and Investment Act represents a significant expansion of Government intervention in UK corporate transactions.

The issue is not confined to obvious areas such as artificial intelligence, defence technology or critical infrastructure. A wide range of transactions may require consideration under the regime.

For investors and advisers, national security due diligence is now a standard part of the deal process. Before completing any acquisition involving technology, infrastructure, data, intellectual property or other potentially sensitive activities, parties should assess whether the NSI Act applies.

Early consideration of NSI issues can help avoid delays, regulatory intervention, financial penalties and, in the most serious cases, a transaction being declared legally ineffective.