NSI Act annual report 2025/6: what the numbers mean for UK M&A

The Cabinet Office published the fifth annual report on the workings of the National Security and Investment Act 2021 (the “NSI Act”) on 14 July 2026, covering the year to 31 March 2026 (the “Reporting Period”).  Publication is a statutory requirement under section 61 of the NSI Act.  HLaw has followed this regime since it was a Bill in 2020, and we wrote about the fourth annual report, and the consultation published alongside it, this time last year.

The statistics tell a now-familiar story: more filings than ever, nearly all of them cleared quickly, and a single-digit number of interventions.  The Act, described on Royal Assent in 2021 as the “biggest shake-up of the UK’s investment screening regime in 20 years” came fully into force on 4 January 2022 and has settled into a routine workstream on UK M&A projects.  It is interesting to consider where the nine final orders came from:

Routine at scale

Notifications rose 15% year on year and are up 46% on 2023/24.  Mandatory notifications outnumbered voluntary ones by more than seven to one.  Every decision to call in or clear a notified acquisition was taken within the statutory 30 working day review period, and 95.6% of the 1,220 notified acquisitions reviewed were cleared at that first stage with no further action.  Of the 53 called-in acquisitions on which the Government made a final decision during the Reporting Period, 44 resulted in final notifications – including four withdrawals – and nine resulted in final orders.  For the overwhelming majority of transactions, the NSI Act is a form, a wait and then a clearance email.

The wait is worth planning for though.  The one metric moving in the wrong direction is the time taken to accept a notification – the administrative stage before the statutory clock even starts – which has risen from a median of seven working days to 11 for mandatory notifications, and from eight to 13 for voluntary notifications.  The Government attributes this to volume and says it is taking steps to bring it back down.  Allowing roughly two weeks to acceptance and then up to six weeks of review, a sensible base case for a mandatory filing is now around two months from submission to clearance.  Build that into the timetable and the regime is benign.  Discover it at signing and it is not.

Where the nine final orders came from

Of the nine final orders made in the Reporting Period, only four followed a notification made in the ordinary way: three mandatory and one voluntary.  Two followed retrospective validation applications, the statutory clean-up route under section 16 for notifiable acquisitions completed without approval.  The other three concerned acquisitions that were never notified at all, and which the Investment Security Unit (the “ISU”) identified through its own market monitoring.

In other words, five of the nine final orders did not follow a mandatory or voluntary notification: two followed retrospective validation applications, and three concerned non-notified acquisitions. Only the former necessarily involved a notifiable acquisition completed without approval. The report does not say that the three non-notified acquisitions were subject to mandatory notification, and it does not link them to the 42 potential failure-to-notify offences. Separately, the ISU received 42 retrospective validation applications during the year – down from 55 last year – and identified 42 potential offences of completing a notifiable acquisition without approval. No penalties were imposed; parties were instead required to provide reassurance that steps had been taken to prevent future non-compliance.

That forbearance should not be mistaken for an absence of teeth.  A notifiable acquisition completed without approval is void under section 13 of the NSI Act.  A person who, without reasonable excuse, completes such an acquisition without approval commits an offence under section 32.  For a business, the maximum fixed monetary penalty is the higher of £10 million and 5% of the total value of its turnover, including turnover outside the UK and the turnover of businesses it owns or controls.

And the ISU can reach deals that never came near it:  in the FTDI litigation, which we at HLaw have written about previously, the High Court upheld a final order requiring an acquirer ultimately owned by Chinese state-backed funds to divest its stake in a UK semiconductor business it had bought in December 2021 – a transaction called in nearly two years after completion.  The screening process is quick and predictable for those in it.  The screening process is quick and predictable for most notified deals. The greater risk lies in failing to identify a mandatory filing, or assuming that an acquisition outside the mandatory regime cannot be called in.

A regime for UK buyers too

A common misconception is that this is a foreign-investment regime.  It is not.  Acquirers associated with the UK featured in 72% of accepted notifications, 52% of call-ins and five of the nine final orders (acquirers associated with China featured in 30% of call-ins and three of the orders).  Mandatory notification turns on whether the target carries on activities within a specified description and whether the acquisition crosses a relevant control threshold, not on the nationality of the buyer. If a UK fund acquires a UK defence supplier whose activities fall within the Defence schedule and crosses such a threshold, it needs clearance in the same way as an overseas buyer.

Defence remained the busiest area of the economy, associated with 58% of notifications accepted or rejected during the Reporting Period.  The final orders, however, concentrated elsewhere:  advanced materials was associated with five of the nine, data infrastructure with three and military and dual-use with two.  The year’s only prohibition sat squarely in that first category: a final order made in August 2025 blocked the transfer of graphene-related assets and know-how by Versarien plc, a UK advanced materials company, into a proposed joint venture with a Chinese materials business.  The order was revoked in February 2026 once the deal was off.

Where deals were cleared subject to conditions, the published orders show a familiar menu:  keeping capabilities, assets and supply arrangements in the UK, information security controls, governance requirements and approval rights over onward transfers.  Parties on higher-risk deals should be pricing those conditions into structure and documents at the outset, not after call-in.

The perimeter moves later this year

The foreword commits to three changes:  exempting certain acquisitions from mandatory notification, updating the scope of the notifiable sectors and improving the notification forms.  None of this is abstract.  On 12 March 2026 the Government published its response to last summer’s consultation on the Notifiable Acquisition Regulations, confirming that it will create standalone schedules for critical minerals (covering all 34 minerals on the UK criticality list) and semiconductors (absorbing the existing computing hardware schedule), add a new schedule for the water sector, and narrow the artificial intelligence and communications schedules to cut out low-risk notifications – with the AI schedule refocused on entities that create or modify AI systems rather than those that merely use them, and clarifying amendments elsewhere.  The amending secondary legislation is expected later in 2026, together with updated guidance.

Separately, the Government announced last July that certain internal reorganisations, and the appointments of liquidators, special administrators and official receivers, are to be taken out of mandatory notification altogether.  That change requires further legislation and is still awaited.

For businesses in or near the 17 sensitive areas – and for anyone investing into AI, semiconductor, critical minerals, data infrastructure, energy or water assets – the practical point is that a filing analysis done under the current regulations may not survive contact with the new ones.  Deals signing in late 2026 should be checked against both.

Final thoughts

The fifth annual report describes a regime in a steady state:  more filings, stable clearance rates, fewer final orders than last year and, once again, no penalties imposed. The statistics are kindest to those who identify any mandatory filing early, timetable for it honestly and assess voluntary notification risk properly.  Most deals are not the problem. Getting the NSI Act perimeter analysis wrong still is.

Do please reach out to a member of the team if you would like to discuss the NSI Act or anything relating to corporate finance and M&A generally.

All the thoughts and commentary that HLaw publishes on this website, including those set out above, are subject to the terms and conditions of use of this website.  None of the above constitutes legal advice and is not to be relied upon.  Much of the above will no doubt fall out of date and conflict with future law and practice one day.  None of the above should be relied upon.  Always seek your own independent professional advice.

Humphreys Law