The National Security and Investment Act, Five Years On: What the 2025-26 Annual Report Tells Foreign Buyers

For any general counsel or dealmaker outside the UK weighing up a UK target, the fifth annual report on the National Security and Investment Act 2021 (Act) is essential reading, not because it changes the law, but because it shows, in hard numbers, how the regime is actually being applied. The headline point is simple: notification volumes keep climbing, call-in rates remain low and stable, and the overwhelming majority of transactions clear without incident, but certain acquirer nationalities and certain sectors, particularly defence, dual-use and critical infrastructure, you are statistically far more likely to attract scrutiny than the average filer.

Volumes are rising, but clearance rates are holding steady

The Investment Security Unit (ISU), which administers the Act, received 1,324 notifications in the 2025-26 reporting period, up from 1,143 the year before and 906 in 2023-24, a 15% year-on-year increase and a 46% increase over two years. Of these, 1,135 were mandatory notifications, 147 voluntary, and 42 retrospective validation applications for deals completed without prior approval. Mandatory filings continue to outnumber voluntary ones by more than seven to one, a reminder that most of this growth is being driven by transactions falling within the Act's 17 specified sensitive sectors rather than parties electing to file out of caution.

Despite that growth in volume, the proportion of deals cleared without further action has barely moved. Of the 1,220 notified acquisitions reviewed in 2025-26, 95.6% were cleared with no further action and only 4.4% (54 transactions) were called in for full assessment, essentially unchanged from 95.5% and 4.5% the previous year . Adding six non-notified acquisitions identified through market monitoring, the government issued 60 call-in notices in total, up from 56 .For clients used to more interventionist merger control regimes, this is a genuinely reassuring statistic: the vast majority of filers never see a call-in notice at all, and the government took every review-period decision within the statutory 30 working days.

Table 1: Five-year trend in notifications and call-ins

Notes: 2022 figures cover only the first three months following commencement on 4 January 2022. Figures for earlier years have in some cases been revised for accuracy in the current report.

Call-in decisions: rare, but concentrated

Once you look past the aggregate 4.4% call-in rate, a more nuanced picture emerges of what actually gets called in. Of the 60 call-in notices issued in 2025-26, 70% followed a mandatory notification, 18% a voluntary notification, 10% related to non-notified acquisitions caught through market monitoring, and just 2% arose from retrospective validation applications. That non-notified figure is worth pausing on: six transactions were called in even though no one filed, and the government separately identified 42 potential offences of completing a notifiable acquisition without approval during the year, none of which resulted in a penalty but all of which required parties to provide reassurance about future compliance. For advisers, that is a clear signal that the ISU's monitoring net catches deals that should have been notified but weren't, and that failing to notify carries real, if currently non-monetary, consequences.

Once called in, most transactions still clear. Of the 53 called-in acquisitions on which a decision was made in the reporting period, 44 (83%) resulted in a final notification with no further action, and only nine (17%) resulted in a final order imposing conditions, blocking the deal, or requiring unwind. Of those nine final orders, eight allowed the acquisition to proceed subject to conditions, and only one blocked the transaction outright. That is a marked improvement on the previous year, when 17 final orders were made from 52 decisions, though the report itself cautions that the small absolute numbers involved make it unwise to draw firm conclusions about a declining trend in remedies. Timelines have also lengthened modestly: it now takes a median 60 statutory working days from notification to a final notification and 99 statutory working days to a final order, both somewhat longer than the prior year's averages, and acceptance itself is taking longer too, rising from a mean of 7 working days to 10.

Origin of investment: the US dominates volume, but China dominates scrutiny

This is where the report becomes genuinely instructive for cross-border practitioners, because the pattern by origin of investment is stark and consistent year over year. Looking at accepted notifications generally, UK-associated acquirers made up 72% and US-associated acquirers 28%, with France and Luxembourg each at 6%. China barely registers in this raw volume metric, associated with only around 1-2% of accepted notifications in 2025-26, and Australia registers even less, at roughly 1-2%.

But volume tells only half the story. Turn to call-in notices, and the picture inverts dramatically. Of the 60 acquisitions called in during 2025-26, UK acquirers accounted for 52%, but Chinese acquirers accounted for 30%, despite representing barely a sliver of overall notification volume, with US acquirers at 23%. The same pattern holds, even more pronounced, at the final notification and final order stages: China accounted for 32% of final notifications issued (second only to the UK's 57%) and was the second most represented origin behind the UK in final orders made, with three of the nine orders in 2025-26 involving Chinese acquirers.

Table 2: China's share of call-in notices, final notifications, and final orders over time

Notes: percentages can exceed the totals shown elsewhere because an acquisition can involve multiple acquirers or origins of investment. The 2022/23 spike in China final orders reflects a period when the total number of final orders overall was also higher (15).

What this tells cross-border teams is that Chinese-origin deals are being called in and remedied at a rate wildly disproportionate to their share of overall M&A activity notified to the ISU, and that this has been a consistent feature since the regime's early years, even as the precise percentages have softened somewhat. US-origin deals, by contrast, are notified in large numbers (28% of accepted notifications) but called in at a rate roughly proportionate to, or only modestly above, that volume, at 23% of call-ins. Australian-origin acquisitions remain a minor category throughout the dataset: at the withdrawal and final order stages Australia recorded either zero or a single instance across the years reported, with one final order involving an Australian acquirer in 2024-25 and none since. That should not be read as complacency-inducing, however; Australian, and indeed other smaller-volume jurisdictions, still appear intermittently in call-in and final order data, and the government notes explicitly that the Act applies regardless of an acquirer's origin.

It is also worth flagging the wider spread of jurisdictions attracting attention. Singapore, Germany, Hong Kong, the United Arab Emirates, and Luxembourg all appear repeatedly across the call-in and final notification tables, sometimes at levels comparable to or exceeding Australia's. Advisers structuring holding company or SPV arrangements should note that "origin of investment" is assessed by reference to the immediate acquirer's headquarters or that of its ultimate beneficial owner, so layering a transaction through an intermediate jurisdiction does not change how the ISU categorises the true origin of capital.

Sectors and deal types that attract heightened scrutiny

The report is unambiguous about where scrutiny concentrates: defence. In 2025-26, Defence accounted for 58% of all accepted or rejected notifications, 47% of call-in notices, and 50% of final notifications, in each case the single largest category, and in each case larger than the prior year's equivalent figures. Military and Dual-Use and Critical Suppliers to Government round out the next tier, each associated with around a fifth to a third of notifications and call-ins. Interestingly, the sectoral pattern shifts once you look at final orders specifically: Advanced Materials produced the largest number of final orders (five of nine), followed by Data Infrastructure (three) and Military and Dual-Use (two), a marked change from the previous year when Defence itself topped the final order table. In other words, Defence deals are far more likely to be notified and called in, but once under detailed assessment, it is Advanced Materials and Data Infrastructure transactions that are proportionally more likely to result in binding conditions or blocks.

The most common reason notifications are rejected outright is worth noting for process hygiene: "withdrawal" was the single largest rejection category in 2025-26 (six of 37 rejected notifications), followed closely by a residual "Other" category (15) and notifications that should have been filed as mandatory rather than voluntary, or vice versa. That last point is a recurring theme across the years of data and underscores how easy it remains for parties, particularly those unfamiliar with the UK's mandatory/voluntary distinction, to misjudge which notification route applies to their transaction.

Practical themes for advisers and acquirers

Several broader observations emerge for practitioners structuring inbound UK acquisitions. First, the sheer growth in notification volume, up 46% over two years. This means the ISU's caseload is expanding even as its clearance rate stays flat, which appears to correlate with modestly lengthening processing times across almost every stage of the process, from initial acceptance through to final orders. Deal timetables should build in some buffer accordingly, particularly for transactions touching the higher-scrutiny sectors.

Second, the additional and voluntary period mechanisms remain a relevant, if modestly used, feature of the landscape: the additional period (an extension of up to 45 statutory working days) was used 18 times in 2025-26, and the voluntary period (a mutually agreed extension) only three times. Parties expecting a called-in deal to resolve within the basic 30-working-day initial assessment period should recognise that a meaningful minority of cases run considerably longer.

Third, and most importantly for the cross-border audience this article is aimed at, national origin remains a powerful, if imperfect, predictor of scrutiny. A US acquirer faces call-in risk roughly proportionate to, or only slightly elevated above, its very high share of overall notified activity. A Chinese acquirer, despite representing a small fraction of total notifications, continues to be called in, receive final notifications, and attract final orders at a rate many multiples of its notification share, a pattern that has held, with some year-on-year softening, across all five years for which data exists. Australian-origin deals, by contrast, remain a marginal category throughout the dataset, with limited evidence of heightened scrutiny beyond the ordinary background rate.

Conclusion

None of this suggests that the NSI Act is being applied inconsistently or unpredictably: the government took every review-period decision within its statutory deadline this year, the overwhelming majority of deals clear without any intervention, and where final orders are made, the large majority permit the transaction to proceed subject to conditions rather than blocking it outright. However, the data does confirm what many advisers suspect anecdotally: national security screening in the UK, much like comparable regimes elsewhere, applies a materially heavier hand to acquirers connected to certain jurisdictions and to certain strategically sensitive sectors, particularly defence, dual-use technology, critical suppliers to government, advanced materials, and data infrastructure. For US corporates, the message is one of relative reassurance, tempered by the reality that call-in rates track notification volume closely. For Chinese-connected buyers, and their advisers, early engagement, meticulous sector-mapping, and realistic timetable planning are essential, given the persistently disproportionate representation in call-in and remedy statistics. For Australian acquirers, the numbers are currently too small to draw firm conclusions, though the government's insistence that the Act applies without regard to origin means no acquirer should assume immunity based on jurisdiction alone.