Regulation explainerMergers & Acquisitions

Foreign investment screening for technology acquisitions: a filing workflow

Acquisitions of companies working in AI, semiconductors, quantum, cryptography or sensitive data increasingly need national-security clearance as well as merger control. Whether a filing is required depends on who ultimately controls the buyer, what the target does and what data it holds. This page sets out the main US, UK and EU regimes, a workflow for the filing analysis, the review clocks, and how to build them into signing and closing.

Reviewed 8 min read

On this page
  1. Why technology targets attract national-security review
  2. CFIUS, the UK NSIA and EU screening at a glance
  3. Review clocks and the consequences of closing early
  4. Running the filing analysis before the timetable is fixed
  5. Building screening into conditions and the long-stop date
  6. Mitigation measures to expect in technology deals
  7. Other regimes a technology deal may need to check
  8. A hypothetical non-EU fund buying an EU AI start-up
  9. Questions and answers
  10. Sources

Why technology targets attract national-security review

Screening regimes ask two questions: who will control or influence the target, and could that create a national-security risk given what the target does? Technology companies meet the second test often. They develop dual-use AI, design chips, hold cryptographic know-how, supply defense or government customers, or hold large volumes of personal data.

Screening runs alongside merger control and is separate from it. A deal with no competition issue can still need a security filing, and the filings ask different questions. It also interacts with export controls, because a buyer's access to controlled technology can itself be a trigger; our guide to advanced computing export controls covers that side.

CFIUS, the UK NSIA and EU screening at a glance

These summaries orient a deal team. Counsel in each jurisdiction confirms whether and how a specific transaction is caught.

CFIUS review (31 CFR Part 800 and Part 802)

United States

Applies whenA foreign person acquires control of a US business, or makes certain non-controlling investments in a US business involved with critical technologies, critical infrastructure or sensitive personal data2.

  • Declarations are mandatory for certain transactions involving critical technologies and where a foreign government acquires a substantial interest; otherwise filing is voluntary1.
  • Parties choose an abbreviated declaration or a full notice, and clearance gives a safe harbor against later review1.

UK National Security and Investment Act (NSIA)

United Kingdom

Applies whenAn acquirer crosses a shareholding or voting threshold in an entity active in one of the sensitive areas, which include artificial intelligence, computing hardware, cryptographic authentication, data infrastructure and quantum technologies3.

  • Mandatory notification and approval before completion when holdings rise above 25%, above 50% or to 75% or more, or when the acquirer gains voting rights able to block resolutions3.
  • Voluntary notification for other qualifying acquisitions, which the government can still call in3.

Regulation (EU) 2019/452 and national screening laws

European Union, current framework

Applies whenA member state's own screening law catches the investment; the EU regulation, which applies until the revised framework replaces it, sets the rules for cooperation between member states and the Commission5.

  • File under each relevant national regime.
  • Expect other member states and the Commission to be able to comment on the screening5.

Regulation (EU) 2026/1386

European Union, revised framework

Applies whenFrom 17 January 2028, a non-EU investor, including through an EU subsidiary it controls, invests in a target within the common minimum scope6 7.

  • Every member state must require prior authorization for in-scope investments; the technology areas include semiconductors, quantum technologies and certain AI, namely general-purpose models with systemic risk and general-purpose AI for space or defense uses6.
  • National authorities keep the power to review non-notified deals after completion7.

Review clocks and the consequences of closing early

Statutory periods are maximums for each phase. Pre-filing contact, information requests and clock-stops can lengthen the real timeline.

StageCFIUSUK NSIAEU states under the revised regulation
Short form or initial reviewDeclaration: 30-day assessment1Up to 30 working days after the notification is accepted3First phase of up to 45 calendar days7
In-depth reviewNotice: 45-day review, then a 45-day investigation if needed130 working days after call-in, extendable by 45 working days and further by agreement3Second-phase length set by each member state7
Extensions and final stageOne 15-day extension of the investigation in extraordinary circumstances, and a 15-day presidential decision period1Information and attendance notices stop the clock3Varies by national law
Closing without a required clearancePenalties for missed mandatory declarations, and CFIUS can review non-notified deals1The acquisition is void, with civil penalties of up to 5% of global turnover or £10 million3Set by national law; non-notified deals can be reviewed after completion7

Running several regimes in parallel means the longest realistic path sets the long-stop date, not the shortest statutory one.

Running the filing analysis before the timetable is fixed

  1. Map the buyer's ownership chain

    Trace ultimate owners, fund investors with governance or information rights, co-investors and any state-linked shareholders, by nationality.

    Output
    Ownership and rights map
    Owner
    Buyer counsel

  2. Map the target's activities

    Compare products, R&D, customers and supply relationships with each regime's sector definitions, including government and defense customers.

    Output
    Activity-to-sector map
    Owner
    Target management with technical advisers

  3. Classify technology and data

    Establish export classifications of the target's technology and the categories and volumes of personal data it holds.

    Output
    Technology and data register
    Owner
    Technical and export-control advisers

  4. Determine triggers by jurisdiction

    For each regime, decide whether filing is mandatory, voluntary but advisable, or not needed, and record the reasoning.

    Output
    Filing matrix
    Owner
    Counsel in each jurisdiction

  5. Choose the filing strategy

    Decide on pre-filing contact, short or long forms, and how to keep facts and any mitigation proposals consistent across regimes.

    Output
    Filing plan
    Owner
    Lead counsel

  6. Fix the timetable

    Set conditions, the long-stop date and interim covenants from the filing plan rather than from the commercial wish date.

    Output
    Deal timetable
    Owner
    Deal teams

Building screening into conditions and the long-stop date

  • If

    A mandatory filing applies in any jurisdiction.

    Then

    Make clearance a condition precedent and set the long-stop date beyond the longest realistic review, including in-depth phases.

    Closing early can be unlawful, or in the UK leave the acquisition void.

  • If

    No filing is mandatory but the target is in a sensitive area.

    Then

    Weigh a voluntary filing against the risk of a post-closing call-in, and decide who bears that risk in the agreement.

    Authorities can review some completed deals for years afterwards.

  • If

    Several regimes apply.

    Then

    Coordinate submissions so that facts and mitigation offers are consistent, and agree which party leads each filing.

    An undertaking offered in one jurisdiction will be noticed in the others.

  • If

    The buyer's ownership is complex or partly state-linked.

    Then

    Prepare ownership disclosures early and consider structural changes, such as limiting certain investors' rights, before filing.

    Ownership questions are the most common cause of delays and information requests.

Mitigation measures to expect in technology deals

Where authorities identify a risk, clearance often comes with conditions. Know early which of these the buyer could accept.

0 of 6 checked

Other regimes a technology deal may need to check

Depending on where the target operates, the list can include Canada's Investment Canada Act, Australia's foreign investment review framework and Japan's Foreign Exchange and Foreign Trade Act, among others. Outbound rules matter too: the US Outbound Investment Security Program (31 CFR Part 850) prohibits or requires notification of certain investments by US persons in semiconductor, quantum and AI businesses connected to countries of concern8. For companies planning to enter new markets after a deal, our geographic expansion practice maps licensing and regulatory steps by country.

A hypothetical non-EU fund buying an EU AI start-up

Questions and answers

Does a minority investment in a technology start-up need a CFIUS filing?

It can. CFIUS jurisdiction covers certain non-controlling investments in US businesses involved with critical technologies, critical infrastructure or sensitive personal data when the investor gains rights such as board seats, access to material non-public technical information or involvement in key decisions. Some of these trigger mandatory declarations. Counsel should review the rights in the term sheet, not only the percentage.

Is the UK NSIA triggered if the target only uses AI rather than developing it?

Under the current regulations, the AI sector definition has been seen as catching some companies that only use AI. The government confirmed in March 2026 that it will narrow the definition to entities that develop or modify AI, with secondary legislation expected during 20264. Until that change takes effect, read the current definition carefully and consider a voluntary notification where the answer is unclear.

Can we sign before screening clearance?

Usually yes. Most regimes restrict completing the acquisition, not signing the agreement, so parties sign with clearance as a condition and close once it arrives. Interim covenants then govern the target's conduct in between, and the buyer must not take control early. Check each regime, because some also restrict pre-closing access to sensitive information or assets.

How does foreign investment screening differ from merger control?

Merger control asks whether a deal harms competition, using turnover or market-share thresholds. Screening asks whether a foreign investor's control or influence creates a national-security risk, using sector, ownership and shareholding tests. A deal can need one, both or neither, and the two run on separate timetables with different authorities.

Sources

  1. CFIUS overview: process, timelines and mandatory declarations — Committee on Foreign Investment in the United States · checked 10 October 2026
  2. 31 CFR Part 800: Regulations pertaining to certain investments in the United States by foreign persons — Electronic Code of Federal Regulations · checked 10 October 2026
  3. National Security and Investment Act: guidance on acquisitions — UK Government · checked 10 October 2026
  4. UK Government Confirms Changes to NSIA Mandatory Notification Sectors — Paul, Weiss · checked 10 October 2026
  5. Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments into the Union — EUR-Lex · checked 10 October 2026
  6. Regulation (EU) 2026/1386 on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452 — EUR-Lex · checked 10 October 2026
  7. Foreign Investment Screening in the EU: Revised Regulation to Take Effect in 2028 — Jones Day · checked 10 October 2026
  8. Outbound Investment Security Program — US Department of the Treasury · checked 10 October 2026

More in Mergers & Acquisitions

Back to Mergers & Acquisitions

Next step

Check your deal against screening triggers before signing

Send the buyer's ownership structure, the target's main activities and where it operates. We will help your counsel build the activity, technology and data maps the filing analysis needs.

Discuss a screening analysis