The National Security and Investment Act 2021 (NSIA) is the UK’s primary mechanism for screening certain acquisitions that may present a threat to national security.
Last month, the UK government published a formal response to its 2025 consultation setting out proposed changes to the mandatory notification regime. You can read more about the 2025 consultation in our previous briefing.
The government continues to refine the NSIA addressing the evolving nature of national security risks with feedback from businesses and stakeholders about the efficacy and scope of the regime.
The government has now confirmed its plans to implement certain reforms to refine and reorganise the 17 sensitive sectors which trigger mandatory notification. This will ensure the focus of the mandatory regime continues to be on genuine national security risks and will provide greater clarity for businesses around their notification obligations.
Key reforms
- Water (new mandatory sector): water and sewerage operators will be brought into scope for the first time to protect critical infrastructure. This sector will focus on major water companies and large independent providers. New operations that meet a minimum size threshold will also be caught by the mandatory regime.
- Semiconductors (standalone sector): this will be carved out from the existing Advanced Materials sector and merged with Computing Hardware to create a dedicated schedule covering additional activities such as chip design processes and advanced packaging.
- Critical Minerals (standalone sector): this will be carved out from the existing Advanced Materials schedule and will be revised to ensure ‘low-risk activities’ are not caught. The government will consider whether certain additional materials should be brought in scope.
- Artificial Intelligence (narrowed): this will focus on entities that develop or modify advanced AI systems; end-users of off-the-shelf or licensed third-party AI will be specifically excluded.
Other changes to existing sectors
Additional minor amendments will be made to some of the existing sectors to improve clarity on when businesses are required to notify. These take the form of clarificatory changes to the scope and/or definitions relating to Communications, Critical Suppliers to Government, Data Infrastructure, Energy and Suppliers to the Emergency Services.
Changes to the Synthetic Biology schedule were considered as part of the consultation but the government has concluded this category will remain unchanged, as attempts to further simplify the sector may result in gaps in the schedule.
Revised Memorandum of Understanding (MoU)
Last month also saw the Cabinet Office and the Competition and Markets Authority (CMA) sign a revised MoU, principally to regulate their co-operation when matters engage both the NSIA regime and the merger control regime.
Whilst not legally binding, it serves as a statement of intent and establishes a formal cooperation framework for acquisitions subject to both the NSIA and merger control under the Enterprise Act 2002. It sets out the roles and functions of the ISU and the CMA, the principles around information sharing between the two organisations and possible remedies.
Key takeaways
Secondary legislation is needed to implement the changes. This is expected to be published, together with updated guidance on the sensitive sectors, later in the year. Until then, the existing 17 sensitive sectors remain in force.
Notably, the March 2026 response was silent on previously announced plans to consider exemptions to the NSIA regime for internal reorganisations and insolvency appointments so we await further information on this.
We will continue to monitor developments in this area.
With thanks to Noaman Malik, a current trainee in the team, for contributing to this article.
This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.
© Farrer & Co LLP, April 2026
