Foreign Direct Investment (FDI) and National Security Screening

Ireland’s foreign direct investment screening regime went live in January 2025, with the recent publication of its first Annual Screening Report providing the earliest insights into how the new framework is operating in practice.  By contrast, the UK’s National Security and Investment Act (NSIA) has been in force since 2022 and has already become an established feature of the M&A landscape, with some fine tuning changes currently in progress.

Together, these regimes have fundamentally changed the regulatory landscape for transactions involving businesses or assets on either side (or both sides) of the Irish Sea.  Whether acquiring, investing or restructuring, investment screening has become an increasingly important part of early transaction planning.  A deal with any Irish or UK nexus should now routinely raise a key question:

Could this transaction require investment screening clearance?

Increasingly major jurisdictions around the world are introducing foreign direct investment or national security screening regimes.  This article co-authored by Sean Ryan, Corporate Partner; and Head of EU, Competition and Regulatory at Whitney Moore and Angela Gregson, Competition Partner and Head of Competition at Weightmans, compares the recently in force Irish FDI regime with the UK’s National Security and Investment Act (NSIA) regime and highlights what investors and dealmakers need to know, including:

• When notification is required;

• The principal similarities and differences between them;

• key procedural considerations; and  

• Practical steps to avoid unnecessary delays and minimise risk of significant penalties and divestment orders.

Is foreign investment required or can domestic transactions be caught?

Ireland’s Screening of Third Country Transactions Act 2023 specifically targets non-EU/EFTA investors, including UK and US acquirers. The first Annual FDI Screening Report shows that US and UK investors accounted for the vast majority of notified transactions during 2025, with smaller numbers involving investors from the UAE (2 transactions), Monaco (1 transaction) and China (1 transaction).

By contrast, the UK’s National Security and Investment Act 2021 (NSIA) applies to any investor, regardless of nationality — including domestic UK buyers. In fact, the NSIA annual report for the year ending 31 March 2025 reveals that 65% of all NSIA screened transactions in that period involved domestic UK acquirers. 

What level of investment triggers a mandatory notification?

Subject to satisfying certain conditions (e.g. the cumulative value of the transaction (including all transactions between the parties in the previous 12 months) must be €2m or more; and the transaction relates to, or impacts on, certain sectors (see below)), Ireland captures any acquisition of control of an asset or an undertaking in Ireland; or in certain circumstances an increase in the shares or voting rights held in an undertaking in Ireland to more than 25%, or from 50% to more than 50%.

The UK triggers mandatory notification if there is a ‘trigger event’ in relation to a “qualifying entity” i.e. a company with a connection to the UK (including those incorporated in the UK, but also those that have sales to customers in the UK, or production/offices in the UK) and who have activities that fall within one or more of seventeen defined sectors of strategic importance (see below).  The trigger events include an acquisition of shares or voting rights which lead to any of the following thresholds being reached or exceeded i.e. from below to above 25%, 50% or 75% respectively.

Which sectors are covered, and how broadly are they defined?

Ireland directly mirrors EU Regulation 2019/452, covering broadly defined critical infrastructure (including land and real estate for the use of such infrastructure); critical technologies and dual use items (including AI, cybersecurity, energy storage and/or semiconductors); the supply of critical inputs (including energy, raw materials or food security), access to sensitive information (including personal data) or the ability to control such information and/or media freedom.

The UK currently focuses on 17 defined sectors deemed to have strategic national importance, including advanced materials, advanced robotics, AI, civil nuclear, communications, computing hardware, critical suppliers to Government, cryptographic authentication, data infrastructure, defence, energy, military and dual-use, quantum technologies, satellite and space technologies, suppliers to the emergency services, synthetic biology, and transport.

What are the penalties for non-compliance?

Ireland imposes fines of up to €4 million and/or up to five years’ imprisonment. Furthermore, there are significant powers, and a wide discretion, afforded to the Irish Minister for Enterprise, Trade and Employment, including compelling divestment(s).  The UK regime provides for fines of up to 5% of worldwide group turnover or £10 million (whichever is higher), plus potential imprisonment for up to five years, and the acquisition is rendered legally void. 

The UK decision maker, the Chancellor of the Duchy of Lancaster, also has wide discretion in relation to the imposition of remedies for any identified national security concerns through the imposition of a final order setting out behavioural requirements e.g. relating to data governance and preserving key technologies within the UK, as well as in extreme cases, potentially a requirement to divest the acquired business.

How long does a review take, and is there a standstill obligation?

Ireland’s statutory review period runs to 90 days, extendable to 135 days, with a mandatory standstill preventing completion until clearance is obtained. In Ireland, during 2025 the average screening took just 40.5 days, with two-thirds of decisions issued in under 40 days.

In the UK, the Information Security Unit has an initial 30 working day review period which starts after a preliminary assessment of whether notification is accepted as complete (5-10 working days) to decide whether to clear the transaction or call it in for detailed assessment.  If called-in, the statutory period for detailed assessment can last for 75 working days or longer, by agreement, but is in practice longer due to information requests “stopping the clock” during the assessment period.  In our experience, in reality, the assessment period can last for 5 months or more with the operation of multiple periods where the statutory clock is stopped whilst information requests are being responded to. In the UK, the vast majority, 95.5% of the 1,143 notifications in 2024–25 were cleared within the initial 30-working-day review period.

What “call-in” powers does each regulator hold for non-notified deals?

Ireland’s Minister for Enterprise, Tourism and Employment can call in transactions for up to 15 months post-completion; and for up to 5 years in certain cases (i.e. where a transaction was captured by the mandatory notification rules, but was not notified).

In the UK, transactions can be called in for up to 5 years: The UK Information Security Unit actively monitors transactions to identify possible missed notifications and regularly sends out information requests to acquirers to establish if a mandatory notification requirement has been missed and to prompt retrospective notification or to gather information to decide whether to call the transaction in. During the 2024–25 period, seven transactions were called in for detailed assessment under the UK regime despite no notification having been made.

What do the statistics reveal about how each regime operates in practice?

Ireland’s 2025 Annual Report shows that 102 notifications were made during the year with screening notices issued in 26 cases. No transactions were blocked, but 2 transactions were cleared subject to conditions. The key sectors were energy, telecoms, ICT, healthcare and pharma.

In the UK, 17 final orders were issued in 2024–25, up from 5 the previous year — 1 transaction was ordered to be unwound, with conditional approvals setting out requirements to remedy the national security concerns e.g. relating to data governance, cyber security and safeguarding valuable know-how and technologies within the UK the preferred solution where possible.

How are the two regimes evolving — and what reforms are on the horizon?

In December 2025, the EU institutions reached a provisional agreement on a new FDI regulation requiring mandatory screening mechanisms in all Member States, which will require Ireland to adapt.

The UK has consulted on revised sector definitions, following which it has decided to include an additional sector to cover large water companies, and carving out critical minerals and semiconductors from advanced materials into stand-alone sectors, whilst narrowing the scope of the AI sector, in particular to carve out “off-the-shelf AI” products from the sector definition and therefore from the mandatory notification requirement.  An exemption for intra-group transactions is also expected.  The finer points of the changes are currently being drafted, with the secondary legislation enacting the changes expected to be laid before Parliament later this year.

How does Ireland’s EU membership affect the treatment of UK investors post-Brexit?

Ireland’s regime must be non-discriminatory between third countries, meaning post-Brexit UK investors cannot be treated more favourably than those from the US or China. There is no reciprocal carve-out for EU investors under the UK’s NSI Act.

How do the two regimes compare globally, and are they proportionate?

The UK receives more notifications than peer jurisdictions such as Germany and France, partly because its sectors are defined broadly with no exemption for smaller transactions. During 2024, Ireland shared 23 notifications with the European Commission and other Member States under the EU cooperation mechanism, and reviewed 74 notifications from other Member States with an Irish element. Ireland has stated its approach is intended to be proportionate and tailored without undermining its attractiveness to inward investment. Clearly national security is a high priority for the UK Government, which is understandable given the wider geo-political climate over recent years. However, the UK is also keen to facilitate investment into the
UK wherever possible. The UK regime has proven to be a fairly wide net, with the changes decided following consultation designed to hone the regime to better focus on aspects of the economy where national security concerns are more likely to arise.  In particular, intra-group transactions are viewed as attracting a significant volume of mandatory notifications in circumstances where national security concerns are unlikely to arise. Again, the soon to be implemented changes seek to address this issue.  In terms of the final orders ultimately imposed, there is a clear commitment to conditional approval as a preferred remedy over divestment which may be said to show a commitment to proportionality on intervention.