NSI Act (National Security and Investment Act)

The National Security and Investment (NSI) Act came into force on 4 January 2022. Under the Act the UK goernment is able to scrutinise and intervene in certain acquisitions made by anyone, including businesses and investors, that could threaten the UK’s national security. The new rules empower the government to impose conditions on qualifying acquisitions of entities and assets, or, if necessary, to block or unwind the offending transactions.

The Secretary of State can “call in” (review) acquisitions if the government reasonably suspects that a qualifying acquisition has given rise to, or may give rise to, a risk to national security. This can occur up to 5 years after the acquisition or while the acquisition is in contemplation or progress. It is not possible to call in acquisitions that were completed before 12 November 2020.

The Act creates mandatory and voluntary notification regimes for the acquisition of entities and assets respectively.

  • Any party may notify the ISU about a qualifying acquisition of an asset and check whether the Secretary of State will call it in.
  • The acquirer of an entity must notify the government’s Investment Security Unit (ISU) prior to completion of a qualifying acquisition

Qualifying acquisitions 

The NSI Act only applies to qualifying acquisitions. An acquisition qualifies if all of the following apply:

  • the acquisition is of a right or interest in, or in relation to, a qualifying entity or asset(see paragraph below)
  • the entity or asset being acquired is from, in, or has a connection to the UK
  • the level of control acquired over the qualifying entity or asset meets or passes a certain threshold.

Qualifying entities and assets

In the higher education and research-intensive sectors, a qualifying entity could include a:

  • university
  • trust
  • university subsidiary
  • university spin-out
  • an unincorporated association, such as a research consortium
  • research organisation
  • private company or corporation doing contractual work with a higher education institution or research organisation

Qualifying assets include land, tangible, moveable property, and ideas, information or techniques which have industrial, commercial or other economic value (intellectual property), so this could be:

  • designs
  • plans, drawings and specifications
  • software
  • patents
  • trade secrets
  • databases
  • source code
  • algorithms
  • formulae
  • land
  • laboratory equipment

So if, for example, a third party sponsors research or a research position and acquires rights over intellectual property in or close to one of the 17 sensitive areas likely to give rise to national security risks (see below), this is a qualifying acquisition under the NSI Act and may be called in by the government.

The government has provided general guidance and guidance for academia which includes case studies.

Mandatory notifications

The requirement for mandatory notification only applies to qualifying acquisitions of entities in 17 sensitive areas the UK government considers likely to give rise to national security risks.

The 17 areas are:

  • Advanced Materials
  • Advanced Robotics
  • Artificial Intelligence
  • Civil Nuclear
  • Communications
  • Computing Hardware
  • Critical Suppliers to Government
  • Cryptographic Authentication
  • Data Infrastructure
  • Defence
  • Energy
  • Military and Dual-Use
  • Quantum Technologies
  • Satellite and Space Technologies
  • Suppliers to the Emergency Services
  • Synthetic Biology
  • Transport

The acquirer is legally required to ask the government for prior approval of the acquisition. Proceeding with the transaction without approval will mean the acquisition is void and may mean that the acquirer is subject to civil or criminal penalties.

When an agreement is proposed in which the University is likely to acquire control over an existing entity (for example, the University is acceding to an existing research consortium) the Principal Investigator will be asked questions about the technology and the transaction to assess the possibility that mandatory notification is required.  Where such a possibility is identified the Principal Investigator will be referred to the NSI team for a decision as to whether a mandatory notification is required.

Mandatory notification process through Cambridge Enterprise

Where mandatory notification is required in relation to a University spin-out, this will normally be made by the spin-out company itself as a separate legal entity. In all other instances, mandatory notifications relating to commercialisation activities supported by Cambridge Enterprise will be made by assigned members of staff at Cambridge Enterprise, working with the researchers involved, directly via the BEIS portal.

Voluntary notifications

The NSI Act also provides for voluntary notifications. Voluntary notifications may be made in relation to qualifying acquisitions of assets in or close to the 17 areas described above. Whilst there is no legal requirement to tell the government about qualifying acquisitions not covered by mandatory notification, voluntary notification avoids the risk of proceeding with an acquisition that might be later called in and potentially blocked or unwound.

The University takes a risk-based approach to voluntary notifications. When an agreement is proposed in which any party is likely to acquire IP rights (for example, research collaboration agreements, studentships and material transfer agreements) the Principal Investigator will be asked questions about the technology and the relevant party to assess the risk of call-in. Where such a risk is identified the Principal Investigator will be referred to the NSI team for a decision as to whether a voluntary notification is required.

Voluntary notification process through Cambridge Enterprise

Where a commercialisation activity supported by Cambridge Enterprise may be relevant to the NSI Act, Cambridge Enterprise staff will discuss this with the researchers involved, taking advice from the NSI team as necessary, to decide whether a voluntary notification should be made. The decision whether to make a voluntary notification will be taken by an appropriate member of CE staff directly via the NSI portal. For the purpose of institutional oversight and record-keeping, copies will be sent to nsi.notifications@admin.cam.ac.uk.

Responsibility for compliance

As with export control, the responsibility for national security due diligence begins and rests ultimately with the Principal Investigator. Failure to comply with the regulations under the NSI Act or providing false or misleading information to the Secretary of State in an NSI notification is a criminal offence. PIs need to be aware where their research falls in relation to the 17 areas the government considers most likely to give rise to national security risks (please refer to the government's general guidance and the guidance for academia). Researchers should also be aware of where their research and collaborators are positioned in relation to export controls regulations and sanctions and embargoes (for more information, please see our export control webpages).

For further information, the government's National Protective Security Authority (NPSA) has created a video, drawing on real case studies, on identifying dual-use applications before commercialisation.

Disclaimer: This resource has been prepared by NPSA and NCSC and is intended to aid academic institutions to help them understand and mitigate security risks arising from research, in combination with additional resources and the application of institutions’ own judgement. This document is provided on an information basis only, and while NPSA and NCSC have used all reasonable care in producing it, NPSA and NCSC provides no warranty as to its accuracy or completeness.​

Crown Copyright Statement: OGL logo © Crown Copyright 2024​ This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated.