The risk of national security and investment screening should be assessed before a binding offer is made rather than shortly before completion. In an acquisition involving any of these jurisdictions, buyers should consider the relevant legislation in each jurisdiction: (i) French foreign investment control (IEF), (ii) the UK's National Security and Investment Act (NSIA), (iii) Poland's Act on the Control of Certain Investments and (iv) Italy's 'Golden Power' regime. These regimes do not share the same triggers, timelines or sanctions.
The sensitive activity analysis is at the core of the IEF assessment which extends well beyond defence. Energy, water, transport, electronic communications, public health, cybersecurity, artificial intelligence, robotics, semiconductors, data infrastructure and food security may all be relevant. Buyers should review the target group, branches, key contracts, licences, intellectual property, software, data and critical subcontracting arrangements.
The NSIA applies to trigger events involving qualifying entities. Control may arise from shareholding or voting-right thresholds, rights to pass or block resolutions or the acquisition of material influence over policy. Mandatory notification to the Investment Security Unit is required for acquisitions of entities operating in 17 sensitive sectors, including artificial intelligence, communications, data infrastructure, defence, energy, military, quantum technologies, space and transport. Voluntary notification should be considered where the transaction falls outside the mandatory regime but nonetheless raises national security concerns, particularly where sensitive assets such as intellectual property, software or data are involved. Even where no mandatory filing is required, the transaction may be called in for review for up to five years after completion.
Under the broader mechanism, a mandatory prior notification to the Minister of Economic Development and Technology is required before entering into a binding agreement to acquire significant participation (20% or 40% of voting rights, profit participation or capital participation) or control in a Polish protected entity, provided that the entity generated Polish sales and services revenue exceeding the equivalent of EUR 10 million in either of the two financial years preceding the notification. Protected entities include Polish public companies, critical infrastructure operators and entities active in a broad range of sectors spanning energy generation, pharmaceuticals, medical devices, food processing, cloud services, specified software and defence-related activities. The regime may also capture indirect acquisitions and anti-avoidance structures, including acquisitions through subsidiaries, branches or representative offices of non-EU/EEA/OECD investors.
The regime originally covered defence and national security, plus energy, transport and communications. Successive amendments, accelerated by emergency measures adopted in 2019–2020 during the COVID-19 pandemic and further extended since, have widened its perimeter significantly. Strategic sectors now include critical infrastructure (encompassing financial services, credit and insurance), critical technologies (artificial intelligence, robotics, semiconductors, cybersecurity, biotechnology, dual-use items), access to sensitive data, and food security, among others. The list continues to evolve, and buyers should treat the sector test as expansive.
Unlike some foreign-investment regimes, Italy's Golden Power regime is not triggered solely by the nationality of the acquirer. Notification obligations can arise from: (i) acquisitions of control (and, in certain strategic sectors, acquisitions of significant non-controlling stakes above set voting-right or capital thresholds) by non-EU persons or entities in companies holding strategic assets; (ii) in specified sectors, acquisitions by EU persons or entities above materiality thresholds; and (iii) purely domestic corporate acts or resolutions (mergers, transfers of strategic assets, changes of registered office or corporate purpose, dissolution) that change the ownership, control, availability or allocation of strategic assets, regardless of the buyer’s nationality. The regime therefore looks at the nature of the target’s activity and assets as much as the identity of the acquirer.
Where a notification is required, it must be filed with the Presidency of the Council of Ministers (via the dedicated Golden Power unit) before the transaction is completed. The Government generally has an initial review period of approximately 45 days, which may be extended (for example, by a further 45 days or shorter extensions depending on the sector and the case, particularly where further information is requested) to decide whether to clear the transaction unconditionally, impose conditions (such as governance, supply or security-of-information commitments) or exercise a veto in defence and national-security-sensitive cases. Silence within the statutory term generally amounts to non-exercise of the powers (tacit clearance).
The sanctions for non-compliance are severe. Failure to notify, or completing a transaction in breach of an imposed condition or veto, can result in administrative fines of up to twice the value of the transaction (and, in any event, not less than 1% of the aggregate turnover of the companies involved), together with suspension of voting rights attached to the relevant shares and nullity or ineffectiveness of resolutions or acts adopted in breach.
In practice, investment screening should form part of the overall investment strategy from the outset. Buyers need to understand not only whether a filing is required, but also whether the deal perimeter, governance rights, information flows or access to sensitive assets could result in condition precedents or affect value. This should directly be reflected into the SPA particularly through IEF/NSIA/Polish Act/Golden Power conditions precedent, seller cooperation undertakings, specific warranties, information covenants, long-stop calibrated to the statutory (and potential extended) review period provisions and, where appropriate, specific indemnities. For France-UK-Poland-Italian targets in strategic sectors, investment control is therefore not a late-stage regulatory footnote but a key issue affecting execution, timing and value protection.
We would like to thank Andrea Tarazi for her contribution towards this article.
France
In France, an IEF filing is required where three conditions are met. First, there must be a foreign investor. This concept is defined broadly and includes foreign entities, French entities controlled by foreign persons and the entire chain of control. A French special purchase vehicle will therefore not avoid the regime if its ultimate controller is foreign. Secondly, the transaction must constitute an investment, namely the acquisition of control of a French entity, the acquisition of all or part of a business line or, for non-EU/non-EEA investors, the acquisition of more than 25% of voting rights in a French entity or more than 10% in a listed French company. Since Brexit, UK investors fall within this last category. On 17 August 2026, the scope of the 10% voting-right threshold applicable to listed French companies has been clarified. While the threshold itself remains unchanged, it now expressly covers French companies listed on certain non-EU regulated markets, including the London Stock Exchange, SIX Swiss Exchange, Toronto Stock Exchange and Singapore Exchange. Thirdly, the French target must carry on a sensitive activity.The sensitive activity analysis is at the core of the IEF assessment which extends well beyond defence. Energy, water, transport, electronic communications, public health, cybersecurity, artificial intelligence, robotics, semiconductors, data infrastructure and food security may all be relevant. Buyers should review the target group, branches, key contracts, licences, intellectual property, software, data and critical subcontracting arrangements.
UK
The NSIA assessment differs from the IEF assessment. The NSIA is not triggered by the nationality of the buyer but by the existence of a UK nexus and a potential national security risk. Qualifying entities may be UK buyer, a foreign buyer or even a foreign-to-foreign transaction where the target carries on activities in the UK, supplies UK customers or holds UK-linked assets. It also extends beyond share acquisitions. Acquisitions of certain qualifying assets such as software, source code or databases know-how may be relevant where they provide access to sensitive capabilities. An NSIA review should therefore focus on the transaction structure, the target's UK footprint and the assets being acquired rather than the buyer's identity.The NSIA applies to trigger events involving qualifying entities. Control may arise from shareholding or voting-right thresholds, rights to pass or block resolutions or the acquisition of material influence over policy. Mandatory notification to the Investment Security Unit is required for acquisitions of entities operating in 17 sensitive sectors, including artificial intelligence, communications, data infrastructure, defence, energy, military, quantum technologies, space and transport. Voluntary notification should be considered where the transaction falls outside the mandatory regime but nonetheless raises national security concerns, particularly where sensitive assets such as intellectual property, software or data are involved. Even where no mandatory filing is required, the transaction may be called in for review for up to five years after completion.
Poland
Poland operates a dual-track investment control regime. The Act on the Control of Certain Investments establishes two parallel mechanisms which may require prior clearance before the transaction can be completed: one targeting acquisitions in entities included in a government list of protected entities operating in strategic sectors such as energy, fuels, gas, defence-related activities, telecommunications and ports, and a second, broader mechanism which applies to investors from outside the EU, EEA or OECD, including entities which do not have, or have not had for at least two years before the filing, their registered seat in one of those jurisdictions.Under the broader mechanism, a mandatory prior notification to the Minister of Economic Development and Technology is required before entering into a binding agreement to acquire significant participation (20% or 40% of voting rights, profit participation or capital participation) or control in a Polish protected entity, provided that the entity generated Polish sales and services revenue exceeding the equivalent of EUR 10 million in either of the two financial years preceding the notification. Protected entities include Polish public companies, critical infrastructure operators and entities active in a broad range of sectors spanning energy generation, pharmaceuticals, medical devices, food processing, cloud services, specified software and defence-related activities. The regime may also capture indirect acquisitions and anti-avoidance structures, including acquisitions through subsidiaries, branches or representative offices of non-EU/EEA/OECD investors.
Italy
Italy’s “special powers” regime, established by the Decreto-Legge No. 21/2012 (converted into Law No. 56/2012) and substantially expanded in subsequent years, grants the Italian Government the power to impose conditions on, or veto, transactions affecting companies that hold assets deemed strategic to the national interest.The regime originally covered defence and national security, plus energy, transport and communications. Successive amendments, accelerated by emergency measures adopted in 2019–2020 during the COVID-19 pandemic and further extended since, have widened its perimeter significantly. Strategic sectors now include critical infrastructure (encompassing financial services, credit and insurance), critical technologies (artificial intelligence, robotics, semiconductors, cybersecurity, biotechnology, dual-use items), access to sensitive data, and food security, among others. The list continues to evolve, and buyers should treat the sector test as expansive.
Unlike some foreign-investment regimes, Italy's Golden Power regime is not triggered solely by the nationality of the acquirer. Notification obligations can arise from: (i) acquisitions of control (and, in certain strategic sectors, acquisitions of significant non-controlling stakes above set voting-right or capital thresholds) by non-EU persons or entities in companies holding strategic assets; (ii) in specified sectors, acquisitions by EU persons or entities above materiality thresholds; and (iii) purely domestic corporate acts or resolutions (mergers, transfers of strategic assets, changes of registered office or corporate purpose, dissolution) that change the ownership, control, availability or allocation of strategic assets, regardless of the buyer’s nationality. The regime therefore looks at the nature of the target’s activity and assets as much as the identity of the acquirer.
Where a notification is required, it must be filed with the Presidency of the Council of Ministers (via the dedicated Golden Power unit) before the transaction is completed. The Government generally has an initial review period of approximately 45 days, which may be extended (for example, by a further 45 days or shorter extensions depending on the sector and the case, particularly where further information is requested) to decide whether to clear the transaction unconditionally, impose conditions (such as governance, supply or security-of-information commitments) or exercise a veto in defence and national-security-sensitive cases. Silence within the statutory term generally amounts to non-exercise of the powers (tacit clearance).
The sanctions for non-compliance are severe. Failure to notify, or completing a transaction in breach of an imposed condition or veto, can result in administrative fines of up to twice the value of the transaction (and, in any event, not less than 1% of the aggregate turnover of the companies involved), together with suspension of voting rights attached to the relevant shares and nullity or ineffectiveness of resolutions or acts adopted in breach.
In practice, investment screening should form part of the overall investment strategy from the outset. Buyers need to understand not only whether a filing is required, but also whether the deal perimeter, governance rights, information flows or access to sensitive assets could result in condition precedents or affect value. This should directly be reflected into the SPA particularly through IEF/NSIA/Polish Act/Golden Power conditions precedent, seller cooperation undertakings, specific warranties, information covenants, long-stop calibrated to the statutory (and potential extended) review period provisions and, where appropriate, specific indemnities. For France-UK-Poland-Italian targets in strategic sectors, investment control is therefore not a late-stage regulatory footnote but a key issue affecting execution, timing and value protection.
We would like to thank Andrea Tarazi for her contribution towards this article.
