When M&A meets national security
This article is an extract from the CMS European M&A Outlook 2026. To download the full report please click here
FDI reviews present one of the biggest hurdles to M&A. FDI rules differ significantly from country to country, and even within the EU there is no single, harmonised system. Instead, transactions must often navigate a patchwork of national rules and filing requirements. At the same time, FDI reviews are difficult to predict. The process can be highly political and less transparent than other regulatory procedures – FDI decisions are rarely published and almost never challenged before the courts. Consequently, it is difficult to assess the likely outcome and timing of a decision. Adding to this complexity, FDI laws are changing rapidly. Governments continue to transform their screening regimes, and the way authorities interpret the rules is influenced by geopolitical developments. A transaction that appears unproblematic today may face much stricter scrutiny tomorrow.
Recent trends in FDI reviews
Recent trends in FDI reviews Once a niche sector, defence has turned into a dealmaking hotspot. Unsurprisingly, defence is one of the most sensitive sectors for FDI review, and many investors now face their first real FDI applications. Filing thresholds are often very low for defence, so even small minority investments can trigger a filing. Defence deals are also very likely to attract regulatory conditions, particularly information access restrictions, confidentiality requirements and commitments to maintain key operations or sites in the country.
As governments become more focused on data sovereignty and protecting citizens’ information, acquisitions of data-rich businesses are attracting intense scrutiny. Authorities are paying close attention to who gains access to sensitive data and where that data may ultimately flow. Where concerns arise, authorities often impose measures such as data access restrictions, localisation requirements and enhanced cybersecurity obligations.
As cyber threats become more sophisticated and critical systems become more connected, cybersecurity companies are coming into focus. Businesses that protect critical infrastructure and networks were always security-relevant, but industrial software companies are attracting growing scrutiny. The risk is not just access to sensitive systems as such: cybersecurity companies know how those systems work, and how their protections can be bypassed. Again, information access restrictions, confidentiality requirements and commitments to maintain key operations in the country are routinely imposed on buyers. As with defence, even intra-EU deals may face restrictions.
Depending on the nature and scope of the services provided, logistics companies may have significant visibility into supply chains. Such insight may provide a detailed picture of who needs what, when and from where, potentially exposing critical dependencies, supply patterns and vulnerabilities. They also play a vital role during crises, helping to secure essential supplies and even support defence operations. As a result, investments even in smaller logistics companies have attracted intense FDI scrutiny where investors were from countries that are seen as systemic rivals to the EU.
New EU screening regulation
The EU has revised its 2019 Foreign Direct Investment Screening Regulation. The new Foreign Investment Screening Regulation (EU) 2026/1386 entered into force on 16 July 2026 and will fully apply from January 2028. While regional harmonisation was one of the goals, member states pushed back – national security remains at the heart of national sovereignty, and countries are keen to retain control over decisions affecting their essential security interests. As a result, the new regulation does not introduce an EU-wide one-stop shop: national authorities will remain responsible for reviewing transactions under their domestic regimes. However, the revised regulation will bring about some minimum standards and strengthen coordination between member states and the Commission. The key changes include:
- All EU member states must maintain foreign investment screening regimes meeting common minimum standards.
- Member states must require prior authorisation for investments in a defined set of sensitive activities, including dual-use and military items, certain AI, quantum and semiconductor activities, selected critical infrastructure, strategic raw materials, certain financial market infrastructures and electoral infrastructure.
- Authorities must consider common sector specific and investor-specific risk factors, including links to third-country governments, sanctions exposure, opaque ownership structures, past screening history and potential access to sensitive technologies, infrastructure, data or supply chains.
- National reviews will be subject to minimum procedural rules, including a two-phase process, a 45-calendar-day Phase I period, retrospective call-in powers and coordinated filings where a transaction is notifiable in several member states.
- More cases will be referred to the EU co-operation mechanism, where member states exchange their views on pending cases, especially where transactions involve sensitive sectors, state-linked or sanctioned investors.
A new EU framework, 27 national responses
The impact of the new EU FDI Screening Regulation will reach far beyond Brussels. Although foreign investment screening will continue to be administered at national level, all member states will be required to align their domestic regimes with the new framework. This is expected to trigger legislative activity across the EU, with each member state reviewing and amending its rules.
Many governments are likely to use the implementation process as an opportunity to undertake broader reforms of their FDI screening regimes. Businesses and investors should expect significant legislative changes over the next 12-18 months.
Against this backdrop, monitoring regulatory developments and assessing FDI risks at the early stages of a transaction will become even more important for deal certainty and transaction planning.
