How does the National Security and Investment Act affect AI?

5 min read

The UK’s National Security and Investment Act 2021 (NSIA) established a regime for the UK Government to scrutinise and potentially intervene in commercial transactions in order to safeguard the UK’s national security. In overview, the NSIA regime requires the submission of a mandatory filing to the Department of Business, Energy and Industrial Strategy (BEIS) if the target entity in a transaction has activities that fall within one or more of the 17 “high risk” sectors of the UK economy.

Artificial intelligence (AI) is one of the sectors classified as “high risk” for the purpose of the NSIA regime. This is because the UK Government recognises that AI technologies may be used for harmful purposes and can, in certain circumstances, have potential military applications. Accordingly, parties seeking to either buy or sell an entity active in the AI space in the UK must be alive to the possibility that their transaction could trigger a mandatory filing obligation with BEIS. This is not least because there are significant penalties associated with failing to notify BEIS of a mandatorily notifiable transaction, including fines and potential criminal sanctions.

How is AI defined under the NSIA regime?

Secondary legislation sets out the specific criteria which determines when an entity will be considered to undertake AI activities for the purpose of the NSIA regime. The process of ascertaining whether an entity has such AI activities involves two steps.

The first step is to consider whether the entity carries on research into, or develops or produces goods, software or technology that uses AI. In this context, AI is defined as technology enabling the programming or training of a device or software to:

  • perceive environments through the use of data;
  • interpret data using automated processing designed to approximate cognitive abilities; and/or
  • make recommendations, predictions, or decisions, in any case with a view to achieving a specific objective.

Assuming the first step is satisfied, the second step is to ask whether the entity’s AI activities are being used for one or more of the following applications:

  • the identification or tracking of objects, people or events;
  • advanced robotics; or
  • cyber security.

Governmental guidance provides further detail on the meaning of these three AI applications. Only those entities which satisfy both step one and step two will be caught by the AI sector for the purposes of the NSIA’s mandatory notification regime.

The NSIA in practice

The NSIA regime entered into force in the UK on 4 January 2022.  Although there is not an abundance of publicly available information on the internal workings of the regime as it relates to AI, some useful clues can be found in the Annual Report published by BEIS, which covers the NSIA regime’s first three months of operation. According to the Annual Report, of the 17 “high risk” sectors, the AI sector was the fourth most common sector from the perspective of mandatory notifications. Mandatory notifications relating to AI accounted for nearly 20% of the total mandatory notifications submitted to BEIS at the time of the Report. Two of the transactions notified were called-in for further national security review. It remains to be seen whether these trends will continue when BEIS next publishes data on the NSIA.

To date, the UK Government has blocked five transactions using its NSIA powers. Although none of these transactions involved entities with activities falling squarely within the AI sector, they do nonetheless demonstrate the UK Government’s general willingness to intervene in corporate transactions which could pose risks to national security.

Practical takeaways

Whilst the UK Government is keen to stimulate the growth of the AI sector in the UK, it also possesses powers which enable it to intervene in and potentially block transactions in the AI space that give rise to national security risks.

When considering the potential application of the NSIA, transaction parties should bear the following practical takeaways in mind:

  • Target entities that simply use AI technologies are not likely to be caught by the mandatory notification regime. Rather, a target entity will satisfy step 1 if it researches, develops or produces goods, software or technology that use AI. 
  • Even if a transaction relating to AI does not, strictly speaking, fall within the NSIA’s mandatory notification regime, transacting parties may nonetheless opt to make a voluntary notification if the transaction could implicate UK national security and involve a risk of being “called in” by the Government.
  • To date, the transactions that have been blocked under the NSIA have involved Chinese or Russian acquirers. However, the transactions that have been cleared subject to conditions have involved a broader range of nationalities, including UK, US, and UAE acquirers. This shows that acquisitions by buyers of any nationality, including those incorporated in the UK, could be subject to an in-depth review and remedies if the target entity is considered to have significant UK capabilities in AI or another sensitive sector.
  • Transaction parties should be aware that, in some circumstances, the acquisition of a relatively low minority shareholding in an entity active in a sensitive sector can be sufficient to establish BEIS’ jurisdiction to review a transaction. For example, in September 2022, a transaction involving the acquisition of a 12% equity interest, accompanied by the right to appoint a board member, was caught by the NSIA regime and cleared subject to conditions.

For more information about the operation of the NSIA regime more generally, please refer to our previous Slaughter and May briefings (here and here).

This article was written by Lisa Wright and Jennyfer Moreau. Lisa is a partner, and Jennyfer is an associate, in Slaughter and May’s Competition Team. This article is part of our wider Regulating AI series. For more information on the other content available in the series, see our Regulating AI hub