7th August 2025

Written by Andy Moseby.

The National Security & Investment Act: the hidden risk in transactions involving cutting-edge creative tech companies.

You’re embracing “Createch” and have built an AI-powered creative business. Maybe it’s a generative design platform, a machine-learning music composition tool or a data-driven content recommendation engine.

You’ve secured seed investment, grown your team, and now you’re ready for the next step, whether that’s a strategic sale, Series A funding or internal restructuring pre-international expansion.

But wait: there’s a UK law that could void your deal entirely, even after contracts are signed and the bottles of champagne are opened. If you’re in the AI space, you’re almost certainly in its crosshairs.

Welcome to the National Security and Investment Act 2021 (NSIA)

The NSIA isn’t just another piece of regulatory red tape. It’s a sweeping national security regime that treats AI as one of a number of sensitive sectors requiring government oversight. As the NSIA defines artificial intelligence broadly – covering everything from pattern recognition to predictive modelling – it has the potential to capture modern creative-tech businesses developing their own AI solutions.

The NSIA gives the UK government unprecedented power to review, condition or block transactions involving AI companies. Unlike traditional merger control, there are no revenue thresholds. The size of your business is irrelevant. What matters is whether your technology could theoretically pose national security risks. This wide scope is intentionally broad. If your company develops AI products that are able to identify patterns, make decisions or simulate human cognition, you’re within the regime’s reach.

The NSIA creates mandatory notification requirements for specific control thresholds: acquiring 25%, 50% or 75% of shares (or voting rights) triggers automatic government review. But here’s the catch: even minority investments can be caught if they provide “material influence” over company policy. Material influence isn’t precisely defined but it can include board seats, veto rights over strategic decisions or contractual arrangements that give investors sway over business direction. That seed round where you gave your lead investor consent rights? Potentially caught. The strategic partnership with technology transfer provisions? Also potentially caught.

The notification obligation falls on the acquirer, not the seller, but sellers have every commercial reason to ensure compliance. If a notifiable transaction completes without approval, it becomes legally void, meaning the whole deal needs to be unravelled. Deals that should have been notified but weren’t face a five-year window during which the Government can retrospectively intervene.

Imagine completing your exit, distributing proceeds, buying assets or using the money to fund a new project, and then receiving notice that the transaction is under review and could be unwound.

This retrospective power creates ongoing uncertainty that can haunt businesses long after deals close. Non-compliance also carries criminal sanctions for the acquirer: fines up to £10 million or 5% of global turnover (whichever is greater) plus potential imprisonment of up to five years. Even inadvertent breaches can trigger these penalties, which is why buyers are increasingly demanding extensive NSIA warranties and indemnities.

Impact of notification

The recent NSIA Annual Report for 2024-2025 shows that the Investment Security Unit within the Department for Business and Trade received 1,143 notifications throughout the financial year, up 25% on the number from 2023-2024. The majority (56%) were associated with defence and, whilst the figure for AI isn’t recorded in the report, there is reference to a chart which appears to show that 15-16% of the notifications (around 170-180) fell within the AI category.

Of the 1,079 notifications that were reviewed 95.5% (1,030) were notified that no further action would be taken, with the remaining 4.5% (49) being issued a call-in notice. Seven further “non-notified” deals – transactions which the ISU spotted by market monitoring, but which weren’t the subject of a notification – were also issued with a call-in notice.

When notification is required, the ISU conducts a 30-working-day initial assessment. If national security concerns arise, this extends to a detailed 45-day review, potentially with another 45-day extension.

For the 2024-2025 period, all decisions on whether to call-in or clear notified acquisitions were taken within the 30 working days (on average, 29 working days was taken to issue a call-in notice), with the additional 45 working day period only used 21 times. Still, for fast-moving transactions, these timelines can be fatal. Venture capital firms operating on tight deployment schedules, strategic acquirers with quarterly targets and competitive bid processes all struggle with the uncertainty and delay that NSIA reviews introduce.

The government’s track record shows mixed signals. While most notifications receive clearance, the cases that don’t often involve conditions that fundamentally alter deal economics: requirements to ring-fence sensitive operations, restrict access to certain data or maintain UK-based operations.

Beyond traditional M&A

Remember, the NSIA’s reach extends far beyond conventional acquisitions. Internal corporate reorganisations, group restructurings and changes in control within existing structures can all trigger notification requirements if control thresholds are crossed.

This creates particular challenges for growing creative-tech companies. Employee option schemes that dilute founder control below key thresholds, management buyouts, spin-offs of IP-holding subsidiaries: all potentially caught if not carefully structured.

International structures add further complexity. The NSIA’s extra-territorial reach means foreign investors acquiring control of UK-based AI activities face scrutiny regardless of where the acquisition vehicle is based.

What about AI licensing?

The good news is that the NSIA’s scope is more limited for businesses that merely licence or use AI technologies. The NSIA’s current artificial intelligence sector definition specifically targets entities that research, develop or produce AI technology. Simple licensing or usage arrangements typically fall outside this definition.

However, the boundaries aren’t always clear-cut. Consider these scenarios:

• Pure licensing (Low Risk): a creative agency licensing OpenAI’s GPT models through standard API access to power content generation tools would typically not constitute “research, develop or produce” activities. The agency is consuming AI services rather than creating AI technology.
• Customisation and integration (Moderate Risk): a business that licenses foundation models but then significantly customises, fine-tunes or integrates them into proprietary applications may cross into “development” territory. The degree of modification and the nature of the resulting IP become relevant factors.
• Strategic AI partnerships (Higher Risk): arrangements involving joint development, shared training data, model customisation rights or collaborative research could bring both parties within the NSIA’s scope. These partnerships often blur the line between licensing and development.
• Data and Training Rights (Variable Risk): agreements that provide rights to training data, model weights, or algorithmic insights may constitute more than simple licensing, particularly where the licensee gains meaningful control over AI development processes.

In the foreword to the NSIA 2024-25 Annual Report, the Rt Hon Pat McFadden, the Chancellor of the Duchy of Lancaster, is predictably bullish about how the NSIA encourages foreign trade: “the vast majority of inward investment continues to pose no threat to our national security, and most businesses will never need to interact with the takeover screening process“.

Nonetheless, creative-tech businesses should carefully assess their AI arrangements. Key considerations include the extent of customisation rights, access to underlying models or data, collaborative development obligations, and whether the arrangement provides strategic influence over AI technology development.

Strategic implications for Creative-Tech

The creative industries are at the heart of the Government’s recent ten-year Industrial Strategy, but the implementation of the NSIA represented a fundamental shift in how transactions are conceived and executed. Businesses that once competed on innovation, speed and agility now have to potentially factor government approval into their significant corporate decisions.

On 22 July 2025, the Cabinet Office unveiled a package of changes aimed at streamlining the NSIA regime without compromising national security. Whilst the headline shift is the removal of mandatory notification requirements for non-contentious internal reorganisations and insolvency appointments, more significant is the launch of a full review of the sectors caught by mandatory notification. The Government has opened a 12-week consultation and the definitions of many of the sensitive sectors – including AI – are under review.

A commitment has been made to improve administrative clarity, building on industry feedback that the process remains opaque in parts. Whilst the Government seems to be (sensibly) targeting higher-risk activities while reducing compliance friction for benign transactions, the NSIA remains central to any transaction planning. Deals involving AI remain squarely in scope.

Legal teams must stay alert. Definitions are evolving. Notification thresholds are under review. Sector boundaries are shifting. The reforms signal a maturing regime but one that remains interventionist, strategic and essential to navigate correctly. This creates competitive disadvantages versus jurisdictions with lighter-touch regimes. US-based AI companies can move faster on acquisitions and investments, while EU competitors operate under more predictable regulatory frameworks.

The burden also falls disproportionately on emerging companies. Established tech giants have compliance infrastructure and regulatory affairs teams. Start-ups and scale-ups often only discover the NSIA when transactions are already in motion.

Smart businesses are adapting by building NSIA considerations into corporate governance from the outset. This means structuring shareholder agreements to avoid material influence triggers, designing option schemes around control thresholds, and maintaining detailed records of AI activities to support future notifications.

The NSIA isn’t going away. If anything, geopolitical tensions around AI development suggest the regime will become more stringent, not less. Recent government partnerships with major AI players like OpenAI and Google demonstrate the strategic importance placed on controlling AI development and deployment.

For creative-tech entrepreneurs, this means treating NSIA compliance as core business infrastructure, not legal afterthought. Early engagement with specialist advisors, proactive transaction structuring and robust internal compliance procedures are becoming competitive necessities.

Find out more about our expertise in Corporate here.