LegislationGB

National Security and Investment Act

UK law requiring mandatory notification and government approval for acquisitions in 17 sensitive sectors on national security grounds.

Airbus agreed in April 2026 to buy Ultra Cyber, a Ministry of Defence-cleared cryptography supplier, from Cobham, bringing UK sovereign cryptography work inside a European defence prime pending national-security clearance review.

Last refreshed: 22 September 2026 · Appears in 1 active topic

Key Question

Can NSIA protect UK sovereign cryptography while permitting the Airbus–Ultra Cyber deal to close?

Timeline for National Security and Investment Act

#13 21 Jul

Invested in Greenjets' Series A as the UK Government's dual-use venturing arm

UK Startups and Innovation: Greenjets raises £30m in its 21st year

#13 15 Jul

Mentioned in: Beijing urges Dutch talks to settle Nexperia dispute

European Tech Sovereignty

#2 30 Apr

Airbus signs for Ultra Cyber from Cobham

Cybersecurity: Threats and Defences

#3 27 Apr

Mentioned in: Ineffable lands $1.1bn seed, SAIU rides minority

UK Startups and Innovation

View full timeline →

Follow UK Startups and Innovation →

Background

The National Security and Investment Act 2021 came into force on 4 January 2022, requiring mandatory notification and government approval for acquisitions in 17 sensitive sectors on national security grounds, including cryptographic authentication and defence. The Investment Security Unit, which sits within the Cabinet Office, has 30 working days to decide whether to call in a notified transaction, and a called-in deal faces a further assessment period of up to 75 working days.

The Act does not itself invest in or fund any company: it is a screening and approval regime, and its power is to block, condition or clear deals that others are financing. Its defining precedent is Newport Wafer Fab: the Secretary of State made a final order on 16 November 2022 requiring Nexperia to divest at least 86% of the Welsh chip fab on national security grounds; Nexperia agreed to sell the plant to US-based Vishay Intertechnology for $177m in November 2023, and the sale completed in March 2024.

The Act's cryptographic-sector powers face a live test: in April 2026 Airbus, a European defence prime headquartered in Toulouse, agreed to buy Ultra Cyber from Cobham, bringing Ultra Cyber's secret-level, MoD-cleared cryptography and cyber-defence programme work under Airbus's ownership. The Prudential Regulation Authority and the Ministry of Defence must clear the deal before it can close, and the review is expected to set a precedent for how the Act treats European NATO allies as owners of UK classified defence technology.

Common Questions

Reference

How long does the UK government have to review an NSIA notification?

30 working days initially, extendable to 75 working days for complex cases, before the government must decide whether to call in a deal for national security assessment.Source: National Security and Investment Act 2021, s.14

What is the National Security and Investment Act?

A UK law, in force since 4 January 2022, requiring mandatory government notification and approval for acquisitions across 17 sensitive sectors including AI, defence and data infrastructure.Source: National Security and Investment Act 2021 (legislation.gov.uk)

Which sectors require mandatory notification under NSIA in the UK?

The 17 NSIA sensitive sectors include: AI, advanced materials, advanced robotics, civil nuclear, communications, computing hardware, cryptographic authentication, data infrastructure, defence, energy, military and dual-use, quantum technologies, satellite and space, synthetic biology, transport, suppliers to government, and suppliers to emergency services.Source: UK Government

Does the Airbus acquisition of Ultra Cyber require NSIA approval?

Yes. Ultra Cyber operates in the cryptographic authentication sensitive sector under the NSIA, providing MoD-cleared sovereign cryptography. Airbus, as a non-UK acquirer, must obtain government clearance. PRA and MoD review processes are the parallel gating events.Source: Lowdown

Why is the Airbus acquisition of Ultra Cyber an NSIA test case?

Ultra Cyber operates in the cryptographic authentication sensitive sector on MoD-cleared programmes, and the acquirer, Airbus, is a non-UK entity, even though it is from an EU ally.Source: Lowdown briefing, Cybersecurity: Threats and Defences #2

When did Nexperia have to sell Newport Wafer Fab?

The Secretary of State ordered the divestment in November 2022; the sale to US-based Vishay Intertechnology for $177 million completed a year later, in November 2023.Source: UK Government, NSIA Newport Wafer Fab Final Order Public Notice, 16 November 2022; Akin Gump press release, November 2023

Has the UK government blocked any foreign acquisitions under NSIA?

The most prominent intervention was Newport Wafer Fab in 2023, where Nexperia was ordered to divest 86% of its UK semiconductor business. Most called-in transactions since 2022 have been cleared subject to conditions rather than blocked outright.Source: UK Government / Cabinet Office

Source Material

National Security and Investment Act 2021 — legislation.gov.uk National Security and Investment Act — UK Government