Guidance

National Security and Investment Act: guidance for the higher education and research-intensive sectors

Updated 21 May 2024

This guidance helps Higher Education Institutions, other research organisations and investors in this area to understand the scope of the National Security and Investment Act 2021 (NSI Act).

It covers:

• sources of help for higher education institutions
• a summary of the NSI Act
• examples of assets and entities within the scope of the NSI Act (qualifying assets and entities) within the higher education and research-intensive sectors
• how you may be required to notify the government about an acquisition of a qualifying entity in one of the specified 17 sensitive areas of the UK economy and get approval from the government before you can complete it
• when you can voluntarily notify the government about other qualifying acquisitions
• what happens if the government decides to assess your activity in more detail (“calling in”)
• hypothetical scenarios of qualifying acquisitions of entities and assets in the higher education and research-intensive sectors.

Higher Education Institutions and other research organisations should be aware of the NSI Act when collaborating with other parties to acquire, sell or develop qualifying entities or assets.

Help for higher education institutions to decide whether to notify

The government has created a dedicated team, the Research Collaboration Advice Team (RCAT) to help ensure researchers’ work is protected and that the UK research sector remains open and secure. This includes increasing understanding among academics of the laws and regulations they need to follow as they work internationally. RCAT can also advise on potential national security risks arising from specific international collaborations, which may lead the institution to make a voluntary notification under the NSI Act. However neither RCAT nor the ISU can require academics or academic institutions to submit a voluntary notification.

Researchers, research professionals, or higher education institutions who believe their work may be of relevance to the NSI Act and would like further advice can contact their assigned RCAT point of contact in advance of notifying the Investment Security Unit (ISU). If you do not already have an assigned point of contact, or have a query regarding the submitting or processing of a notification, you should contact the ISU at: investment.screening@cabinetoffice.gov.uk. Read further information about the RCAT.

Summary of the NSI Act

The government can scrutinise and intervene in certain acquisitions made by anyone, including academic institutions, businesses, and investors, that could harm the UK’s national security. The government can impose certain conditions on an acquisition or, if necessary, unwind or block it, although the government expects to do this rarely.

These rules fall under the National Security and Investment (NSI) Act which came into force on 4 January 2022. The rules cover qualifying acquisitions of certain entities and assets, known as qualifying entities and assets, and examples for the higher education and research-intensive sectors are given in this guidance.

The government can call in a qualifying acquisition for assessment if it reasonably suspects that it has given rise to, or may give rise to, a risk to national security. This applies whether the acquisition has been completed or is still in progress or in contemplation. However, it is not possible to call in and assess acquisitions completed before 12 November 2020.

How the rules work

The rules only apply to qualifying acquisitions. These are referred to as trigger events in the National Security and Investment Act.

Your acquisition is a qualifying acquisition if all of the following apply:

• the acquisition is of a right or interest in, or in relation to, a qualifying asset or qualifying entity (these terms are explained below)
• the entity or asset you are acquiring is from, in, or has a connection to the UK (see additional guidance here)
• the level of control you acquire over the qualifying entity or qualifying asset meets or passes a certain threshold
  • These thresholds are:
    • your shareholding stake or voting rights in a qualifying entity meets or crosses certain percentage thresholds (for example, it becomes higher than 25%)
    • you acquire voting rights in a qualifying entity that allow you to pass or block resolutions governing the affairs of the entity
    • you are able to materially influence the policy of a qualifying entity, for example by acquiring the right to appoint members of the board of the entity
    • you are able to use a qualifying asset, or you are able to direct or control its use, or you are able to do so more than you could prior to the acquisition

Read the guidance on how the NSI Act will works and what these thresholds are.

What is a qualifying entity and qualifying asset?

Entities and assets might be qualifying entities and qualifying assets if they are from, in or have a connection to the UK.

Read further guidance on the acquisition of entities or assets outside the UK.

A qualifying entity is any entity other than an individual, including a company, a limited liability partnership, any other body corporate, a partnership, or an unincorporated association or trust.

In the higher education and research-intensive sectors, a qualifying entity could include, but is not limited to, a foreign or UK:

• university, which is registered as a charitable organisation
• private university
• trust
• university spin-out
• university subsidiary (for example a company that a university has incorporated and carries out specific activities that the university operates)
• research organisation
• private company or corporation doing contractual work with a higher education institution or research organisation.

Qualifying assets include land, tangible, moveable property, and ideas, information or techniques which have industrial, commercial or other economic value (‘intellectual property’).

In the higher education and research-intensive sectors a qualifying asset could include but is not limited to:

• designs
• plans, drawings and specifications
• software
• trade secrets
• databases
• source code
• algorithms
• formulae
• land
• tangible moveable property, such as advanced or specialised laboratory equipment
• patents, including future intellectual property arising from collaboration with other entities
• licences granting the use of assets, whether those licences are commercial or non-commercial or relate only to research and development
• intellectual property (all forms)

Agreements between parties that may give rise to the creation of such assets in the future may also be of interest to the government for assessment under the NSI Act, particularly if they are related to the sectors set out in the Notifiable Acquisition Regulations.

Mandatory notification

If you are a party acquiring a qualifying entity, you are legally required to tell the government about certain acquisitions in 17 sensitive areas of the economy as these areas are considered more likely to give rise to national security risks. Read the regulations on legislation.gov.uk.

Acquisitions of entities in these areas which meet certain thresholds of control and other conditions (specified in notifiable acquisition regulations) are called notifiable acquisitions and need to be notified, and approved, before proceeding.

Acquisition of assets are not subject to mandatory notification.

The areas of the economy are:

• Advanced Materials
• Advanced Robotics
• Artificial Intelligence
• Civil Nuclear
• Communications
• Computing Hardware
• Critical Suppliers to Government
• Cryptographic Authentication
• Data Infrastructure
• Defence
• Energy
• Military and Dual-Use
• Quantum Technologies
• Satellite and Space Technologies
• Suppliers to the Emergency Services
• Synthetic Biology
• Transport

Read further guidance for each of these areas.

The regulations specifying the acquisitions within the 17 areas of the economy listed above which are subject to mandatory notification were published in 2021. Read the regulations on legislation.gov.uk.

You will need to tell the government about a notifiable acquisition by submitting a notification online.

Once a complete notification has been accepted, the government has 30 working days to review the acquisition and provide clearance or call in the acquisition for a national security assessment. If the acquisition is called in, the government has 30 working days to complete its national security assessment, although this can be extended by a further 45 working days if more time is needed. After this, any further extensions must be agreed by the acquirer. If the government clears your acquisition, it cannot investigate it again, unless you have submitted false or misleading information.

If you complete a notifiable acquisition without gaining approval from the government, the acquisition is void. There are civil and criminal penalties for proceeding with a notifiable acquisition without gaining the necessary approval.

Voluntary notification

You can submit a voluntary notification if you are a party to a qualifying acquisition that is not covered by mandatory notification and want to gain clarity as to whether the government is going to call in the acquisition. You are not legally required to tell the government about your qualifying acquisition if it is not subject to mandatory notification, however, if the government reasonably suspects it may give rise to, or may have given rise to, a national security risk, it may still be called in.

The statutory timelines for the assessment of a voluntary notification are the same as for mandatory notifications, noted above.

In deciding whether to notify voluntarily, parties may be assisted by the NSI Section 3 Statement which provides further information on how the government expects to use its call-in power and assess qualifying acquisitions, or contact the Research Collaboration Advice Team (RCAT).

You can contact the ISU for general enquiries or advice about the Act on investment.screening@cabinetoffice.gov.uk.

When you may want to notify

If you are planning an acquisition of a qualifying entity in one of the defined sensitive areas of the UK economy, you may be legally required to submit a mandatory notification and receive approval from the government before you can complete it. Higher Education Institutions and other research organisations work within many of these sensitive areas for which mandatory notifications are required. Completing a notifiable acquisition without approval will mean the acquisition is void and may mean that the acquirer is subject to civil or criminal penalties.

There is no legal requirement to notify the government of acquisitions of control over assets. However, the government can call in acquisitions of qualifying assets if it reasonably suspects that the acquisition gives rise to, or may give rise to, a risk to national security. All cases will be considered on an individual basis. You can submit a voluntary notification if you are a party to a completed or planned qualifying acquisition that is not covered by mandatory notification and want to seek assurance whether or not the government is going to call in the acquisition now or in the future. A voluntary notification can be submitted by either the acquirer or the target, independently.

For the purposes of the NSI Act, the government is more likely to be interested in academic collaborations that are connected to, or could be used in connection with, the activities set out in the Notifiable Acquisition Regulations. This is because these collaborations are more likely to pose a risk to national security.

Parties may want to notify acquisitions which involve the acquirer gaining greater control over an asset through the licensing of a form of intellectual property or commercial rights over forms of intellectual property which may be generated in future.

Academic collaborations that are unconnected to the activities set out in the Notifiable Acquisition Regulations may also be of interest under the NSI Act, although this is less likely.

You can receive help on specific cases from the Research Collaboration Advice Team (RCAT) (see above).

Research collaborations and activities receiving funding from a UK government entity or via a body affiliated to the government, for example a specific funding agency, are not automatically exempt from scrutiny under the NSI Act and may still need to be notified.

If the government decides to assess your qualifying acquisition for a national security risk (calling in)

You will be told by the government if it is assessing your acquisition for a national security risk. This is known as ‘calling in’ the acquisition. A qualifying acquisition may be called in after you have submitted a notification or because it comes to the attention of the government through market monitoring. The government is only able to do this if it has a reasonable suspicion that the acquisition may pose a risk to national security.

When assessing the likelihood of a qualifying acquisition giving rise to a risk to national security, the government will consider three primary factors. These are the risks posed by a) the target, b) the acquirer, and c) the control being acquired, as well as any other appropriate considerations. Further details of these are in the NSI Section 3 Statement.

NSI Act and Export Controls

The Export Control Joint Unit (ECJU) administers the UK’s system of export controls and licensing for military and dual-use items. The NSI Act and Export Control systems are separate regulatory functions and you may need to notify both the ISU and ECJU of any acquisitions. If you have secured a licence through the ECJU this does not exempt your acquisition from requirements under the NSI Act. Similarly, if you have received clearance from the Secretary of State under the NSI Act you may still be required to obtain an export licence from the ECJU.

Scenarios of acquisitions

The hypothetical examples below show qualifying acquisitions involving higher education and research institutions in which the government may consider issuing a call-in notice if it reasonably suspects the acquisition has given rise, or may give rise, to a national security risk.

Involvement in university research

Private companies, governments and other organisations are frequently involved in universities’ and other organisations’ research at early stages, often at a pre-commercial stage.

This can be done through a collaborative, or other, agreement involving:

• contract or sponsored research
• sponsoring a research position (for example, a chair)
• sponsoring a research theme
• licensing intellectual property

Such activities are qualifying acquisitions under the NSI Act if through these agreements a person gains control, or greater control, over a university or research organisation’s qualifying assets, which can include both tangible moveable and intellectual property, for example where such assets are licensed out (exclusively or non-exclusively) by a university.

It is also a qualifying acquisition if a party gains control, or greater control, over a qualifying asset generated by the research it has funded. Any agreement that provides for this is also in scope of the NSI Act as a contemplated qualifying acquisition.

Acquisitions of qualifying assets do not have to be mandatorily notified under the NSI Act, but the government can call in such an acquisition if it reasonably suspects the acquisition has given rise to, or may give rise, to a national security risk.

Example 1

A company enters into a collaboration agreement with a UK university. Through the agreement, the company will acquire the right to use commercially any existing and future intellectual or tangible property of the university related to the collaboration.

The parties are not legally required to notify the government in this scenario because mandatory notification requirements do not apply to acquisitions of assets, including control over intellectual property. However, parties may want to submit a voluntary notification if they believe there is a potential risk to national security.

The government may be able to call in this contemplated acquisition for assessment if it reasonably suspects the acquisition may give rise to a risk to national security. This is because this scenario is a contemplated qualifying asset acquisition as the company gains control over intellectual or tangible moveable property generated from the collaboration. If the intellectual property also falls within one of the 17 sensitive areas of the economy, this could increase risk.

Example 2

A non-UK entity provides funding for a UK university to carry out a research project on the foreign company’s behalf. The foreign company sits on the steering board for the research project. The foreign company will also be entitled to all intellectual and tangible moveable property generated from the research.

The parties are not legally required to notify the government in this scenario because mandatory notification requirements do not apply to acquisitions of assets (the foreign company will acquire access to all intellectual property and tangible moveable property generated). However, parties may want to submit a voluntary notification if they believe there is a potential risk to national security.

The government may be able to call in this contemplated acquisition for assessment if it reasonably suspects the acquisition may give rise to a risk to national security. This is because this scenario is a contemplated qualifying asset acquisition as the funding gives the company control over intellectual or tangible moveable property generated through this project.

Example 3

An academic institution acquires the right to use and access all of the background intellectual property of another academic institution through a collaboration agreement. The acquiring academic institution has known foreign-military ties.

The government may be able to call in this acquisition for assessment if it reasonably suspects the acquisition has given rise to, or may give rise, to a national security risk. This is because this scenario is a qualifying asset acquisition as the acquiring academic institution has acquired control over the other academic institution’s intellectual property. The acquirer risk may also be heightened due to the military connections of the acquiring academic institution. The intellectual property may fall within the 17 sensitive areas of the economy, therefore target risk may also be applicable.

The parties are not legally required to notify the government in this scenario because mandatory notification requirements do not apply to acquisitions of assets. However, parties may want to submit a voluntary notification if they believe there is a potential risk to national security.

Example 4

A company enters a collaborative research project with an academic institution in the UK. The collaboration agreement stipulates an option for the private company to enter into a non-exclusive licence agreement for any intellectual property generated by the project. The private company decides to exercise this option and enter into a non-exclusive licence agreement to use the intellectual property which has been generated by the academic institution and is being used to conduct further research.

The government may be able to call in this acquisition for assessment if it reasonably suspects the acquisition has given rise, or may give rise, to a risk to national security. This is because the granting of the licence is an acquisition of control over a qualifying asset. Through the licence the private company has acquired control over intellectual property.

The parties are not legally required to notify the government in this scenario because mandatory notification requirements do not apply to acquisitions of assets, including control over intellectual property. However, parties may want to submit a voluntary notification if they believe there is a potential risk to national security.

Developing or forming research centres

Research centres are often collaborative projects between different research organisations and public and private partners.

If, in the development or founding of a research centre, control over qualifying assets or entities is acquired, the government can call in such a qualifying acquisition for assessment if it reasonably suspects the acquisition has given rise, or may give rise, to a risk to national security.

Example 5

A research centre is being set up between a UK university and multiple non-UK entities, including a non-UK local government body. The centre will be based overseas in a science park. A five year agreement will be put in place on the intellectual property being produced by the centre and its role as a teaching and innovation facility. The research centre is expected to often have visiting or residing academics from the UK university. Any intellectual property that is produced by the research centre will be split between the UK university and one or more of the non-UK entities invested in the centre. The research centre will conduct academic work across multiple sectors including work on synthetic biology, a sector identified in the notifiable acquisition regulations.

The sharing of any existing intellectual property with the centre, or setting up an agreement to share future intellectual property that is developed, may be asset acquisitions under the NSI Act, and the government may be able to call in such acquisitions if it reasonably suspects the acquisitions have given rise, or may give rise, to a national security risk.

As there is work being conducted in one of the 17 sectors, the UK university may wish to discuss with its RCAT point of contact, to consider any potential risks in setting up the research centre overseas.

The UK university may want to submit a voluntary notification under the NSI Act. Such a notification would include relevant information about what research would be conducted at the centre and how intellectual property would be shared with the non-UK partners.

Example 6

A UK research organisation partners with a UK-based research centre, which is owned by a foreign research organisation and a private UK company and carries out research in one of the 17 sensitive areas of the economy specified in the Notifiable Acquisition Regulations. Through the terms of the partnership, the research centre gains control over the laboratory equipment and software of the UK research organisation.

This acquisition is an acquisition of control over a qualifying asset. The research centre can now use the UK research organisation’s laboratory equipment and software. The government may be able to call in this acquisition for assessment if it reasonably suspects the acquisition has given rise, or may give rise, to a national security risk.

In this scenario, none of the parties involved is legally required to notify the government because mandatory notification requirements do not apply to acquisitions of assets such as the laboratory equipment and software. This applies even if the assets are held by a qualifying entity that operates in areas of the economy specified in the Notifiable Acquisition Regulations.

The parties may, however, choose to submit a voluntary notification.

Developing university or research organisation spin-out companies

A university or research organisation spin-out company is a company which is created to develop a university’s research for commercial application. The spin-out is a private company but often the university will retain shares in the company or retain some ownership of the intellectual property.

If a spin-out company is acquired or the spin-out gains control of qualifying assets of a university or research organisation, this could be called in by the government for assessment if it reasonably suspects this has given rise, or may give rise, to a risk to national security.

If an established spin-out is subsequently acquired by another party, for example by trade sale, merger, or investment, this could also be in scope of the NSI Act. If the spin-out operates in one of the 17 sensitive areas of the economy specified in notifiable acquisition regulations, there may be a legal requirement to notify the government of the acquisition.

Example 7

A number of investors establish a university spin-out in the UK in order to commercialise a UK university’s patented technology. The investors and the university receive equity stakes in the spin-out and the technology is licensed to the spin-out through the university’s Technology Transfer Office.

The government may be able to call in this acquisition for assessment if it reasonably suspects the acquisition has given rise, or may give rise, to a risk to national security. This is because in this scenario there is a qualifying acquisition of a qualifying asset as the spin-out has gained control over the use of the technology as a licensee.

The parties are not legally required to notify the government of the grant of the licence because mandatory notification requirements do not apply to acquisitions of assets.

Example 8

A venture capital fund that is backed by multiple investors invests in an established university spin-out, in return for a 27% equity stake. The university spin out carries out research and produces goods within the quantum research field. Quantum technologies is one of the 17 sensitive areas of the economy that are specified in the notifiable acquisition regulations.

The venture capital fund (the acquirer) is legally required to notify the government of its planned acquisition and obtain approval before completing it, otherwise the acquisition will be void. This is because this investment is a notifiable acquisition of a qualifying entity which is specified in the notifiable acquisition regulations.

The fund and certain employees may also be liable to criminal or civil penalties for completing the acquisition without approval.

Funding employees or students in university programmes

Funding for PhDs and other academic placements can come from various sources including industry, academic institutions and public and charitable funders. Companies fund employees or students to carry out research projects including PhDs at universities.

The ownership of the intellectual property generated in academic placements can vary depending on the agreement, and can include the following scenarios:

• the student has rights over the intellectual property generated
• the intellectual property rights reside with the university
• the intellectual property generated is assigned to the company that is funding an employee to do research at a university and the terms are stipulated through the employee’s contract.

If a company or other person acquires control over intellectual property generated in the UK, for example the right to use the intellectual property, the government may be able to call in the acquisition if it reasonably suspects the acquisition has given rise, or may give rise, to a national security risk.  This would also apply to any agreement that provides for control to be acquired over a future intellectual property, even if the intellectual property had not yet been created, as it would be a contemplated qualifying acquisition. The fact that a research collaboration receives government funding does not exempt related acquisitions from being called in under the NSI Act.

Example 9

A private foreign company funds a university for an academic placement which results in a PhD. As part of the employee’s contract, all intellectual property generated is assigned to the company.

The government may be able to call in this contemplated acquisition for assessment if it reasonably suspects the acquisition may give rise to a risk to national security. This is because this scenario is a contemplated acquisition of control over a qualifying asset because the private company has contractual rights over any intellectual property generated by the employee during their PhD.

The parties are not legally required to notify the government in this scenario because mandatory notification requirements do not apply to acquisitions of assets.

Donating to an academic institution

Donations and donations for research are not covered by the NSI Act as no control is gained over a qualifying asset or entity. It is for universities to ensure robust and transparent procedures for accepting donations.

Many alumni and other parties donate to universities and related organisations. Universities have due diligence processes for accepting donations, which are often stated publicly.

Donations differ and may include a grant or sponsorship. They generally must meet the criteria that the donation will result in no commercial value for the donor.

Example 10

A private company donates a large sum to a university for the development of a new research laboratory. The private company is later awarded contracts as an equipment supplier at the same university in line with the necessary contracts regulations.

This scenario is not a qualifying acquisition and is not in scope of the NSI Act as the private company has not gained control over the use of the laboratory or any intellectual property. The company has won contracts through the university’s standard tender process.

Other resources to ensure best practice in your approach to protecting your research

The National Protective Security Authority (NPSA) and the National Cyber Security Centre (NCSC) have updated their protective security guidance for start-ups, spinouts and scaleups, and those who invest in them. This guidance, called Secure Innovation, aims to give early stage emerging technology companies the motivation and tools to deliver effective protective security, increasing their resilience to state threats and their competitive advantage whilst attracting funding or customers. Spinouts entering the market are vulnerable to a variety of threats, Secure Innovation aims to help those spinouts and the institutions that support them to reduce their vulnerability to certain threats.

NPSA has also published guidance on Trusted Research. This outlines the potential risks to UK research and innovation and aims to help researchers, UK universities and industry partners protect their research from potential theft, misuse or exploitation and make informed decisions around international research collaboration.

Universities UK (UUK) has published detailed guidance for institutions on the considerations and measures they should take to guard against hostile interference and promote academic freedom.