The National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021 (the NARs) specify activities in 17 sensitive sectors of the UK economy which bring a target entity in scope of mandatory notification under the UK’s National Security and Investment Act 2021 (the NSIA).

In March 2026, the UK Government published its response to a public consultation on proposed changes to the NARs which took place between July and October 2025, announcing changes aimed at providing “greater clarity” for businesses, and “cutting red tape”, while at the same time strengthening controls on critical sectors. However, the changes are not expected to result in a material reduction in the number of notifications, and the quality of updated guidance (yet to be seen) on the revised sector definitions will play an important role in whether clarity is significantly improved. 

Key proposed changes of note include:

1. Adding of a new sector definition to cover acquisitions in the Water sector.
2. Updating the Artificial Intelligence (AI) sector definition to move out-of-scope companies which use AI as an “off the shelf” tool for internal processes.
3. Removing Critical Minerals and Semiconductors from the existing Advanced Materials schedule and adding them into two new standalone sector definitions (with the number of sensitive sectors subject to mandatory notification increasing from 17 currently to 19 after the changes are made, also factoring in the new Water sector).
4. Amendments to several other sector definitions, including Critical Suppliers to Government, and Energy.

The Government will also introduce welcome new exemptions so that mandatory notifications will no longer be required for certain types of internal reorganisations or appointing liquidators, special administrators and official receivers – the Government having confirmed its intention to add these exemptions when it launched its consultation on the NARs last July. 

Water

The Government proposes to add a new schedule to the NARs covering the 17 regional water and/or sewage undertakers operating in England and Wales but excluding companies operating solely as retailers in the non-household retail market for water. The Government proposes that New Appointments and Variations (NAVs) (where companies provide water and/or sewerage services to customers in an area previously served by the incumbent monopoly provider) will be in scope but with a minimum size threshold so that only larger NAVs will be captured.

The proposed addition of the regulated water and sewerage undertakers reflects their position as the owners and operators of critical national infrastructure and comes in a context of wider water sector reform, including the Independent Water Commission’s report delivered in July 2025 and the Government’s subsequent White Paper published in January 2026. The Government’s White Paper proposed to merge the powers of the four existing regulators into a new “Integrated Water Regulator” but did not make clear whether the new regulator will have the power to block material changes in control of water companies, as the IWC had recommended, so it remains to be seen if the expansion of the UK’s national security regime is intended to address this recommendation, or sit alongside similar powers for the new industry regulator.

Investors in the water sector will need to carefully assess the need for NSIA filings in future, in a context where the regime captures increasing shareholdings or voting rights to more than 25 per cent, more than 50 per cent, or 75 per cent or more (as well as certain other “trigger events”), and where significant new equity across the industry is likely to be needed during PR24.

Artificial Intelligence

Feedback from the public consultation indicated concerns that the existing AI sector definition is excessively broad and captures activities with no national security implications, particularly in view of the rapidly developing use of AI in the economy.

The Government’s consultation set out a draft definition which aimed to capture national security risks from evolving AI technology, while excluding low-risk cases where consumer AI is used as a tool within internal processes. Based on feedback in response to the consultation, the Government now proposes to revise the NARs to:

• Exclude the use of non-consumer AI systems for routine business activities;
• Exclude the use of licensed third-party AI systems; and
• Exclude certain modifications made to AI systems and testing of AI systems as part of routine business deployment activities and IT policies.

Critical Minerals and Semiconductors

Currently, Critical Minerals are captured within the existing Advanced Materials schedule, which captures the extraction, refinement, processing, production and end of life recovery of 45 “critical materials” listed in the NARs.

The Government’s new definition for Critical Minerals proposes to: 

• Specify activities which are relevant to critical minerals, building on parts of the existing Advanced Materials schedule, while adding definitions for exploration, extraction, processing and recycling; and
• Update the list of minerals in scope to capture all 34 which are currently listed on the Critical Mineral Intelligence Centre’s (CMIC) latest criticality assessment (e.g. aluminium, helium, iron, magnesium and zinc), while retaining strategically important minerals necessary for defence or scientific purposes which are not on CMIC’s list

Similarly, the Government proposes to carve Semiconductors out of the existing Advanced Materials schedule and create a new schedule, combining it with the existing Computing Hardware schedule to create a single more coherent definition, which also newly captures advanced packaging techniques, activities involving the wider design process of processing units and memory chips, semiconductor-related devices, and advanced chip designs.

Critical Suppliers to Government

The Government proposes to update references to “List X” accreditation with references to “Facility Security Clearance” and to add in scope delivery of certain notifiable services to a relevant government authority (defined as one of the 24 ministerial government departments) below SECRET level, where delivery of those services “will or is likely to result in” the entity generating or obtaining access to material to which a security classification of OFFICIAL together with a marking of SENSITIVE has been applied or could be applied.

The additional services which will now be in-scope include: accounting or financial services; facilities management services; human resources or recruitment services; information technology services; or security and security hardware services.

A consequential change is also proposed to the Data Infrastructure sector definition, removing the provision requiring notification for entities solely on the basis of having contracts with a Public Sector Authority, given the overlap with the Critical Suppliers to Government schedule, which was identified by respondents to the public consultation.

Energy

The main changes proposed to the Energy sector schedule relate to the electricity definition, where the Government proposes to align the definition of an aggregator more closely to Ofgem’s definition and extend the definition to capture multi-purpose interconnectors (MPIs). 

Another proposed change involves amending the “cumulative capacity” threshold for acquisition of electricity assets. Currently this requires a filing to be made where the total installed capacity of generating assets and electricity available for aggregation available to the qualifying entity, the acquirer, and the acquirer’s group is equal to or greater than 1GW. The Government proposes to amend this so that a filing is only triggered where the relevant capacity being acquired increases the total installed capacity of the acquirer or group to meet or exceed thresholds in 500MW increments starting from 500MW. The “individual generating asset” threshold will remain unchanged, so that a filing is also required in relation to acquisitions of individual assets with installed capacity of 100MW or more.

This will be a welcome change for most investors in UK generation assets: while the “cumulative capacity” threshold now kicks in at 500MW rather than 1GW, such that investors with smaller portfolios than previously may now be caught, investors with significant existing installed capacity should no longer need to make a mandatory NSIA filing for every additional acquisition of generation capacity in the UK, providing the acquisition does not result in crossing a 500MW threshold.

Changes to other sectors

Certain other changes will also be made to the schedules containing the sector definitions for Communications (mainly to add or remove certain turnover thresholds), Data Infrastructure (in particular, to add all third-party operated data centres alongside certain Cloud Service Providers and Managed Service Providers, in addition to the change already mentioned above), Suppliers to the Emergency Services (mainly adding subcontractors requiring certain security clearance) and Synthetic Biology (minor changes to certain exemptions).

Looking ahead

Overall, while these changes signal the UK Government’s keenness to streamline the burden on businesses, the UK’s NSIA regime remains wide in scope and complex to apply. The Government’s own estimates of the impact of proposed changes during its public consultation suggested between 10 fewer and 35 more mandatory notifications per year, with a midpoint of 10 more notifications – in a context where approximately 1,000 transactions are being notified each year (mostly mandatory notifications) yet fewer than 50 transactions have been remedied since the regime commenced in January 2022, including only seven prohibitions.

The Government will bring secondary legislation before Parliament later this year to implement the proposed changes, though the timing for this has not yet been confirmed. Given that the proposed changes will have the effect of bringing some deals newly within scope of a mandatory filing, while others are removed from scope, businesses engaged in corporate transactions will need to carefully monitor their implementation.