National Security & Investments Act (NSIA)

To determine whether an activity falls within scope of NSIA, we look at three things: 

First, whether there is a ‘trigger event.' Entities that collaborate with the University often gain access to or control over qualifying assets such as IP, via contracts, collaboration agreements, sponsored research agreements, MTAs, etc. 

These contracts and agreements constitute the acquisition of a qualifying asset and therefore qualify as a ‘trigger event.’ 

Second, whether the work falls within scope of any of the ‘17 sensitive sectors of the economy'

Third, whether the UK Government may consider there to be a national security risk.

The NSIA does not provide a definition of what constitutes a national security risk, and is instead drafted broadly to allow Government flexibility in implementing the legislation. We assess this based on the security risk associated with the country in which the collaborator, and any affiliates involved, is/are located. 

Research collaborations and activities receiving funding from a UK government entity or via a body affiliated to the Government, for example a funding agency, are not automatically exempt from scrutiny under NSIA.  

If you are involved in an acquisition of a qualifying entity in one of the 17 sectors, there may be a legal requirement to submit a mandatory notification and receive approval from Government before you can complete it.  

There is no legal requirement to notify the government of acquisitions of control over qualifying assets. However, Government can ‘call in’ acquisitions for assessment if it reasonably suspects a risk to national security. You can submit a voluntary notification if you want to seek assurance on whether Government may call in the acquisition now or in the future, for example to make sure that we are not required to unwind a deal further down the line. 

Private companies, governments, and other organisations are frequently involved in university research, often at a pre-commercial stage, through agreements such as: 

• Contract or sponsored research

• Sponsoring a research position (for example, a chair) or theme

• Licensing intellectual property

• Developing or forming research centres

• Developing spinout companies

• Funding employees or students in university programmes.  

If you plan to undertake research activity that you think could fall within scope of NSIA, please get in touch with the Trusted Research team in Research Services (with your Department copied in) for advice. 

When deciding whether to make a voluntary notification under NSIA, researchers, Departments, and Research Services will jointly need to consider the risks and benefits of doing so, and the risk of proceeding without a notification.  

If the arrangement proceeds without making a notification, the Government may call it in for review anyway if they suspect there is a risk to national security. This call-in could come before the collaboration begins, but, if you have proceeded without a notification, is more likely to take place once the arrangement is agreed, announced, and in progress, making it very complicated to unwind if required to do so. 

Making a notification provides certainty about whether the Government intends to approve, block, or impose conditions on the collaboration at the outset. However, the process of preparing the notification requires a high level of effort from researchers, the Department, and Research Services. It is likely to take several months to prepare a notification, and for the subsequent Government review, potentially delaying research. 

The call-in review process, whether initiated through a notification or independent Government call-in, can have material, though time-limited, consequences for the research group. The University may receive a legal order covering the review period that imposes restrictions and reporting requirements on the research group, Department, and University. While it is difficult to predict the scope of these restrictions, researchers will be ordered not to contact the collaborator during the review period and may also be prevented from disclosing research to any third party and/or required to submit weekly reports to provide evidence of compliance with the order.  

Orders have, at times, severely restricted academic freedoms for research groups, and this should be considered when deciding whether to proceed with a collaboration that is likely to be a high security risk and in scope of the NSIA. 

The Trusted Research team supports researchers and departments with preparing NSIA notifications. Notifications must only be submitted by the Trusted Research team in Research Services, or, in certain scenarios, Oxford University Innovation (OUI). 

Researchers will need to provide a range of detailed information which outlines the nature of the work, and the level of control the acquirer (i.e., your collaborator) will obtain over the asset. You should work closely with your Department’s administrative team to ensure that all the relevant details are captured. The Contracts team in Research Services should also be consulted, as they will have details on other necessary aspects, such as IP arrangements. We will also need information directly from the collaborator, such as the organisational structure and ownership.  

If you consider that an NSIA notification may be appropriate for your collaboration, please contact the Trusted Research team in Research Services to discuss. If you, your Department, and Research Services agree that a notification will be made, Research Services will provide you with an NSIA notification form to complete. We will work with you and other relevant groups to finalise the form, then we will submit it via the Investment Security Unit's online submission service. 

When a notification has been submitted, Government will give provide a case reference number and aims to accept, reject, or return the notification to the notifier (i.e., if insufficient information has been provided, which may cause delays) within 5 working days. In some cases, this may take longer, particularly if an acquisition or specific issue is complicated. 

Most notifications will be cleared rather than called in, and the University will be informed of the outcome of Government’s decision during the 30-working day review period. 

Within 30 working days of acceptance of the notification form, Government will either: 

• Clear the acquisition and tell the University it can go ahead; 

• ‘Call in’ the acquisition for a full national security assessment; 

• Require further information, which you should provide to Research Services as soon as possible, to help complete the assessment (known as an ‘information notice’); 

• Require the University or people involved in the acquisition to attend a meeting (known as an ‘attendance notice’). 

Government will inform the University by email if it needs to carry out a full assessment. This is known as ‘call-in’. Following a call-in, there will be an ‘assessment period,’ which consists of an initial period of 30 working days, which may be extended by a further 45 working days and possibly further. 

A called-in acquisition may be cleared by Government at any time during the assessment period. This is called a final notification and you will be informed by email. 

Government can also put in place immediate and temporary controls in what is called an ‘interim order.’ An interim order may require the University to do or not do something, such as halting pre-completion steps or preventing the transfer of assets. The issuing of an interim order does not mean that the government will also issue a final order – an acquisition may still be cleared through a final notification. 

If Government determines there are national security risks arising from your acquisition, you may be informed of conditions Government is considering putting in place through a final order. You will be issued a final order if Government imposes conditions on your acquisition, or if your acquisition is blocked. Notices of final orders made by the government will be published on GOV.UK, with sensitive information removed.