On 26 June 2026, Regulation (EU) 2026/1386 on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452 (the New Regulation) was published in the Official Journal. Its substantive screening obligations will apply from 17 January 2028.
What you need to know
- Mandatory screening across all 27 Member States: The New Regulation replaces the EU's voluntary coordination framework with a binding obligation for every Member State to establish and operate a national foreign investments screening mechanism covering a common minimum scope of sensitive sectors — from dual-use items and semiconductors to critical infrastructure and electoral systems.
- Intra-EU investments are now in scope: Investments made through EU-incorporated subsidiaries that are ultimately owned or controlled by non-EU investors fall squarely within the new framework, closing a significant structural loophole under the former regime (albeit one that most Member States already filled at national level).
- Application expected by early 2028: The New Regulation will enter into force on 16 July 2026, but will apply from 17 January 2028, i.e. 18 months thereafter, giving Member States a defined window to align their national regimes.
Greater harmonisation through a common baseline
The New Regulation repeals Regulation (EU) 2019/452, which established a framework for screening foreign direct investments and a cooperation mechanism between Member States and the European Commission, but neither harmonised national systems nor required any Member State to screen specific investment categories. The New Regulation mandates, for the first time, harmonised foreign investment screening across all 27 Member States. Each Member State retains sole responsibility for its own screening decisions and national security, but the system now operates within a binding common baseline.
The New Regulation strengthens the efficiency and effectiveness of foreign investment screening and increases harmonisation across the Union. The EU legislator considered these improvements "necessary" in light of "the integration of global economies, combined with war and geopolitical tensions". Compared to Regulation (EU) 2019/452, the New Regulation also seeks greater harmonisation because "reducing divergence is crucial to ensuring predictability for investors in respect of the applicable national regimes and their characteristics, thereby reducing associated compliance costs".
This legislative framework reflects both Member States’ decisional practice over the past five to six years (the post-Covid-19 pandemic era) and negotiations between the three EU institutions. The EU Parliament called for a more pervasive regulation – broadening the mandatory sectors and strengthening the European Commission's powers. The Council was more reluctant to impose strict prescriptions on Member States, preferring to limit the relevant sectors mainly to dual-use or military products and to soften the European Commission's powers. The European Commission sought a workable compromise.
A mandatory and coordinated screening process
While it does not establish a single EU filing system nor a system akin to the one-stop-shop under the EU Merger Regulation, the New Regulation does impose a more structured procedural baseline across Member States. For deal planning, three national-level process points are particularly important at the outset.
First, screening is no longer left to a patchwork of national approaches. Each Member State must operate a transparent and non-discriminatory screening mechanism. For investments falling within the common minimum scope discussed below, that mechanism must require filing and screening before completion. In practice, this will have limited immediate impact as all Member States have by now adopted a national screening mechanism, generally imposing a standstill obligation. Some national mechanisms will, however, need significant overhaul to comply with the new procedural and substantive requirements.
Second, national procedures must follow a common basic architecture: an initial review, capped at 45 calendar days from the date on which the filing is deemed complete by the screening authority, and, where required, an in-depth investigation by the relevant screening authority. Screening authorities must also be able to monitor compliance, detect and prevent circumvention and impose effective, proportionate and dissuasive penalties for non-compliance.
Third, screening authorities must also have post-completion call-in powers. Investments that fall within a Member State’s screening mechanism but are not subject to prior authorisation may be reviewed on the screening authority’s own initiative for at least 15 months and up to five years after completion on grounds of security or public order. Investments that were subject to prior authorisation but were not filed, or were filed only after completion, may also be called in for at least 24 months after completion.
Who and what is caught
The New Regulation defines "foreign investment" broadly: any investment – direct or through an EU-based subsidiary of a non-EU investor – that establishes or maintains lasting links enabling effective participation in the management or control of a Union target (the EU company being acquired). “Effective participation" extends beyond decisive influence to situations where an investor can nonetheless materially impact a target's commercial policy through shareholding, voting rights, contractual leverage or significant board representation. This harmonises the treatment of investments made through EU-based subsidiaries, reducing divergence across Member States. Purely passive minority investments would fall outside the concept of effective participation. The New Regulation excludes (even if only in its recitals) pure portfolio investments – acquisitions of securities intended solely for financial return without any intention to influence the Union target’s management or control.
The New Regulation also relies on the concept of “beneficial owner” – the natural person(s) who ultimately own or control the investor, benefit from the investment, or on whose behalf it is made. Where no natural person can be identified, the highest identifiable legal entity in the ownership chain serves as the beneficial owner. This concept is relevant at several points in the procedure. The beneficial owner’s identity can trigger a mandatory notification – for example, where that person is subject to EU restrictive measures or previously participated in an investment that was not authorised or with whose conditions the investor failed to comply. The filing must also disclose this, and it forms part of the assessment of whether the investor is likely to pursue third-country objectives or serve as a conduit for indirect foreign influence.
The New Regulation excludes two categories of transaction from its scope: financial resolution transactions (relevant in the banking and insurance sectors), where speed is essential to financial stability, and internal group restructurings that do not change beneficial ownership, unless they introduce a new legal entity established in a third country that is not already represented in the upstream ownership chain of the Union target.
Technically, foreign investments carried out through the establishment of new facilities or of an undertaking for the performance of an economic activity in the EU (so-called greenfield investments) are treated differently: they remain within the scope of the New Regulation, but – despite the EU Parliament's expectations – are not subject to the mandatory prior authorisation requirement for the common minimum scope; Member States therefore remain free to decide whether to include or indeed keep (e.g. France, Italy, Romania) such investments within their national screening mechanisms.
The sectors that matter: a common minimum scope
Every Member State must now impose a prior authorisation requirement on foreign investments where the target operates in one of seven defined categories:
- dual-use items and military goods and technologies;
- defence products;
- semiconductor, quantum and AI technologies (specifically listed in Annex I);
- critical transport, energy or digital infrastructures (criticality follows a risk-based targeted assessment taking into account "national security and vital societal functions" – examples include energy storage facilities, airports, port managing bodies, cloud computing service providers and public electronic communications network providers);
- strategic raw materials (a sector that also falls within the scope of the so-called Industrial Accelerator Act, which – though still at proposal stage – may raise coordination questions);
- financial market operators/institutions; and
- electoral infrastructure.
The common minimum scope is targeted rather than sector-wide, balancing security concerns with proportionality. Member States must regularly reassess which infrastructure is designated as critical. Entities should be able to ascertain whether they fall within these categories. This list is a floor, not a ceiling: Member States retain full discretion to extend their screening mechanisms to additional sectors.
How risk is assessed
To ensure a consistent approach, screening authorities should assess likely risks to security or public order from two angles, based on certain common standards and criteria pertaining to the foreign investment itself and the foreign investor behind it.
On the investment side, Member States and the European Commission must consider whether the investment is liable to produce effects on certain sectors, assets or activities that are crucial to security or vital societal functions, notably:
- projects or programmes of Union interest as listed in Annex II;
- the availability of critical technologies, including outside the Union, in particular those listed in Annex III, and the protection and availability of intellectual property or other intangible assets;
- the security, integrity, resilience and functioning of critical entities or critical infrastructure, including land and property necessary for the operation of such infrastructure, as well as those of entities operating in the cybersecurity sector;
- the continuity of supply of critical inputs, including services;
- the protection of sensitive information, including personal data, in particular the foreign investor’s ability to access, control or otherwise process such information;
- the freedom and pluralism of the media, including online and social media platforms that can be used for large-scale disinformation or criminal activities;
- the protection of electoral processes;
- the protection of public health, including the provision and availability of critical medicines, as listed in Annex IV;
- the protection of food security, including farming where the Union target possesses or operates more than 10,000 hectares of farmland; and
- the security of military facilities and other sensitive public facilities in the immediate geographical proximity of the Union target.
On the investor side, the focus lies on the context and circumstances of the foreign investment, notably whether the foreign investor or connected persons:
- are likely to pursue a third country’s policy objectives, including by using the investment to coerce a Member State or the Union;
- are likely to facilitate the development of a third country’s military capabilities;
- are likely to use the investment to support internal repression in a third country or the commission of serious violations of human rights or of international humanitarian law;
- have previously made a foreign investment that was screened by a Member State and either not authorised or authorised subject to mitigating measures that were significantly or repeatedly not complied with;
- have already been involved in activities negatively affecting security or public order in a Member State;
- have engaged in illegal or criminal activities, including circumvention of EU restrictive measures;
- are subject to EU restrictive measures, where relevant taking into account the reasons for those measures;
- are established in a third country identified as having significant strategic deficiencies in its anti-money laundering and counter-terrorist financing regime;
- are subject to third-country laws requiring information-sharing for intelligence purposes without due process or oversight mechanisms; or
- have an opaque ownership structure.
The European Commission will make available a "risk evaluation form" for Member States to assess these elements.
The New Regulation codifies a clear hierarchy: where a screening authority identifies a likely negative effect on security or public order, the host Member State must first consider mitigating measures before resorting to prohibition or unwinding. Mitigating measures may include governance changes, voting right modifications, conditions on access to sensitive technologies or information, supply commitments, continuation of business activities, sourcing from secure and reliable suppliers, cybersecurity protocols, data localisation or storage requirements, audit and security checks, compliance monitoring and notification obligations. Prohibition or unwinding may be imposed only where the likely negative effects cannot be adequately addressed through other means. Member States must give affected parties the opportunity to make their views known effectively before adopting any adverse decision. Those parties retain the right to an effective judicial remedy.
A (slightly) coordinated approach to multi-jurisdictional transactions
The New Regulation introduces coordination requirements for transactions that are notifiable in more than one Member State.
The EU Parliament wanted strict coordination: all notifications following the first one submitted within three days, and authorities coordinating on scope, timelines and remedies, aiming for consistent and, where possible, simultaneous final decisions. The New Regulation adopts a softer approach.
The notifying party "shall endeavour" to file on the same day in all relevant Member States. Member States "shall endeavour" to send notifications through the cooperation mechanism on the same day and to align the timing of their screening procedures. The relevant Member States are also encouraged to cooperate and discuss the compatibility of their screening decisions.
An enhanced cross-border cooperation mechanism
The New Regulation substantially strengthens the cooperation mechanism.
- Member States must notify other Member States and the European Commission where the investment falls within the common minimum scope and specific risk indicators relating to the foreign investor are present. These include (i) direct or indirect control by a third-country government (including through ownership structure, significant funding, special rights or state-appointed directors or managers), (ii) subjection to EU restrictive measures, or (iii) prior involvement in an investment that a screening authority did not authorise or authorised subject to mitigating measures with which the investor significantly or repeatedly failed to comply.
- A separate notification obligation applies when the host Member State (i.e. the Member State in which the transaction should take place) opens an in-depth investigation and the target has subsidiaries or relevant operations in other Member States, or is active in a project or programme of Union interest. Annex II lists these strategically important EU initiatives, including the EU space programme, Horizon Europe and the trans-European transport and energy networks.
- Finally, Member States must notify other Member States and the European Commission when (a) in exceptional cases, they intend to impose mitigating measures or prohibit or unwind the transaction without carrying out an in-depth investigation or (b) they consider that the foreign investment could negatively affect security or public order in at least one other Member State.
The New Regulation also lists minimum information that the notifying Member State must provide (to be included in a form established by the European Commission).
Timelines are tightly calibrated. For investments within the common minimum scope that also present one of the specified risk indicators, the host Member State must notify other Member States and the European Commission within 15 calendar days of filing. Where the notification is triggered by the opening of an in-depth investigation, the host Member State must send it within 45 calendar days of filing. Other Member States have 15 calendar days from notification to signal an intention to comment; the European Commission has 20 calendar days to signal an intention to issue an opinion. Where no additional information is requested, substantive comments must follow within 20 calendar days for Member States and opinions within 30 calendar days for the European Commission, counted from notification.
Where additional information is requested, the clock runs from receipt of that information. Comments must then be provided within 15 calendar days and European Commission opinions within 25 calendar days. If substantial new information emerges before the relevant deadline, the notifying Member State may extend the deadline once by up to 20 calendar days. Save in exceptional circumstances justified by security or public order, the host Member State may not adopt its screening decision before the relevant comment and opinion deadlines have expired. This will directly affect review periods at national level and, therefore, transaction timetables.
The European Commission may propose mitigating measures and may also issue a single opinion addressing multiple foreign investments jointly where their combined effect could negatively affect security or public order. This aggregation power is particularly relevant for serial acquirers or coordinated investment strategies.
The European Commission's opinion and/or other Member States' comments, where issued, must be discussed at a meeting – upon request of the European Commission and/or the relevant Member State(s) – and taken into "due consideration" by the notifying Member State.
The cooperation mechanism also provides for practical information-gathering powers and enhanced business intelligence sharing. A host Member State that needs information held by a person in another Member State may ask that Member State to obtain it, or may ask the European Commission to gather it on its behalf. Similarly, Member States and the European Commission can provide comments and opinions to a host Member State on non-notified foreign investments, but only where duly justified – namely, where they consider the investment likely to negatively affect security or public order, or where they have information relevant for screening. The recitals also signal a growing intelligence-sharing capability at EU level. Investors should expect screening authorities to test disclosures against an expanding pool of shared intelligence rather than assess them in isolation.
The European Commission may also act where it considers that the foreign investment is likely to negatively affect projects or programmes of Union interest on grounds of security or public order. The host Member State must take these comments and/or opinion into “due consideration” when deciding whether to screen the investment, and must provide a written explanation of its reasons for not screening and, where applicable, the alternative measures it intends to take to address the risks identified.
This institutionalises coordination at EU level without shifting decision-making power away from the host Member State, contrary to what the EU Parliament originally proposed.
To enable more effective cooperation, the European Commission must make a secure encrypted communication system and a centralised database operational within 12 months of entry into force. The database will capture outcomes since 12 October 2020 and be populated by Member States after completion of each national procedure. At least nine Member States may also request an optional online EU portal for electronic multi-jurisdictional filings – all filings in the requesting Member States must then be submitted via that portal using a specific online form.
What this means in practice
Foreign investment analysis must move upstream in the deal cycle. Mandatory prior authorisation, procedural standstills (mandatory waiting periods before screening decisions may be adopted) and cooperation-mechanism timelines mean that screening can no longer be treated as a secondary workstream to address after signing.
For multi-jurisdictional transactions, the new framework encourages simultaneous filing and coordinated screening across all Member States concerned – including aligned decision timing. The secure database lets screening authorities compare notes, so investors must ensure consistency across filings. The EU online portal may help both the notifying parties and Member States submit and review the same information – though one may wonder whether Member States will actually request this portal, as it would inevitably limit their discretion in setting national information requirements.
Call-in powers introduce a new dimension of post-closing risk, as the deadline for national authorities to exercise these powers is quite long. Transaction documentation should thus reflect this exposure.
Member States must publish detailed guidance on scope, thresholds, filing triggers and procedural rules – increased transparency that should help investors assess their filing obligations early. Each Member State must also publish an annual report with aggregated and anonymised data on the investments screened and the outcomes reached. This gives the market a growing evidence base on how authorities apply the regime in practice. The EU legislator missed an opportunity to require Member States to state reasons in their review decisions – a step that would have improved transparency and predictability across the market.
The New Regulation enters into force 20 days after publication in the Official Journal. Substantive screening obligations apply 18 months thereafter – expected early 2028. Certain provisions – including the obligation to notify national mechanisms, the European Commission's mandate to build the database and communication system, and delegated act powers – apply immediately upon entry into force. Regulation (EU) 2019/452 continues to govern investments undergoing screening on, or completed by, the date of application; the New Regulation does not apply retroactively to such investments.
Following the New Regulation, foreign investments screening in Europe is becoming more consistent and predictable, anchored in binding baseline rules and genuine cross-border cooperation for the first time. Investors and targets should use the 18-month implementation window to map their exposure to the minimum-scope sectors; stress-test transaction timelines against the new procedural framework; and develop a coordinated filing strategy that reflects the increased information-sharing between national screening authorities. We consider early planning will be key to successfully navigating the new regime.
Other authors: Giulia Carnazza, Counsel; Dimitra Karakioulaki, Associate; Eleanor Popplewell, Associate; Sarah Schaible, Transaction Lawyer; Aamir Hajjout, Research Assistant
