Screening of foreign investments in the EU

Why foreign investment screening in the EU is changing fundamentally

Regulation (EU) 2019/452, the first common framework for screening foreign investments, has applied in the EU since 11 October 2020. It was primarily a mechanism through which Member States and the European Commission share information about potentially risky investments. However, each state decided for itself whether to introduce screening and how strict it would be.

Today, the situation is different. Russia’s invasion of Ukraine, technological rivalry with China, the energy crisis, and rising geopolitical tensions have convinced European leaders that a fragmented approach is not sufficient. The new Regulation (EU) 2026/1386 was adopted on 17 June 2026 and published in the Official Journal of the EU on 26 June 2026. It introduces a unified and significantly stricter framework and will replace Regulation 2019/452.

The Regulation entered into force on 16 July 2026 and will apply from 17 January 2028. By then, Member States, including the Czech Republic, must amend their national laws. If you are planning a sale with completion in 2028 or later, factor in the new rules now.

What is changing specifically in the EU screening system

The existing system was voluntary. EU Member States could, but did not have to, have screening. The result was a mosaic – some states had strong screening, others had almost none.

The new rule is clear: all EU Member States will be required to have mandatory foreign investment screening covering acquisitions in sensitive sectors. This is not only about states that have not had screening so far – even already modern regimes in Germany, France, or the Czech Republic will have to adapt to the new minimum standards.

Practical impact: From 2028, the acquisition of a company in a sensitive area by a foreign investor will be subject to prior approval in every EU Member State. In the Czech Republic, such approval is already required today for selected sensitive companies.

Minimum list of sensitive sectors and activities

The new Regulation defines a list of sectors and activities that, from 2028, must be screened everywhere in the EU. This list is not exhaustive – states may expand their screening – but it is binding as a minimum.

Mandatory screening includes:

• Defence and military material – any acquisitions of companies manufacturing, developing, or trading in items on the dual-use list (dual-use items) and military material from the official EU list.
• Advanced technologies – in particular semiconductors, quantum technologies, and artificial intelligence. For AI, this specifically includes general-purpose AI models or systems intended for space or defence, or AI models with systemic risks under the new EU Artificial Intelligence Act (EU AI Act).
• Critical infrastructure – energy, transport, and digital infrastructure, if the relevant state considers it critical based on its risk assessment.
• Critical raw materials – extraction, processing, recycling, and storage of strategic critical raw materials as defined in the Critical Raw Materials Act.
• Financial sector – central counterparties, central securities depositories, operators of regulated markets, operators of payment systems (excluding central banks), systemically important institutions, and global providers of specialised financial messaging services.

In many cases, however, these are activities that are not obvious at first glance. Are you selling a software company working on AI for autonomous systems? Screening. Are you selling an energy distribution company? Screening. Are you selling an IT service provider? It depends on whether it falls within critical infrastructure – which is now determined differently.

Extension of screening to intra-EU investments with foreign control

The new Regulation brings one of the most controversial changes: from 2028, it will also apply to investments made through a company established in the EU that is controlled by an investor from a third (non-EU) country.

What does this mean in practice? If your company is being acquired by a German holding company controlled by a Chinese fund, the transaction will be screened even if it is formally “intra-EU”. In the Czech Republic, this already applies today: under Czech law, a foreign investor also includes anyone who is directly or indirectly controlled by a person from outside the EU.

The change responds to the judgment of the Court of Justice of the European Union in Xella (C-106/22) of 13 July 2023. In it, the Court stated that the existing Regulation 2019/452 does not apply to an investment by a company established in the EU, even if it is controlled by an undertaking from a third country.

Two-stage screening with a harmonised timetable

The new system introduces a uniform template for all screenings in the EU: Phase I and Phase II.

Phase I (initial review):

• The authority carries out the initial review within 45 calendar days of the filing.
• It decides whether an in-depth review (Phase II) is needed.

Phase II (in-depth review):

• The Regulation does not set a uniform length for the in-depth review. It is governed by national law.
• During Phase II, the authorities examine the owner, the source of funding, and the impact of the investment on security and public order.
• For comparison: in the Czech Republic, the MPO currently decides on approval within 90 days of the opening of proceedings, and in particularly complex cases up to 30 days later. If the matter is discussed by the government, up to a further 45 days are added. While conditions are being negotiated, the proceedings are suspended, and the MPO may suspend them while documents are being supplemented.

Retroactive screening and long “call-in” periods

The new rules strengthen the review of investments that have already been completed. In the Czech Republic, however, this is nothing new: the MPO may review, of its own motion, an investment that did not require approval and was not consulted for up to 5 years after its completion. If the investor concealed facts, it may do so even later. For an investment that required approval and for which the investor did not apply, the MPO will open proceedings of its own motion without any time limit.

Specifically:

• Under the new EU Regulation, Member States will be able to review, of their own motion, even an investment that has already been completed, for a period of at least 15 months and at most 5 years after its completion.
• An investment that should have been approved in advance but was not will be reviewed by the authorities retrospectively as well. The investor faces penalties and a prohibition on the continued existence of the investment.

This means that the sale of your company is never entirely “safe” if it was not properly notified and did not pass screening with explicit approval.

How screening affects the sale of a company: Practical scenarios

Scenario 1: Sale of a technology company to an Asian fund

You own a Czech IT company that develops software for autonomous vehicles. An attractive offer comes in from a Singapore venture fund. Everything looks great – the price is good, the investors are credible, and their lawyers are professional.

If the fund acquires at least 10% of the voting rights, a seat on a corporate body or other effective control, and your company falls within a sensitive area under Section 7 of Act No. 34/2021 Coll., on the screening of foreign investments (the “ZPZI”), for example because it develops selected dual-use items, the fund must apply to the MPO for approval before completing the transaction. If the company does not fall under Section 7, the investor may file a request for consultation. The MPO will then inform it within 45 days whether it will open proceedings.

During the screening, the Czech authorities (specifically the Ministry of Industry and Trade, “MPO”) will assess whether the Singapore fund is linked to a state, whether it has a history of breaching conditions in other acquisitions, whether it is on sanctions lists, and whether access to your technology would pose a threat to the security of the Czech Republic.

If the authority identifies suspicious elements (for example, that the fund has ties to state entities, or that the artificial intelligence you develop could be used for military purposes), it negotiates conditions with the investor and submits the matter to the government. The MPO may impose conditions or a prohibition only on the basis of a government resolution.

Practical consequences:

• For approval under Section 7, expect proceedings of up to 90 days. In complex cases, where documents are being supplemented or where the government discusses the matter, it can take several months.
• You must provide the Czech authorities with detailed information on the funding, the fund’s ownership structure, its investment history, and the purpose of the acquisition.
• The investor faces the risk that the investment will be approved only subject to conditions – for example, that certain technologies may not be developed in the Czech Republic, that a Czech security auditor must be appointed, or that control over certain data may not be acquired.
• In the worst case, where the government concludes that the investment threatens security, the ministry will not grant approval or will prohibit the investment.

Scenario 2: Sale of an energy company to an EU investor

You are selling an energy distribution company to a German energy consortium. Energy is a sensitive sector, and the decisive question is who controls the buyer.

If the consortium is genuinely European and no one from a third country controls it directly or indirectly, it is not a foreign investor under Czech law and screening does not apply to it. However, if it is controlled by, for example, a US, Chinese or Middle Eastern owner, it is a foreign investment. If your company is a critical infrastructure entity or a provider of a regulated service under the higher-obligations regime, the transaction requires MPO approval. The same principle is introduced from 2028 by the new EU Regulation, which expressly covers investments made through EU companies controlled by an investor from a third country.

What follows from this:

• Right at the outset, check the buyer’s ownership structure all the way up to the ultimate owner.
• If the buyer is controlled from a third country, the application for approval is filed by the buyer, but you will have to supply it with documents about your company.
• The MPO notifies the European Commission and the other Member States of the opening of proceedings, and they may submit comments.
• If the transaction has an impact in several states, it may require approval in more than one of them, which extends the timetable.

Scenario 3: Sale of a company from a private equity group’s portfolio

You own a media business as part of a private equity group’s portfolio. The portfolio was created in such a way that the Czech company was initially owned by a French holding company, which in turn is owned by a US fund. Now you want to dispose of the stake and you are selling it to a US media group.

The buyer (the US group) is a foreign investor, so the Czech act on the screening of foreign investments applies to the transaction. Media businesses generally do not fall among investments that require approval. The exceptions are holders of a licence for nationwide radio or television broadcasting and publishers of periodicals with an average circulation of at least 100,000 copies per day. For these, the investor must file a request for consultation with the MPO before completing the transaction; if it fails to do so, it faces a fine of up to 1% of turnover.

What happens:

• The consultation obligation applies regardless of whether the investor comes from a “friendly” country.
• For other media companies, consultation is voluntary. If the investor does not file for it, the MPO may review an investment capable of threatening security or public order of its own motion for up to 5 years after its completion, and even later if the investor concealed material facts.
• If the MPO finds no reason to open proceedings in the consultation, it cannot review the investment later either (except where untrue or incomplete information was provided).

New Czech rules: critical infrastructure and the new Cybersecurity Act

In 2025, the Czech act on the screening of foreign investments (Act No. 34/2021 Coll., ZPZI) was expanded twice. Since 19 August 2025, mandatory approval has applied to investments in critical infrastructure entities under the new Critical Infrastructure Act (Act No. 266/2025 Coll.). Since 1 November 2025, when the new Cybersecurity Act (Act No. 264/2025 Coll.) took effect, it has also applied to investments in providers of regulated services under the higher-obligations regime.

Result: Many companies that previously did not fall under screening now do so automatically.

When does a foreign investor in your company need MPO approval? Under Section 7 of the ZPZI, in these four cases:

• the company manufactures, develops or provides life-cycle support for military material,
• the company is a critical infrastructure entity,
• the company is a provider of a regulated service under the higher-obligations regime pursuant to the Cybersecurity Act,
• the company develops or manufactures selected dual-use items.

Providers under the lower-obligations regime do not belong to this group. However, investments in them may be reviewed of the authority’s own motion if they could threaten the security of the state.

Regulated services fall within the following sectors (whether the higher-obligations or lower-obligations regime applies is determined by the criteria of the NÚKIB decree and the registration of the service):

• public administration
• energy
• manufacturing industry
• food industry
• chemical industry
• water management
• waste management
• transport
• digital infrastructure and services
• financial market
• healthcare
• science, research and education
• postal and courier services
• defence industry
• space industry

If, therefore, you develop software for managing energy grids, provide IT services or operate a hospital, it is quite possible that you are a provider of a regulated service. However, you are on the list of sensitive targets under Section 7 of the ZPZI only if you are under the higher-obligations regime.

Notifying the service to NÚKIB: A provider that meets the conditions for registration of a regulated service must notify it to NÚKIB no later than 60 days from the day it met the conditions. The authority then decides on the registration. When selling a company, therefore, always verify whether the service is registered, or whether it should have been.

Practical impact: When you must notify a sale

If your company falls under Section 7 of the ZPZI, the foreign investor must apply to the MPO for approval before the investment is completed. The obligation arises as soon as the investor is to hold at least 10% of the voting rights or when the investor or a person close to it obtains a seat on a corporate body, even if this does not amount to control.

This means:

• Even the sale of a purely financial 10% stake may require approval.
• It is not only about a majority— even a minority investor who, for certain reasons, has strategic influence may trigger screening.
• For sensitive investments under Section 7, the MPO decides in proceedings within 90 days, and in particularly complex cases up to 30 days later. If the matter is discussed by the government, up to a further 45 days are added. For other investments, the investor may request a consultation and the MPO will inform it within 45 days whether it will open proceedings.

What risks and fines you face if you ignore screening

If a foreign investor carries out an investment that requires approval without applying for it, the following may result:

• under the ZPZI, a fine of up to 1% of the foreign investor’s total net turnover. For breach of the conditions of approval or of a decision prohibiting the continued existence of the investment, it is up to 2% of turnover. If turnover cannot be determined, the fine ranges from CZK 50,000 to CZK 50 million, or from CZK 100,000 to CZK 100 million respectively,
• the opening of proceedings of the authority’s own motion and, potentially, a prohibition on the continued existence of the investment,
• from 2028 under the new EU Regulation: penalties that each state must set as effective, proportionate and dissuasive. The specific amount will be determined by national law.

Frustration of the transaction ex post

If the authorities subsequently (for example, one or two years after completion of the purchase) manage to establish that the transaction should have been notified and was not, they may decide to prohibit the continued existence of the foreign investment. For an investment that required approval, the law sets no time limit for opening such proceedings.

In extreme cases, the MPO may, in its decision prohibiting the continued existence of the investment, prohibit or restrict the exercise of the investor’s voting rights, or order the sale of the stake within a set period. If the investor does not sell the stake, the ministry may arrange its sale itself, for example at a public auction.

What happens to the contract

Neither the EU Regulation nor Czech law provides that a contract for the sale of a company is automatically invalid without approval. However, an investment that requires approval must not be completed without it. If it is completed, the investor faces a fine, a prohibition on the continued existence of the investment and an ordered sale of the stake.

For the seller, this means a risk that the buyer will lose the stake or that the transaction will have to be unwound. It is therefore important to make approval a condition precedent (closing condition) and to agree on what happens if approval is not granted.

How screening affects the price and structure of the transaction

The sale is delayed; consequently, closing and the seller’s payout are delayed as well. While waiting for screening, market conditions may change, the buyer may suddenly feel less motivated, or may demand a “waiting discount”.

The attorneys at ARROWS, a Prague-based law firm, can help you structure the deal so that it is resilient to such scenarios—for example by introducing clear deadlines, penalties for extensions, or a “tranche” payment structure tied to individual screening milestones.

“Hell-or-high-water” clauses

Investors—especially if they come from higher-risk jurisdictions—will pressure you to accept a “hell-or-high-water” clause, i.e., an obligation to take all steps necessary to obtain screening approval, regardless of cost and difficulty.

Be cautious. Such clauses can create enormous liability for you as the seller. The attorneys at ARROWS, a Prague-based law firm, can help you negotiate a fair allocation of risk between you and the buyer.

Conditional approval – “mitigation measures”

Screening often does not end with a clear YES or NO, but rather “YES, but subject to conditions”. These conditions (mitigation measures) can be demanding:

• You must not develop certain technology in the EU
• You must not have physical access to data
• You must appoint a security auditor
• You must not hire certain employees from third countries

Such conditions can fundamentally change the value of the company for the buyer and, consequently, your position in negotiations.

How to prepare for screening: Practical steps

Step 1: Early diagnosis – is your company “sensitive”?

Before you start selling, you need to know whether your company falls within the screening regime. Questions you need to ask yourself:

• Do I operate in technologies—AI, semiconductors, quantum computers, cybersecurity?
• Do I have access to critical infrastructure—energy, transport, water, telecommunications?
• Am I a provider of a regulated service under the higher-obligations regime pursuant to the Cybersecurity Act (effective from 1 November 2025), or a critical infrastructure entity?
• Do I work with critical raw materials—their extraction, processing, or recycling?
• Do I have access to sensitive data—health, military, police, electoral?

If you answer YES to any question, there is a high likelihood of screening.

The attorneys at ARROWS, a Prague-based law firm, can carry out a detailed analysis of your company and give you a clear verdict on whether screening is likely.

Step 2: Preparing documentation and demonstrating sources of funds

The screening authority will want to know:

• Who is the buyer’s ultimate beneficial owner? (Beneficial ownership)
• Where do the funds to finance the purchase come from?
• Does the buyer have a history of breaching conditions in other acquisitions? (Buyer due diligence)
• Is the buyer or its owners on sanctions lists?
• What is the purpose of the acquisition? (Is it a purely financial investment, or is it about gaining control over technologies?)

If you have this information prepared, the screening will go more smoothly.

Step 3: Communication with the buyer – a “screening-aware” structure

You should discuss screening openly with the buyer. You should not hide it or assume that it “probably won’t be necessary”.

Recommended steps:

• Inform the buyer early that the transaction will be subject to screening
• Agree together on who will lead communications with the authorities
• Clearly negotiate who will bear the costs and risks of screening
• Set the closing conditions so that they reflect the reality of screening (not as a surprise three months after signing)

The attorneys at ARROWS, a Prague-based law firm, can lead such negotiations and ensure that your interests are protected.

Step 4: Voluntary consultation with the state (optional, but recommended)

For investments that do not require approval, the foreign investor may file a request for consultation with the MPO. The ministry will state within 45 days whether it will open screening proceedings. If it does not open proceedings, it can no longer review the investment later, unless the investor provided untrue or incomplete information. For investments that do require approval (Section 7 of the ZPZI), consultation does not replace the application for approval.

Attorneys from ARROWS, a Prague-based law firm, can prepare and lead such a consultation.

Relevant questions on the new EU regulation

1. How do the new EU rules apply to the Czech Republic specifically?
The EU Regulation is directly applicable from 17 January 2028. By then, the Czech Republic will have to amend its act on the screening of foreign investments. Even today, however, mandatory approval already applies in the Czech Republic to investments in military material, selected dual-use items, critical infrastructure entities (since 19 August 2025) and providers of regulated services under the higher-obligations regime (since 1 November 2025).

2. What happens to my company if the transaction was closed before the new rules?
The new rules will not have retroactive effect on transactions that were duly closed in accordance with the old rules. In the Czech Republic, however, it already applies today that the MPO may review, of its own motion, an investment that did not require approval and was not consulted for up to 5 years after its completion, and even later if the investor concealed material facts. An investment that required approval and for which the investor did not apply will be reviewed without any time limit.

3. Does a transaction have to be screened in several states?
It may. If the target company has subsidiaries or assets in several Member States, approval may be needed in more than one of them. The new EU Regulation introduces rules for coordinating such filings between states.

Risk table and how ARROWS helps

What Regulation (EU) 2026/1386 will bring from 17 January 2028

Final summary

Screening of foreign investments in the EU is changing fundamentally. It is no longer something you can afford to ignore. If you are selling a company or preparing for a sale, you must expect screening to be part of the process – and if you underestimate it, you risk delays, loss of negotiating position, loss of the buyer, fines, or even the collapse of the entire transaction.

The Czech situation is also specific: since 2025, mandatory MPO approval has also applied to critical infrastructure entities and to providers of regulated services under the higher-obligations regime pursuant to the new Cybersecurity Act (effective from 1 November 2025). From 2028, the rules of the new EU Regulation will be added to this. If you operate in digital infrastructure, ICT, energy, healthcare or any other sensitive area, the threat of screening is real for you.

However, the point is not for screening to scare you. The point is for it to prepare you. If you know your sale will be affected by screening, you can:

• Structure the transaction so that screening does not end up being a surprise
• Negotiate clear terms in case the screening does not pass unconditionally
• Communicate with potential buyers based on facts, not speculation
• Minimise costs and risks

Attorneys from ARROWS, a Prague-based law firm, are well-versed in foreign investment screening and can help you with each of these steps – from the initial diagnosis through preparation of the filing to representation in negotiations with the authorities. At the same time, thanks to the ARROWS International network, they can also assist with matters that have cross-border elements and require coordination with authorities in other countries.

If you are preparing to sell a company to a foreign investor and want to avoid risks and delays, contact ARROWS, a Prague-based law firm, at consultation@arws.cz. We will carry out a complete audit of your screening risk and help you structure the transaction so that it passes without unnecessary complications.

Read also:

• Why Legal Support Is Essential in M&A Transactions: Key Risks and Phases
• Expansion via Share Deals in the Czech Republic: Legal Checklist for Safe Growth
• Vendor Due Diligence: Protecting Value and Price in Company Sales
• Selling a Company: From Letter of Intent to Closing Key Pitfalls
• Cybersecurity and AI Act: Compliance for hospitals and public institutions