The emergence of Artificial Intelligence as the topic at the forefront of the technology sector in the past couple of years has prompted a trend amongst governments and associated bodies to warn of the dangers AI poses from a national security perspective.

UK Prime Minister Rishi Sunak has been extremely keen in recent months to publicly champion Britain as a global leader in the field of Artificial Intelligence. During a visit to Washington D.C. in June, Sunak announced that the UK would host the first global summit on AI regulation later this year. In response to a reporter’s question about whether a “midsize country” could naturally lead the debate around AI he responded: ‘That midsize country happens to be a global leader in AI.’ ‘You would be hard-pressed to find many other countries other than the U.S. in the western world with more expertise and talent in AI.’

Yet amongst this undeniable encouragement to those businesses with a UK nexus who are active in AI and will be seeking investment, there is also an emerging concern over the dangers of AI as an issue of national security.

Also in June of this year, Jonathan Hall KC, head of the UK’s terror watchdog, who look at the adequacy of terror legalisation, said that the national security threat from AI was becoming ever more apparent and too much AI development focused on the potential positives of the technology while neglecting to consider how terrorists might use it to carry out attacks.

This climate therefore suggests not only an incoming barrage of new regulation covering AI, but also that application of existing legislation aimed at protecting national security, such as the UK’s National Security and Investment Act 2021 (NS&I Act) will see a sharpened focus on transactions involving Artificial Intelligence in particular, which could have practical implications on the costs, timing and possibly completion of deals concerning entities which are ‘active’ in AI.

In the latest in our series of articles concerning the NS&I Act, we examine how the legislation defines Artificial Intelligence as well as trends which have developed from the first 18 months of the NS&I Act which allow us to suggest some practical tips for businesses contemplating transactions in this space, and specifically, in deciding whether or not to notify.

Background to the NS&I Act

The NS&I Act came into effect from 4 January 2022 and established a statutory regime for Government scrutiny of corporate acquisitions and investments for the purposes of protecting national security in the UK.

The NS&I Act provided the Government with broad powers including the ability to:

1. ‘Call-in’ for review any in-scope transaction where there is a reasonable suspicion that it could give rise to a risk to national security;
2. impose remedies to address risks to national security (including the imposition of conditions or prohibiting or unwinding the transaction); and/ or
3. impose sanctions for non-compliance with the NS&I Act, including fines of up to 5% of worldwide turnover or £10 million (whichever is the greater) and imprisonment of up to 5 years for the acquirer.

The legislation introduced a mandatory notification regime for transactions involving companies active in 17 ‘key sectors’. One such key sector was listed as Artificial Intelligence. The NS&I Act also accommodates a mandatory notification regime for parties seeking advance clearance where they are concerned the legislation may impact a proposed transaction.

For the purposes of this article, we will focus only on how Artificial Intelligence is treated under the NS&I Act and the practical implications for transactions which may involve AI. However, a list of other articles which Bristows has produced discussing the wider applicability of the NS&I Act and those which focus on other ‘key sectors’ are listed beneath this article below.

How does the NS&I Act deal with Artificial Intelligence?

Under the legislation a ‘qualifying entity’ is company which:

1. carries on activities in the UK (e.g. a UK company, or an overseas company that does business from a regional office or a research and development facility in the UK); and/or
2. supplies goods or services to people in the UK (e.g. a UK company, or an overseas company that produces goods for exporting to a company in the UK, or is responsible for distributing them to the UK company).

The Government has produced guidance (which can be found here) concerning the scope of the Artificial Intelligence part of the regulations.

In short, the process of ascertaining whether an entity has such AI activities involves two steps.

Step 1 – consider whether the entity carries on research into, or develops or produces goods, software or technology that uses AI. In this context, AI is defined as technology enabling the programming or training of a device or software to:

• perceive environments through the use of data;
• interpret data using automated processing designed to approximate cognitive abilities; and/or
• make recommendations, predictions, or decisions, in any case with a view to achieving a specific objective.

Assuming step 1 is satisfied,

Step 2 – consider whether the entity’s AI activities are being used for one or more of the following applications:

• the identification or tracking of objects, people or events;
• advanced robotics; or
• cyber security.

How has the legislation treated AI transactions recently?

In late July, the Cabinet Office published its second annual report on the NS&I Act – Annual Report 2022-23.

This is the first Annual Report to cover a whole year since the NS&I Act came into force (covering the period from 1 April 2022-31 March 2023) and mainly includes a breakdown of the numbers rather than anything substantive (for example, number of mandatory and voluntary notifications in total, number of notifications by sector and number of notifications by origin of investment, numbers of call-ins and final notices etc).

Unfortunately, like last year’s report (which only covered the first 3 months of the legislation), it doesn’t go beyond the statistics to give any guidance or analysis on the notifications that have been called-in or where final orders have been made. This means parties are still relatively uncertain whether they fall within the regime, seemingly resulting in a lot of notifications being made, with comparatively few final orders being provided. Given the increased prominence of businesses using AI in some guise, we expect this sector in particular to be affected by the lack of certainty over the circumstances in which they should notify.

As a general overview of the latest figures revealed by the report:

• The Secretary of State received 866 notifications (93% of these were cleared within 30 days).
• Of all the notifications, 180 were voluntary; 691 were mandatory; and 15 were retrospective.
• The number of call-in notices issued was 65 (which amounted to less than 10% of all notifications) and over double were for mandatory notices vs voluntary notices.
• The number of ‘Final Notifications’ given was 57 and 15 ‘Final Orders’ were made.

When we look at sector focus based on the latest report, and, for the purposes of this article, specifically at notifications relating to Artificial Intelligence:

• Of the mandatory notifications, about 16% related to AI whereas the highest proportion (47%) related to the Defence sector.
• Of the voluntary notifications, AI accounted for around 7.5% of these whereas the highest proportion (17%) related to Advanced Materials and about 16-17% each related to the Defence and Military Dual Use.
• Of the call-ins, 11% related to AI compared with 37% related to Military and Dual Use; 29% Defence and 29% Advanced Materials.
• Of the Final Orders, only 13% related to AI; 42% related to Military and Dual Use; 32% Advanced Materials; and 26% Defence.

Analysis – tips and trends

• The latest Annual Report into the NS&I Act does not appear to show a particular drift towards AI transactions being the most prominent in terms of mandatory notifications, call-ins or final orders compared with other sectors more traditionally associated with national security concerns such as Defence, Advanced Materials and Military and Dual Use.
• However, the latest report only covered the period up to 31 March 2023 and, as indicated at the beginning of this article, the recent publicity attributed to Artificial Intelligence and growth in this sector in general, suggest that scrutiny by the UK Government of acquisitions relating to AI for national security reasons under the parameters of the NS&I Act is only set to grow. As such, in the near future we would expect a greater proportion of mandatory notifications, call-ins and final orders in respect of the AI sector relative to the overall total figures in such categories.
• It is important for potential acquirers to bear in mind that target entities that simply make use of AI technology, as more and more businesses are doing, will not be caught by the mandatory notification regime.  Rather, the first element of the 2 step test is to consider whether the entity ‘carries on research into, or develops or produces goods, software or technology that uses AI’. We anticipate that as the notification trends further develop, we will gain further insight (and hopefully some published Government guidance) which will aid businesses in making this distinction when assessing whether they will fall within the AI sector under the legislation.
• Given the relatively positive statistic in the latest report that all notifications, whether mandatory or voluntary, were either called-in or cleared within the statutory time limit of 30 working days after being accepted (with acceptances of notifications taking on average 5 working days), parties to a transaction who have concerns over whether the AI features of the target could require clearance under the NS&I Act even if they don’t strictly meet the 2 step test set out above, could opt to make a voluntary notification for comfort without this likely to dramatically affect the transaction timetable.
• A more general note from the latest report is that China maintains its status as the most ‘red flag’ jurisdiction when considering when to notify under the NS&I Act, given that although Chinese origin of investment represented less than 5% of notifications, this category accounted for the majority of Final Orders (8 out of 15), including 4 out of the 5 prohibition/unwinding decisions. However, transaction parties should certainly not refrain from notifying based on jurisdictional reasons alone. Of all the acquisitions called-in, 32% involved acquirers associated with the UK and 20% with the USA, which seemingly confirms the Government’s publicly declared ‘acquirer agnostic’ approach to exercising its call-in powers under the NS&I Act.

For further information concerning implementation the NS&I Act (including a focus on other ‘key sectors’), please refer to our previous Cookie Jar articles here:

The NS&I Act and the Advanced Materials sector

NS&I Act, 5 months in…

How will the NS&I Act affect investors looking to acquire companies operating in the advanced robotics industry?

The NS&I Act and the ‘Computing Hardware’ sector