Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

The Overseas Investment (National Interest Test and Other Matters) Amendment Act 2025 (No 81 of 2025) is the largest rewrite of New Zealand's Overseas Investment Act 2005 since the 2018 residential-land amendment. The Bill (Government Bill 171) was introduced by the Minister of Finance in June 2025, passed all three readings in the House of Representatives, received Royal Assent on 19 December 2025, and was brought into force on 6 March 2026 by the Overseas Investment (National Interest Test and Other Matters) Amendment Act 2025 Commencement Order 2026 (SL 2026/2). The Act replaces the OIA's residual "investor test" discretion with a single statutory national-interest test applied to all "sensitive asset" transactions, introduces a new s 29B repeat-investor mechanism (Treasury does not re-litigate investor risk factors on subsequent applications outside strategically important businesses), creates new military / dual-use technology call-in transactions and critical-direct-supplier call-in transactions (amended s 85), and adds a no-change-of-control transaction category. Administered by The Treasury (policy lead) and Toitū Te Whenua LINZ (operations / case handling), with consent decisions issued by the responsible Ministers.

On 19 December 2025 the Swiss Federal Assembly adopted in final vote the Federal Act on the Screening of Foreign Investments (Bundesgesetz über die Prüfung ausländischer Investitionen, Investitionsprüfgesetz / IPG; popularly the "Lex China", parliamentary business 22.035). The Act introduces Switzerland's first general ex-ante FDI-screening regime: acquisitions of control over Swiss companies active in security-critical sectors by foreign state-controlled investors require prior approval by SECO, with escalation to the Federal Council. The optional- referendum window runs until 17 April 2026; entry into force is not expected before 2027 once implementing ordinances are adopted. Critical sectors named in the Act include military and dual-use goods, electricity grids and generation, water supply, pharma and health, telecommunications, transport infrastructure and financial-market infrastructure.

The UK Ministry of Defence announced the Atlantic Bastion programme on 8 December 2025, establishing a hybrid naval force to defend UK and NATO subsea cable and pipeline infrastructure against Russian submarine threats. The programme integrates ships, submarines, aircraft, and autonomous uncrewed vessels through AI-powered acoustic detection and a digital targeting web, with £14 million in combined MOD/industry seedcorn investment already committed, 26 UK and European firms submitting anti-submarine sensor proposals, and capabilities due to be deployed in 2026. Atlantic Bastion implements the Strategic Defence Review 2025 undersea-warfare commitments and is coordinated through the Undersea Infrastructure Security (UIS) Oversight Board chaired by the Cabinet Office.

On 26 November 2025, Scotland's Deputy First Minister and Cabinet Secretary for Economy and Gaelic, Kate Forbes MSP, wrote to the Scottish Parliament's Economy and Fair Work Committee confirming that the preferred bidder for Glasgow Prestwick Airport had withdrawn from the sale process after a "robust commercial deal" had been negotiated. The letter discloses that the proposed acquisition was subject to mandatory notification to the UK Government under the National Security and Investment Act 2021, a reserved matter on which Scottish Ministers cannot comment. Media reporting (Global Trade Alert; Daily Business) identifies the withdrawn bidder as Turkish conglomerate Limak Holding and attributes the collapse directly to the UK national-security review process ("Westminster officials opening an investigation"). The airport, which employs over 500 people directly and anchors an Ayrshire aerospace cluster, remains in Scottish Government public ownership.

Cyprus Law 194(I)/2025 "The Establishment of a Framework for the Screening of Foreign Direct Investments Law of 2025" was enacted by the House of Representatives and published in the Official Gazette on 14 November 2025, entering into force on 2 April 2026. It establishes Cyprus's first-ever mandatory pre-approval FDI screening regime, designating the Ministry of Finance as the competent Screening Authority and applying to non-EU/EEA/Swiss investors acquiring ≥25% equity or voting rights in Cyprus entities valued at ≥€2 million across covered strategic sectors. The regime implements EU Regulation 2019/452 and includes a Cyprus-specific sectoral extension covering tourism and real estate — addressing golden-passport-era concerns about non-EU capital flows into the island's financial and hospitality economy.

Germany's transposition of EU Directive 2022/2555 (NIS2), enacted as the "Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung." Bundestag passage 13 November 2025; Bundesrat approval 21 November 2025; published as BGBl. I 2025 Nr. 301 on 5 December 2025; entered into force 6 December 2025. The statute designates the Bundesamt für Sicherheit in der Informationstechnik (BSI) as the central national supervisory authority over an estimated 29,500 covered entities across 18 critical and important sectors, introduces a mandatory 24h initial / 72h detailed / 1-month final cyber-incident reporting cascade, establishes board-level personal liability for senior management, and applies to SME critical- infrastructure suppliers — with no transitional grace period from entry into force.

The Hrvatski sabor (Croatian Parliament) unanimously adopted the Act on Screening of Foreign Direct Investments on 24 October 2025; the law was published in Narodne Novine 136/2025 and entered into force on 13 November 2025. It establishes Croatia's first-ever statutory horizontal FDI-screening regime, implementing EU Regulation 2019/452 in Croatian law. The Act captures direct or indirect acquisitions by non-EU investors of at least 10 % of share capital, voting rights or property rights in Croatian entities operating in sensitive sectors (defence, dual-use, critical infrastructure, critical minerals, emerging tech, sensitive personal data, energy, transport, health, digital infrastructure, media, financial services). The reviewing authority must decide within 120 days, exceptionally 150 days, of a complete application. Croatia was one of the last EU Member States without a horizontal screening law.

The FCC adopted a Report and Order (FCC 25-49) on 7 August 2025 — the first comprehensive overhaul of submarine cable landing license rules since 2001 — effective 26 November 2025. The order prohibits Indefeasible Right of Use (IRU) agreements that would give entities from designated foreign adversary countries (China including Hong Kong and Macau, Cuba, Iran, DPRK, Russia, and Venezuela) control over Submarine Line Terminal Equipment (SLTE) on US cable landings, and mandates new annual reporting plus certification/disclosure requirements covering ownership, cybersecurity and physical security plans, and FCC Covered List compliance. The order operationalises the FCC's bifurcated policy package: accelerating legitimate commercial cable buildout while hardening national-security review for foreign-adversary-connected infrastructure.

Czech Act No. 265/2025 Sb., promulgated in the Sbírka zákonů on 4 August 2025 and entering into force on 1 November 2025, is the first material amendment of the Czech Republic's foundational FDI screening statute (Act No. 34/2021 Sb.) since its enactment. The amendment broadens the perimeter of mandatory pre-closing FDI screening by cross-referencing the simultaneously-enacted Cybersecurity Act (Act No. 264/2025 Sb., transposing NIS2 Directive 2022/2555): entities designated as providers of "regulated services" under the Cybersecurity Act's "regime of higher obligation" automatically fall within mandatory FDI-screening scope, extending screening reach beyond the prior military-material / dual-use / critical-infrastructure perimeter to cover a broad sweep of digital, technology, healthcare, energy, and financial-services operators. The amendment also adds a confidentiality-sharing channel between MPO and NÚKIB, enabling coordinated supply-chain-security assessments for high-risk-vendor reviews under the new Cybersecurity Act.

Czech Republic's first standalone federal statute on the resilience of critical-infrastructure entities — Act No. 266/2025 Sb., "Zákon o odolnosti subjektů kritické infrastruktury a o změně souvisejících zákonů" (Critical Infrastructure Act). Transposes EU Directive 2022/2557 (CER Directive on the resilience of critical entities) into Czech law and removes critical-infrastructure regulation from the earlier crisis-management law (Zákon č. 240/2000 Sb.) into a dedicated statute. Covers the 11 CER-Directive sectors (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, food production-processing-distribution) and obligates designated operators of essential services to conduct risk analyses, implement technical/organisational resilience measures, report incidents to sector-competent authorities, and submit to inspection. Published in the Sbírka zákonů on 4 August 2025; in force 19 August 2025; operator information-obligation deadline 1 March 2026.

The Assembly of Albania (Kuvendi i Republikës së Shqipërisë) adopted Law No. 56/2025 on 11 July 2025, published in Fletorja Zyrtare (Official Gazette) No. 124 of the same date, amending Article 10 of Law No. 7764/1993 "On Foreign Investments" to introduce Albania's first-ever mandatory FDI screening mechanism. The law requires investors to submit applications for screening of any foreign investment "related to or affecting critical public infrastructure, critical technologies, dual-use goods, supply of critical inputs, access to sensitive information, or media freedom" — categories aligned with EU Regulation 2019/452 — while delegating thresholds, timelines, and procedural safeguards to a forthcoming Decision of the Council of Ministers (DCM). Albania becomes the first country in the Western Balkans to establish an investment-screening regime aligned with EU Regulation 2019/452, opening a new issuer-country code (AL) on the IPTM register and anchoring a regional cluster that currently stands at RS=1, MK=0, BA=0, ME=0, XK=0.

Greece enacted Law 5202/2025 on 22 May 2025, published in Government Gazette ΦΕΚ A' 84 on 23 May 2025 and effective the same day, establishing the country's first national mandatory and suspensory foreign direct investment screening mechanism, aligned with Regulation (EU) 2019/452. The Interministerial Committee for the Control of Foreign Direct Investment (ICC-FDI), with initial procedure run by the Ministry of Foreign Affairs, reviews non-EU acquisitions in "sensitive" sectors (energy, transportation, healthcare, ICT, digital infrastructure) and "particularly sensitive" sectors (national security, defence, cybersecurity, AI, ports and critical subsea infrastructure, borderland tourism). A two-phase review applies — 30 days Phase I, up to 150 days Phase II with EU Cooperation Mechanism notification — and the regime became fully operational on 11 November 2025.

On 27 February 2025, the Parliament of the Republic of Moldova adopted Law No. 33/2025 amending Law No. 174/2021 on the mechanism for examining investments of importance for state security. The law entered into force on 20 April 2025 after publication in Monitorul Oficial Nr. 144-147 of 20 March 2025 (promulgated by Presidential Decree No. 118-X of 17 March 2025). Key operative changes expand the protected-sector perimeter to explicitly enumerate 17 categories covering data processing and storage, AI, robotics, cybersecurity, semiconductors, quantum, nanotechnology and biotechnology alongside the pre-existing energy, transport, communications, defence and aerospace pillars; add new grounds for refusal (money-laundering suspicion, corruption convictions, foreign-government control, cybersecurity risk, access to personal data of citizens); introduce enhanced Council powers including retroactive review of previously approved investments and fines of up to 5% of annual turnover (capped at MDL 5 million); and carve out intra-group transactions, asset sales below EUR 1 million, and state-owned-enterprise dealings. The Screening Council became operational in July 2025.

Joint Communication JOIN(2025) 9 final, adopted 21 February 2025, establishes the EU's first cable-infrastructure-specific resilience framework. It introduces a four-pillar Cable Security Toolbox (prevention, detection, response/recovery, deterrence), designates Cable Projects of European Interest (CPEIs) for priority public funding, and allocates €347 million under the Connecting Europe Facility Digital programme for cross-border subsea cable diversification, redundancy, and repair-ship capacity. The plan also formalises EU-NATO Task Force on Resilience of Critical Undersea Infrastructure follow-on workstreams and establishes an attribution and diplomatic-response framework for cable-sabotage incidents, referencing Baltic Sea cable-cutting events from 2023 to 2025.

Japan's National Diet enacted the Cyber Response Capability Enhancement Act (重要電子計算機に対する不正な行為による被害の防止に関する法律, Law No. 42 of 2025) on 16 May 2025, together with companion arrangement legislation. Commonly known as the Active Cyber Defense (ACD) Law, the statute authorises (i) government monitoring of foreign-origin internet traffic transiting designated Japanese communication infrastructure for national-security threat indicators, (ii) pre-emptive access and neutralisation operations against attacker infrastructure abroad by the National Police Agency and the Self-Defense Forces under unified command, and (iii) mandatory cyber-incident reporting and government cooperation duties on critical-infrastructure operators. Implementation is phased through November 2027, with the NISC reorganised into the National Cybersecurity Office (NCO) under the Cabinet Secretariat from July 2025.