Legislation in the United Kingdom aimed at protecting national security might present “unforeseen” compliance problems for companies wanting to merge with or buy foreign businesses, according to legal experts.

The U.K. National Security and Investment Act (NSI Act) entered into force Jan. 4. A response, in part, to worries U.K. technologies could leak to China following security concerns flagged up by Huawei’s bid for work on the country’s 5G networks, the legislation is aimed at scrutinizing mergers and acquisitions (M&A) involving foreign companies that could put key areas of national security and the economy at risk, such as military and defense, data infrastructure, and the nuclear industry.

Legal experts said the legislation allows the government greater power to intervene across a much wider scope than traditional M&A deals.

For example, the U.K. government can now impose certain conditions on an acquisition if it falls into one of 17 categories where prior notification is mandatory. In “rare” cases, the government can unwind or block an acquisition completely.

The legislation applies regardless of the nationality of the acquiring company, said Matthew Hall, competition partner at law firm McGuireWoods. Acquisitions completed before Nov. 12, 2020, are exempt, and there is no minimum turnover or deal-size threshold under the act.

Completing an acquisition subject to mandatory notification, or not notifying a transaction where notification is mandatory, gives rise to the risk of heavy fines (5 percent of total worldwide turnover or 10 million pounds (U.S. $13.7 million), whichever is greater) and potential imprisonment of up to five years.

Equally important, transactions that are subject to mandatory notification will be void without clearance being received.

Alexandra von Westernhagen, a European Union/competition partner at law firm Keystone Law, said the legislation has such “broad scope” that even an overseas company producing goods for export to a U.K. company could be caught under the rules, as could machinery located overseas used to produce equipment that is used in the United Kingdom. Acquisitions that are part of a corporate restructure or reorganization can also come under the legislation.

“Compliance with the act should be considered with utmost care,” she warned.

Legal experts also noted the 17 industry sectors which potentially trigger a mandatory filing are far-reaching, and the boundaries are not always clear. Artificial intelligence and biosciences are included, for example—hot areas where the United Kingdom is pushing for innovation. Research and development with a Chinese entity—and even the importance of China as part of a company’s revenue stream—could trigger notification.

In the short to medium term, companies might need to consider filing notice where their activities fall at the fringes of those activities.

“A good example is the definition of ‘synthetic biology,’ which covers the design or redesign of biological components that do not exist in nature,” said John Schmidt, partner at law firm Arnold & Porter. “This can apply to life sciences businesses involved in the synthetization of DNA but also potentially other industries that seek to design biological processes using synthesized biology to create renewable fuels, for example.”

Alex Haffner, head of competition and regulatory affairs at law firm Fladgate, said the United Kingdom “has created a regime which has a particularly broad scope and—by including the possibility of significant sanctions for noncompliance—effectively makes the NSI Act a crucial part of any transactional diligence process. It will be critical to ask the right questions of your advisers from the outset.”