Screening of foreign investments in the EU: When is the sale of a company at risk of being thwarted due to new regulatory trends?

24.4.2026 | ARROWS law firm

Selling a company is a key decision that new regulatory requirements for foreign investment screening can significantly complicate. In December 2025, the European Union tightened the conditions for acquisitions of European companies by foreign investors. Understand how these trends may delay, complicate, or even prevent your sale—whether you are selling a company to a foreign buyer or are part of a global portfolio.

The illustrative image shows a lawyer addressing issues related to the screening of foreign investments.

Article contents

Why foreign investment screening in the EU is changing fundamentally
What is changing specifically in the EU screening system
New Czech rules: Link to the new Cybersecurity Act
How to prepare for screening: Practical steps
Relevant questions on the new EU regulation
Final summary

Key takeaways:

The new EU rules, with full application from the end of 2027 or the beginning of 2028, introduce mandatory screening for all Member States – meaning that transactions in sensitive sectors will be automatically reviewed and may be conditioned or prohibited on security grounds.
Screening does not affect only large deals – as early as 10% of voting rights, or when acquiring assets in critical technologies, infrastructure, or critical raw materials, your sale may be put on hold for dozens of weeks.
Czech owners face a dual regime – from the full effectiveness of the new Cybersecurity Act (1 August 2024), Czech screening has been significantly expanded through a new link to this Act, which automatically covers digital infrastructure, ICT services, energy, and healthcare.
Not understanding the risks can lead to a loss of negotiating leverage – investors who are not prepared for screening risk lengthy delays, the need to make unwanted concessions, or the complete failure of the transaction.

Why foreign investment screening in the EU is changing fundamentally

In April 2020, the European Union introduced its first comprehensive rules for screening foreign investments. At the time, the main aim was to create a mechanism that would allow individual Member States to share information about potentially risky acquisitions of European strategic companies. However, each state could decide for itself whether it would use screening at all, and how strict it would be.

Today, the situation is different. Russia’s invasion of Ukraine, technological rivalry with China, the energy crisis, and rising geopolitical tensions have convinced European leaders that a fragmented approach is not sufficient. The new rules, on which the European Commission, the European Parliament, and the Council of the EU reached a political agreement in the second half of December 2025, introduce a unified and significantly stricter framework.

These rules will enter into force 20 days after their publication in the Official Journal of the EU and will begin to apply in full after the 18-month implementation period, i.e., from the end of 2027 or the beginning of 2028. This means you now have a critical window of time to understand how they may affect you.

What is changing specifically in the EU screening system

The existing system was voluntary. EU Member States could, but did not have to, have screening. The result was a mosaic – some states had strong screening, others had almost none.

The new rule is clear: all EU Member States will be required to have mandatory foreign investment screening covering acquisitions in sensitive sectors. This is not only about states that have not had screening so far – even already modern regimes in Germany, France, or the Czech Republic will have to adapt to the new minimum standards.

Practical impact: If you are selling a company operating in any of the sensitive sectors, its acquisition by a foreign investor will automatically be subject to at least an initial screening. Regardless of the size of the acquisition and regardless of which state is your competent authority.

Minimum list of sensitive sectors and activities

The new EU rules define a list of sectors and activities that must be screened everywhere in the EU. This list is not exhaustive – states may expand their screening – but it is binding as a minimum.

Mandatory screening includes:

Defence and military material – any acquisitions of companies manufacturing, developing, or trading in items on the dual-use list (dual-use items) and military material from the official EU list.
Advanced technologies – in particular semiconductors, quantum technologies, and artificial intelligence. For AI, this specifically includes general-purpose AI models or systems intended for space or defence, or AI models with systemic risks under the new EU Artificial Intelligence Act (EU AI Act).
Critical infrastructure – energy, transport, and digital infrastructure, if the relevant state considers it critical based on its risk assessment.
Critical raw materials – extraction, processing, recycling, and storage of strategic critical raw materials as defined in the Critical Raw Materials Act.
Financial sector – central counterparties, central securities depositories, operators of regulated markets, operators of payment systems (excluding central banks), systemically important institutions, and global providers of specialised financial messaging services.

In many cases, however, these are activities that are not obvious at first glance. Are you selling a software company working on AI for autonomous systems? Screening. Are you selling an energy distribution company? Screening. Are you selling an IT service provider? It depends on whether it falls within critical infrastructure – which is now determined differently.

Extension of screening to intra-EU investments with foreign control

The new rules introduced one of the most controversial changes: screening now also applies to acquisitions of EU companies if the ultimate owner or controlling person is from a third (non-EU) country.

What does this mean in practice? If you have an ownership structure where your Czech company is owned by a German holding company that is in turn owned by a Chinese fund, then a transaction with a third party will go through screening – even if it is formally “intra-EU”.

This rule was introduced on the basis of the Court of Justice of the European Union’s judgment in Xella (C-106/22), which clearly pointed out that the previous rules allowed screening to be circumvented precisely through EU intermediate owners.

Two-stage screening with a harmonised timetable

The new system introduces a uniform template for all screenings in the EU: Phase I and Phase II.

Phase I (initial review):

Lasts exactly 45 calendar days from the moment the authority confirms the filing is complete.
The authority decides whether the investment is sufficiently suspicious to be referred to Phase II.
It is expected that in 60–70% of cases the investment will be approved at this stage without the need for further review.
The 45-day deadline is non-extendable – it will not be extended if the state takes more time to assess.

Practical impact: If the competent authority fails to issue a decision within the 45-day deadline, the investment automatically moves to Phase II.

Phase II (in-depth review):

It lasts as long as the competent state decides – the new rules do not set a maximum.
In Germany, Phase II typically takes around 2–4 months, and in some more complex cases even longer.
During Phase II, the authorities thoroughly examine the owner, the source of funding, and the impact on security and public order.

Retroactive screening and long “call-in” periods

The new rules introduce something unprecedented: authorities will be able to re-review investments that have already been completed if they were not properly notified.

Specifically:

A transaction that should have been notified but was not may be reviewed retroactively up to 5 years after it is closed.
If a transaction passed screening but new facts arise threatening public order or security, it may be reassessed within a period ranging from at least 15 months up to 5 years after completion of the acquisition (the so-called “call-in” right).

This means that the sale of your company is never entirely “safe” if it was not properly notified and did not pass screening with explicit approval.

How screening affects the sale of a company: Practical scenarios

Scenario 1: Sale of a technology company to an Asian fund

You own a Czech IT company that develops software for autonomous vehicles. An attractive offer comes in from a Singapore venture fund. Everything looks great – the price is good, the investors are credible, and their lawyers are professional.

If it involves acquiring a stake above 10% or an acquisition with effective control in a company that is a sensitive investment under Act No. 34/2021 Coll., on the screening of foreign investments (the “ZIS”), the transaction will automatically be subject to screening in the Czech Republic. Phase I (45 days) will take place first.

During this phase, the Czech authorities (specifically the Ministry of Industry and Trade, “MPO”) will assess whether the Singapore fund is linked to a state, whether it has a history of breaching conditions in other acquisitions, whether it is on sanctions lists, and whether access to your technology would pose a threat to the security of the Czech Republic.

If the authority identifies any suspicious elements (for example, that the fund has ties to state entities, or that the artificial intelligence you develop could be used for military purposes), Phase II will be opened.

Practical consequences:

The sale is delayed by at least 45 days, typically by 3–6 months.
You must provide the Czech authorities with detailed information on the funding, the fund’s ownership structure, its investment history, and the purpose of the acquisition.
The investor faces the risk that the authority will approve the sale only subject to conditions – for example, that certain technologies may not be developed in the Czech Republic, that a Czech security auditor must be appointed, or that control over certain data may not be acquired.
In the absolute worst case – if the authority believes there is a real security threat – it may prohibit the sale.

Scenario 2: Private sale of an energy company

You are selling a small energy distribution company to a German energy consortium. You know very well that energy is critical infrastructure – that is common knowledge. But you think that collegiality within the EU will protect you.

Mistake. The new EU rules clearly state that energy infrastructure is subject to screening regardless of where the investor comes from. The German consortium is no exception.

What happens today:

Your company will be automatically notified for screening in the Czech Republic.
The transaction will also be assessed independently in Germany (if it has any assets there, or if the investor is based there).
Both countries will communicate with each other – the German authorities may say, “please pay attention to the fact that this transaction also affects our infrastructure.”
The timeframe may be extended because the states will coordinate their steps.

Scenario 3: Sale of a company from a private equity group’s portfolio

You own a media business as part of a private equity group’s portfolio. The portfolio was created in such a way that the Czech company was initially owned by a French holding company, which in turn is owned by a US fund. Now you want to dispose of the stake and you are selling it to a US media group.

In line with the new rules, this transaction is subject to screening – because the ultimate owner is from outside the EU, regardless of the fact that the media business is currently owned by an EU entity.

What happens:

Although all parties are from “friendly” countries (the USA, France), screening is mandatory.
If the media business is considered an entity influencing elections or public opinion, the authorities may pay it special attention.
The transaction will also be notified to other EU Member States if the media business has cross-border elements.

New Czech rules: Link to the new Cybersecurity Act

As of 1 August 2024, when a large part of the new Cybersecurity Act (Act No. 202/2023 Coll.) became fully effective, the situation became even more complicated for Czech entrepreneurs. The Czech Republic has linked the foreign investment screening act (ZIS) with the new Cybersecurity Act and other regulations on critical infrastructure.

Result: Many companies that previously did not fall under screening now do so automatically.

Who is now automatically a “sensitive target”? The new Czech rule says: if your company is identified as a provider of a regulated service under the higher-obligations regime or as a provider of an essential service under the Cybersecurity Act, it automatically becomes a sensitive target for foreign investment screening. This also applies to operators of essential services and providers of digital services.

Providers of regulated services under the higher-obligations regime include entities in the following sectors:

Energy
Transport
Banking and financial market infrastructure
Healthcare
Water
Digital infrastructure
Providers of digital services
Space infrastructure
Public administration
Waste management
Production and distribution of chemicals
Food industry
Manufacture of medical devices
Other mechanical engineering
Research

If, therefore, you develop certain types of software (for example, for managing energy grids), or provide IT services, or you are a hospital with specific systems – there is a high chance that you are an entity under the Cybersecurity Act and therefore automatically on the list of sensitive targets.

Deadline for identification and registration: Entities had to comply with the obligations arising from the new Cybersecurity Act (including identification and, where applicable, registration with NÚKIB, if the act applies to them) within three months from the date the act began to apply to them (i.e., for most, from 1 November 2024).

Practical impact: When you must notify a sale

If your company is a sensitive investment under the ZIS (e.g., because it falls under the Cybersecurity Act), you are required to notify the foreign investor already upon acquiring 10% of the voting rights—even if this does not amount to gaining control.

This means:

The sale of a purely financial 10% stake may be caught by screening.
It is not only about a majority— even a minority investor who, for certain reasons, has strategic influence may trigger screening.
The time limit of the Ministry of Industry and Trade (MPO) for assessing a sensitive investment is 45 calendar days from the submission of a complete application, with the possibility of extension into Phase II. For other investments, the time limit is 90 days.

What risks and fines you face if you ignore screening

If the transaction is mandatory—under the new EU rules or under Czech rules—and you fail to notify it, you face:

Under the ZIS (Act No. 34/2021 Coll.):
At EU level (once the new regulation enters into force): a fine of up to 5% of the annual turnover of the undertaking concerned or of the invested amount.

Frustration of the transaction ex post

If the authorities subsequently (for example, one or two years after completion of the purchase) manage to establish that the transaction should have been notified and was not, they may decide to prohibit the continued existence of the foreign investment.

In the most extreme cases, the authorities may even order a forced divestment—i.e., a forced sale of the stake back to the seller or to a third party.

Invalidity of the contract

The new EU rules clearly provide that if a transaction did not undergo (or should have undergone, but did not undergo) screening and was not notified, the contract may be considered invalid.

This means that the seller may sue the buyer for invalidity, and the buyer will have to relinquish the stake—regardless of how much money has already been paid.

Most common questions on regulatory screening risks

1. Can I cancel the sale if the screening does not pass?
In line with current practice, screening is often structured as a closing condition. This means that if the screening does not pass or is made subject to unacceptable conditions, the buyer has the right to cancel the transaction. But be careful: the seller must explicitly agree with the buyer on what impact the screening will have on the transaction. Without a clear agreement, disputes may arise.

2. How long does screening take in total?
At least 45 days (Phase I). In practice, however, once Phase II is triggered, you should expect 3–6 months. In some complex cases, even longer. The attorneys at ARROWS, a Prague-based law firm, can help forecast the timeline based on a detailed analysis of your situation.

3. Do I have to file the screening notification myself, or does the buyer do it?
In legal practice, this is most often handled so that the buyer files the application, but you, as the seller, must provide all necessary documentation and information about the company. The attorneys at ARROWS, a Prague-based law firm, can ensure that the filing is complete and properly structured.

How screening affects the price and structure of the transaction

The sale is delayed; consequently, closing and the seller’s payout are delayed as well. While waiting for screening, market conditions may change, the buyer may suddenly feel less motivated, or may demand a “waiting discount”.

The attorneys at ARROWS, a Prague-based law firm, can help you structure the deal so that it is resilient to such scenarios—for example by introducing clear deadlines, penalties for extensions, or a “tranche” payment structure tied to individual screening milestones.

“Hell-or-high-water” clauses

Investors—especially if they come from higher-risk jurisdictions—will pressure you to accept a “hell-or-high-water” clause, i.e., an obligation to take all steps necessary to obtain screening approval, regardless of cost and difficulty.

Be cautious. Such clauses can create enormous liability for you as the seller. The attorneys at ARROWS, a Prague-based law firm, can help you negotiate a fair allocation of risk between you and the buyer.

Conditional approval – “mitigation measures”

Screening often does not end with a clear YES or NO, but rather “YES, but subject to conditions”. These conditions (mitigation measures) can be demanding:

You must not develop certain technology in the EU
You must not have physical access to data
You must appoint a security auditor
You must not hire certain employees from third countries

Such conditions can fundamentally change the value of the company for the buyer and, consequently, your position in negotiations.

How to prepare for screening: Practical steps

Step 1: Early diagnosis – is your company “sensitive”?

Before you start selling, you need to know whether your company falls within the screening regime. Questions you need to ask yourself:

Do I operate in technologies—AI, semiconductors, quantum computers, cybersecurity?
Do I have access to critical infrastructure—energy, transport, water, telecommunications?
Am I identified as a provider of a regulated service under the higher-obligations regime or as a provider of an essential service under the Cybersecurity Act (from 1 August 2024)?
Do I work with critical raw materials—their extraction, processing, or recycling?
Do I have access to sensitive data—health, military, police, electoral?

If you answer YES to any question, there is a high likelihood of screening.

The attorneys at ARROWS, a Prague-based law firm, can carry out a detailed analysis of your company and give you a clear verdict on whether screening is likely.

Step 2: Preparing documentation and demonstrating sources of funds

The screening authority will want to know:

Who is the buyer’s ultimate beneficial owner? (Beneficial ownership)
Where do the funds to finance the purchase come from?
Does the buyer have a history of breaching conditions in other acquisitions? (Buyer due diligence)
Is the buyer or its owners on sanctions lists?
What is the purpose of the acquisition? (Is it a purely financial investment, or is it about gaining control over technologies?)

If you have this information prepared, the screening will go more smoothly.

Step 3: Communication with the buyer – a “screening-aware” structure

You should discuss screening openly with the buyer. You should not hide it or assume that it “probably won’t be necessary”.

Recommended steps:

Inform the buyer early that the transaction will be subject to screening
Agree together on who will lead communications with the authorities
Clearly negotiate who will bear the costs and risks of screening
Set the closing conditions so that they reflect the reality of screening (not as a surprise three months after signing)

The attorneys at ARROWS, a Prague-based law firm, can lead such negotiations and ensure that your interests are protected.

Step 4: Voluntary consultation with the state (optional, but recommended)

In the Czech Republic, you have the option to consult your investment with the Ministry of Industry and Trade even before a formal filing. This voluntary consultation will give you a better idea of how the authority views your transaction. You will obtain a binding assessment without being tied to any specific action.

Attorneys from ARROWS, a Prague-based law firm, can prepare and lead such a consultation.

Relevant questions on the new EU regulation

1. How do the new EU rules apply to the Czech Republic specifically?
The Czech Republic, like all EU Member States, is required to implement the new rules, with full application from the end of 2027 or the beginning of 2028. In addition, as of 1 August 2024, the Czech Republic already has its own tightening through the new Cybersecurity Act, which means that screening here has become even more extensive. The combination of both sets of rules makes the Czech Republic one of the strictest regimes in the EU.

2. What happens to my company if the transaction was closed before the new rules?
The new rules will not have retroactive effect on transactions that were duly closed in accordance with the old rules. However, the new rules may give states the right to conduct retroactive screening (up to 5 years back) in certain breach cases, for example if the transaction was not notified even though it should have been.

3. Which EU countries have the strictest screening?
Germany, France, Italy and now the Czech Republic are among the countries with the strictest screening. Although Germany is not specifically mentioned in the new EU rules, it decided on its own to implement the new rules first. In 2025, Germany conducted 339 screening proceedings.

Risk table and how ARROWS helps

Potential issues	How ARROWS helps (office@arws.cz)
Uncertainty as to whether the transaction falls under screening	We will carry out a detailed legal analysis of your company and determine whether you are subject to mandatory screening under the new EU rules and Czech regulations. We will give you a clear verdict with a specific forecast of the screening timeline.
Unjustified extension of the screening or incorrect procedure	We will ensure that your filing is complete, properly structured and submitted in line with the highest standards. We will communicate with the authorities and make sure the screening deadline is not exceeded.
The buyer refuses the company because they are afraid of screening	We will help you with a communication strategy towards potential buyers. We will structure the transaction so that the screening risk is clearly allocated and does not come as a surprise. We will prepare a deal memorandum for the buyer explaining the screening process and how it will be addressed.
Screening is conditioned on unacceptable conditions (mitigation measures)	We will represent you in negotiations with the authorities on mitigating the conditions. If the condition concerns technology development, data security or employment, we will advocate for a solution that preserves the company’s value.
The transaction is on the screening threshold (e.g., exactly a 10% stake)	We will provide a legal opinion tailored to your situation. If screening is uncertain, we will recommend a voluntary consultation with the state or a transaction structure that minimises screening risk.

What changed in EU screening from March 2024 (proposal) to December 2025 (agreement)

Aspect	Current rules (until full application of the new regulation in 2027/2028)	New rules (from full application of the new regulation in 2027/2028)
Screening obligation	Voluntary for states – each decides for itself.	Mandatory for all states without exception.
Phase I deadline	Varies by state (30–75 days).	Uniform – exactly 45 calendar days everywhere.
Intra-EU investments	Screened only in some states and only in certain cases.	Automatically screened if the ultimate owner or controlling person is from a non-EU territory.
Retroactive screening	Difficult to access, only in exceptional cases.	Possible up to 5 years back for non-notified transactions.
Minimum list of sectors	No one had a uniform list – each state chose its own.	A clearly defined list (defence, AI, semiconductors, critical raw materials, finance, etc.).
Call-in rights	Not all states had call-in rights.	All states must have call-in rights for at least 15 months up to 5 years after closing, under certain conditions.
Penalties	Different across states.	At EU level, capped at: up to 5% of the annual turnover of the undertaking concerned or of the invested amount.

Final summary

Screening of foreign investments in the EU is changing fundamentally. It is no longer something you can afford to ignore. If you are selling a company or preparing for a sale, you must expect screening to be part of the process – and if you underestimate it, you risk delays, loss of negotiating position, loss of the buyer, fines, or even the collapse of the entire transaction.

The Czech situation is also specific: the combination of the new EU rules and the new Cybersecurity Act (effective from 1 August 2024) creates one of the strictest regulatory combinations in the EU. If you operate in digital infrastructure, ICT, energy, healthcare or any other sensitive area, the threat of screening is real for you.

However, the point is not for screening to scare you. The point is for it to prepare you. If you know your sale will be affected by screening, you can:

Structure the transaction so that screening does not end up being a surprise
Negotiate clear terms in case the screening does not pass unconditionally
Communicate with potential buyers based on facts, not speculation
Minimise costs and risks

Attorneys from ARROWS, a Prague-based law firm, are well-versed in foreign investment screening and can help you with each of these steps – from the initial diagnosis through preparation of the filing to representation in negotiations with the authorities. At the same time, thanks to the ARROWS International network, they can also assist with matters that have cross-border elements and require coordination with authorities in other countries.

If you are preparing to sell a company to a foreign investor and want to avoid risks and delays, contact ARROWS, a Prague-based law firm, at office@arws.cz. We will carry out a complete audit of your screening risk and help you structure the transaction so that it passes without unnecessary complications.

Frequently asked questions on foreign investment screening in the EU

1. Can screening be avoided at all, or is it mandatory?
If your company falls within a sensitive sector (defence, AI, semiconductors, critical infrastructure, critical raw materials, finance) and the buyer is a foreign investor, screening is mandatory without exception. It cannot be avoided. If you attempt to conceal the transaction, you risk subsequent issues, fines, and invalidity of the agreement. The attorneys at ARROWS, a Prague-based law firm, will help ensure that the screening is carried out correctly and on time.

2. When does screening also apply to acquisitions between “friendly” countries (USA, EU, etc.)?
Screening is not selective based on the buyer’s origin. Even a US, Swiss, or other “friendly” investor will undergo screening if acquiring in a sensitive sector or if the ultimate owner is from a non-EU country. Geopolitical relations may influence the outcome of the screening (a friendly investor usually has an easier path), but the screening itself is mandatory regardless of where the investor comes from.

3. Which sectors are most commonly problematic for screening in the Czech Republic?
As of 1 August 2024, these are primarily: digital infrastructure and ICT services (software, cloud, cybersecurity), energy (distribution networks), healthcare (especially hospital IT systems), telecommunications, and financial services. If you operate in any of these sectors, screening is almost certainly likely. ARROWS’ Prague-based attorneys can carry out a specific assessment of your business.

4. Can I voluntarily consult with the state even before the sale?
Yes. In the Czech Republic, you have the option of a voluntary consultation with the Ministry of Industry and Trade. This consultation will give you a better idea of how the state views your situation, without binding you to anything. The attorneys at ARROWS, a Prague-based law firm, can prepare and lead such a consultation.

5. What if the buyer withdraws from the purchase due to screening?
If screening causes the buyer to withdraw from the purchase, it depends on how you have structured the transaction. If you have not included screening as a condition, the buyer may derail the transaction and potentially claim that you breached your duty to inform. The attorneys at ARROWS, a Prague-based law firm, will help you with the legal structuring of the transaction so that the allocation of risks is clear and you are not burdened by unnecessary disputes.

6. How long does screening actually take— is it really only 45 days?
Phase I lasts exactly 45 days. However, if the authority opens Phase II (an in-depth review), it may take a further 2–6 months, and in some cases even longer. In practice, you should therefore expect at least 3–6 months if there is any suspicion. The attorneys at ARROWS, a Prague-based law firm, can provide a timeline forecast based on a detailed analysis of your situation.

Notice: The information contained in this article is of a general informational nature only and is intended for basic orientation in the matter under the legal framework as of 2026. Although we take the utmost care to ensure accuracy, legal regulations and their interpretation evolve over time. We are ARROWS advokátní kancelář, an entity registered with the Czech Bar Association (our supervisory authority), and for maximum client protection we are insured for professional liability with a limit of CZK 400,000,000. To verify the current wording of regulations and their application to your specific situation, it is necessary to contact ARROWS advokátní kancelář directly (office@arws.cz). We accept no liability for any damages arising from the independent use of the information in this article without prior individual legal consultation.

Read also: