In short: investments in critical infrastructure and sensitive technology in the EU are currently subject to security screening under Regulation (EU) 2019/452 (applicable since 11 October 2020) — a cooperation framework in which the European Commission and Member States exchange information on transactions likely to affect “security or public order”, while the final decision stays with the Member State hosting the investment target. The turning point: on 11 December 2025, the Council of the EU and the European Parliament reached a provisional political agreement to revise the Regulation toward MANDATORY national screening in every Member State, a common minimum sectoral scope (hyper-critical technologies, critical infrastructure, critical raw materials and more), and coverage of indirect investments made through EU subsidiaries controlled by non-EU investors. Investors — including those from Vietnam under the EVFTA — should build security screening into their pre-signing checklist, because unnotified deals may face retroactive review.
The current framework: how Regulation (EU) 2019/452 works
Regulation 2019/452 does not create a centralised EU screening authority; it builds a cooperation mechanism: when a Member State screens a foreign direct investment, other Member States and the Commission may issue opinions and comments within set timeframes; the host Member State must give them “utmost account” but keeps the final say — including prohibition or conditions. The trigger is drafted broadly: a likely effect on security or public order, with a non-exhaustive list of factors such as critical infrastructure (energy, transport, water, health, communications, data processing, aerospace, defence and others), critical technologies (artificial intelligence, robotics, semiconductors, cybersecurity and others), supply of critical inputs, access to sensitive information, and whether the investor is controlled by a foreign government.
The biggest weakness of the current framework is fragmentation: each Member State decides for itself whether to maintain a screening mechanism, with different thresholds, procedures and timelines. Acquiring a German technology company may require a pre-closing filing, while the same deal in a Member State without a mechanism faces no screening at all — until the new regulation takes effect.
The 11 December 2025 political agreement: four major changes
First, EU-wide mandatory screening: every Member State must establish a national screening mechanism. At the time of the agreement, 26 of 27 already had one, with the last (Cyprus) expected from April 2026 — so this change mainly locks in the status quo and prevents future gaps.
Second, a mandatory common minimum scope: every national mechanism must at least cover dual-use items and military equipment; hyper-critical technologies such as AI (aligned with the EU AI Act definitions, focused on general-purpose AI relevant to space or defence), quantum technologies and semiconductors; critical raw materials; critical entities in energy, transport and digital infrastructure (based on the host Member State’s risk assessment); electoral infrastructure; and a narrowly listed set of financial-system entities.
Third, anti-circumvention through intra-EU structures: the scope extends to investments made by EU-based investors controlled, directly or indirectly, by non-EU persons or entities. Deals routed through Dutch or Luxembourg subsidiaries to “wash” non-EU capital — a long-standing practice — will lose this loophole.
Fourth, stronger procedures: a two-phase review process and the power to screen unnotified transactions retroactively. In fairness: as of the writing date, 19 October 2026, this remains a provisional political agreement and the final text has not been published — this article describes the direction, not law already in force.
What Vietnamese investors should do before signing
Step 1: identify the host Member State and check its national screening regime — whether pre-closing filing is mandatory and which thresholds trigger it (ownership percentage, control rights, value). Step 2: assess whether the target falls in a sensitive scope — infrastructure, technology, data — including acquisitions via EU subsidiaries. Step 3: build screening-approval conditions into the purchase agreement (long-stop date, walk-away rights, allocation of risk if conditions are imposed or the deal is blocked). Step 4: note the parallel instrument — the Foreign Subsidies Regulation (EU) 2022/2560 may trigger separate notification duties for M&A involving non-EU state support. The EVFTA (in force 1 August 2020) opens market access but does not exempt security screening — the two layers operate independently.
Frequently Asked Questions
- Is the EU’s new FDI screening regulation already in force?
- No. 11 December 2025 brought only a provisional political agreement between the Council and the Parliament; the final text had not been published as of the writing date. The applicable framework remains Regulation (EU) 2019/452 plus each Member State’s national mechanism.
- Can buying an EU tech company through a Dutch subsidiary avoid screening?
- Under the current framework, some such structures may slip through. But the December 2025 agreement extends the scope to indirect investment through EU subsidiaries controlled by non-EU investors — the loophole closes once the new regulation takes effect.
- Does the EVFTA exempt Vietnamese investors from security screening?
- No. The EVFTA opens market access and investment protection, but national-security screening is an independent layer applying to all non-EU investors regardless of trade agreements.
- What happens if no screening filing is made?
- Depending on the Member State: the transaction may be void, fined, or retroactively reviewed with forced divestment. The new agreement adds EU-wide retroactive screening of unnotified deals — “close first, file later” is a high-risk strategy.
This article has been quality-reviewed by the FLAW AI Legal Council