Refinements to the proposed UK National Security and Investment regime

Despite concerns raised in the consultation that the Artificial Intelligence sector should be removed, the Government has decided that the sector should be retained. It is the Government’s view that the opportunity to use AI technologies positively across the UK economy can only be harnessed if sensitive applications of AI are protected from the risk of hostile actors intending to do harm to the UK.

However, in response to concerns that the definition was too broad the Government has restricted the definition of AI to focus on:

• The identification of objects, people and events;
• Advanced Robotics; and
• Cyber Security.

The scope of “Communications” caught has been narrowed to only include public electronic communications networks, services, and associated facilities. The definition is divided into 3 sections (public communications, infrastructure critical to public communications and the associated supply chain).

The Government has also set out specific categories of businesses that will also be captured:

• Providers of submarine cable systems;
• Providers of Cable landing stations; and
• Operators of essential services in the digital infrastructure subsector as set out in the Network and Information Systems Regulations 2018 as follows:
  o Top Level Domain Name Registries;
  o Domain Name System Resolver and Authoritative Hosting services; and
  o Internet Exchange Points.

Further clarity has also been provided in the definition covering the telecoms supply chain and which parts are captured (although this is subject to further discussion and whether the supply chain definition should be narrowed further, potentially listing the specific components that should be caught).

Associated facilities will only be caught if they are associated facilities by reference to a public electronic communications network or service.

The Government also proposed to introduce a materiality threshold to exempt acquisitions of smaller companies to minimize the burden on industry (£50m). This Government is also considering applying a threshold to qualifying entities in the supply chain such as vendors and service providers.

Finally, the definition has been revised to include housing and support infrastructures such as data centers. These were deemed critical to security as they allowed access to the network nodes.

The focus for Computing Hardware remains the prevention of the loss of intellectual property in supply chains to hostile actors. Reference is now therefore made to ‘architectural, logical and physical designs’ and several other terms have been further clarified.

Six sub-terms have also been introduced to explain what a computing processing unit includes:

• A Central Processing Unit;
• A field programmable gate array;
• A microcontroller;
• A system on a chip;
• A Graphics processor unit; and
• A specialist processor for artificial intelligence applications.

The definition of the Defence sector was designed to include companies at all tiers, including sub-contractors and entities in the chain of sub-contractors, which produce, research, develop, design, create, or apply goods or services used for defence or national security purposes.

The sector definition states that if one of the two following criteria are met, the mandatory notification requirement applies:

1. Either the entity is a government contractor or any subcontractor in a chain of sub-contractors which begins with the government contractor; or
2. The entity has been notified by the Government that they hold, or may come into possession of, classified material.