Eivind J. Vesterkjær, Hedvig Moe and Trine Siri Dahl (Advokatfirmaet Thommessen) authored this publication

Introduction

The Security Act contains rules on mandatory FDI filings for certain transactions involving companies that have been made subject to the Security Act. Additionally, the Act provides a "golden power" allowing Norwegian authorities to intervene in transactions concerning companies that have not been made subject to the Security Act, if deemed necessary to protect national security interests.

Summary of major changes in 2025

• There have been no major changes to the Norwegian FDI regime in 2025.
• In February 2025, a proposal for a new regulation containing supplementary provisions to the amendments adopted in 2023 to the Security Act's rules on ownership control was opened for public consultation. The regulation and amended legislation are expected to enter into force in 2026.
• In 2024, there was a public consultation on a broader FDI screening regime. The government is still working on this initiative and a potential legislative proposal. Such an overhaul could be expected to bring the Norwegian system more in line with broader regimes in other European countries, seen in the context of the EU FDI screening system.

Who files?

Under the current regime, the filing obligation lies with the acquirer and applies to both foreign and Norwegian acquirers.

The filing should be submitted to the government ministry responsible for the sector in question or, if no ministry is responsible for that sector, to the National Security Authority.

Types of deals reviewed

To trigger a mandatory filing obligation under Chapter 10 of the Norwegian Security Act, there must be an acquisition of a "qualified ownership interest" in a business brought under the Act's scope by an administrative decision. A qualified ownership interest is defined as acquiring one-third of the shares, interests, or voting rights in the business, or gaining significant influence by other means.

Decisions to subject businesses to the Security Act are made for undertakings handling classified information, controlling critical systems, objects, or infrastructure, or engaging in activities of vital importance to fundamental national functions or national security interests. Businesses of significant importance to fundamental national functions or national security interests may also be subjected to the FDI regime specifically.

Norwegian authorities do not publish a comprehensive list of undertakings that have been placed under the scope of the Security Act. However, based on available information, companies that have been made subject to the Act include entities active in sectors such as defense, telecommunications, space, finance, air and land transport infrastructure, energy, and information and communications technology. In addition, recent cases confirm that the authorities are concerned about transactions involving strategically located real estate and ports.

Scope of the review

The criterion for intervention under the Security Act is whether the acquisition presents a not insignificant risk of a threat to national security interests. This criterion provides significant discretion in the authorities' review, but some guidance may be drawn from previous interventions pursuant to the Security Act.

In 2021, the Norwegian government prohibited the sale of Bergen Engines, a Rolls-Royce-owned engine manufacturer for civil and military applications, to TMH International. The ultimate owners of TMH had ties to the Russian government, raising concerns that the sale would give TMH access to the company's technology, expertise, materials, real estate, customer portfolio, and contracts. Additionally, Bergen Engines' strategic location heightened the national security risk.

In 2023, the government conditionally approved the acquisition by Mubadala Investment Company of a minority interest in GlobalConnect, a provider of fiber internet services. The conditions imposed included measures to prevent sensitive information concerning national security from being obtained by unauthorized persons, ensuring prior control of future changes in ownership of the business, and imposing certain restrictions on the resale of shares.

In 2024, the Norwegian government imposed heavy restrictions on the possible sale of a property on Svalbard. Svalbard is of unique geopolitical importance due to its strategic location in the Arctic region, and the government was concerned that the property might be sold to an acquirer that will exploit it in a manner damaging to national security interests.

The emphasis on the Arctic region was further underscored in 2024, when Norwegian authorities invoked the Security Act to issue a formal notice to Kirkenes Havn, the Port of Kirkenes, reminding it of its obligations pursuant to the Act and signaling that the government would review the importance of the Port to national security interests. The port, situated in northeastern Norway in close proximity to the Northern Sea Route, had been in discussions with COSCO Shipping, a Chinese state owned enterprise, regarding its establishment in Kirkenes.

In September 2025, the Norwegian government, acting through the Norwegian Coastal Administration, Kystverket, assumed ownership of the vessel LLV Azurit. The Russian fishing vessel had been moored in Båtsfjord harbor since May 2024. In December 2024, pursuant to the Security Act, the vessel was ordered to vacate Båtsfjord harbor, but the owner did not comply. The decision was taken on the basis that the vessel's prolonged presence in the harbor was considered to pose a risk to national security interests.

Review process timeline

The review process for transactions differs depending on whether the review results from a mandatory FDI filing pursuant to Section 10-3 or an ex officio investigation pursuant to Section 2-5.

Case handling under Section 10-3 concerns businesses subject to mandatory filing. The review period consists of an initial phase of 60 business days from the filing date and an in-depth phase without any formal timeline.

Within the initial 60-day period, commonly referred to as Phase 1, the authorities must either approve the transaction or inform the acquirer that the matter will be referred to the King in Council (the government) for a decision. In the subsequent stage, Phase 2, there is no definitive timeline for the further review process.

If the authority requests additional information within 50 business days from the receipt of the notification, the 60-day deadline is suspended until the requested information is received.

There is no case handling deadline under Section 2-5. This provision grants the King in Council golden power authority to intervene in any planned or ongoing activities that may present a not insignificant risk of a threat to national security interests, including transactions involving businesses that have not been made subject to the filing obligation.

Under the current regime, there is no statutory standstill obligation. However, when the 2023 amendments come into force, such an obligation will be introduced for transactions subject to mandatory filing. The government also has the power to impose a standstill on a case-by-case basis.

How foreign investors can protect themselves

Under the current FDI regime in Norway, prospective investors should first verify whether the target has received an administrative decision pursuant to Section 1-3 of the Security Act bringing it within the scope of the Act generally or the filing regime specifically. If so, it should be verified whether the investment qualifies as the acquisition of a "qualified ownership interest".

In light of the 2023 amendments, prospective investors should also verify whether the target enterprise holds a facility security clearance granted by the Norwegian clearance authority. When the amendments enter into force, undertakings that hold such a clearance will be subject to the filing regime.

Even where there is no mandatory filing obligation, prospective buyers should consider whether Norwegian authorities might investigate the transaction ex officio under the general intervention clause in Section 2-5. Prospective buyers should also assess whether there is a risk that the transaction may adversely affect the target's ability to serve certain customers post-transaction, for example due to withdrawal of its facility security clearance.

Such a risk assessment will take into account transaction-specific facts but will typically involve verifying whether the transaction would require filing if the 2023 amendments were already in force; considering whether the transaction concerns a security-sensitive sector; assessing the target's customer list and whether the target holds a facility security clearance of 'Konfidensiell' (confidential) or higher; and considering whether the buyer, its ultimate beneficiary, or any companies in the buyer's group have links to high-risk countries.

The outcome of this risk analysis should be used to determine how any FDI aspects of the transaction can best be addressed in the overall transaction context, including whether risks can be mitigated by proactively engaging relevant customers or Norwegian authorities.

Investors should also consider whether the transaction timeline accounts for a potential filing process or ex officio review on national security grounds. Depending on the outcome of the filing analysis and risk assessment, it may be advisable to treat filing requirements and/or potential ex officio reviews as a condition precedent to closing.

Transparency regarding the buyer's ownership structure is advisable during informal contacts with the authorities and in the filing itself to ensure efficient case handling and reduce the risk of information requests that suspend Phase 1 or refer to Phase 2.

Because conditional approval is possible, buyers should consider whether potential security concerns can be remedied, including through divestment of parts of the target business or termination of sensitive agreements, and assess the implications of such remedies for the target's value and the transaction rationale.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2026 White & Case LLP}