Regulation (EU) 2026/1386 on the screening of foreign direct investments (FDI), in force since 16 July 2026, repeals Regulation (EU) 2019/452 and reshapes the EU screening framework. It provides for an 18-month transitional period in which Member States must adapt their legislation and administrative mechanisms. Certain provisions, including those on notification of national measures, the common information form, the secure European information-exchange infrastructure and the Commission's delegated powers, are already in force since 16 July 2026.

A mandatory screening framework and a broader concept of foreign investment

The main change is the obligation for every Member State to establish and maintain a national foreign investment screening mechanism. Extending this obligation across the EU strengthens oversight and closes the gaps that allowed certain problematic foreign investors to use Member States without screening mechanisms as gateways to the internal market for investments in sensitive assets.

A common minimum scope of strategic sectors

The Regulation introduces a mandatory minimum scope for prior authorisation. It covers Union undertakings involved in dual-use items, military equipment and sensitive technologies, including semiconductors, quantum technologies and certain artificial-intelligence technologies. The scope also extends to critical energy, transport and digital infrastructure identified through a national risk-based assessment; activities relating to strategic raw materials; and systemically important financial entities, such as central counterparties, central securities depositories, regulated-market and payment-system operators and specialised financial-messaging providers.

Electoral infrastructure is expressly included. Investments in entities that own, develop or operate voter-registration databases, voting systems or other IT systems used to manage electoral operations must be subject to prior authorisation. This reflects the Union's concern with foreign influence, access to sensitive data and technological vulnerabilities affecting democratic processes.

Prior authorisation, ex post review and coordinated procedures

Investments falling within the mandatory scope must be notified and reviewed before completion. National procedures must include at least two phases. The initial review must be completed within 45 calendar days from the date on which the filing is deemed complete. Where necessary, an in-depth investigation should be carried out, while its detailed procedural framework remains largely at the discretion of each Member State.

The Regulation also reinforces ex post control. Investments falling within the scope of a Member State's screening mechanism but which are not subject to prior authorisation may be examined on the authority's own initiative from at least 15 months and up to five years after completion, if there are reasons to consider that such an investment may affect security or public order. Investments that should have been authorised but were not notified, or were notified only after completion, must remain reviewable for at least 24 months after completion.

For transactions requiring filings in several Member States, applications must be submitted on the same day and must identify the parallel filings. The authorities concerned must coordinate their procedures and seek to align decision timetables, a point of direct relevance to cross-border M&A transactions.

Stronger EU cooperation and procedural safeguards

Member States must notify the Commission and the other Member States of specified investments, including cases involving the common minimum scope and investors controlled by third-country governments, subject to EU restrictive measures, or previously involved in prohibited investments or in breaches of mitigation measures. Notification is also required when an in-depth investigation is opened and the target participates in a project or programme of Union interest or belongs to a group operating in several Member States.

The Commission and other Member States may issue reasoned opinions or comments and the Commission may recommend mitigation measures, although the final decision remains with the screening Member State. Information requirements will be standardised and will cover the investor, beneficial owner, ownership structure, financing and source of funds, planned completion, group structure and links with projects or programmes of Union interest. Exchanges will take place through a secure, encrypted European system. At the request of at least nine Member States, the Commission will also establish an online Union filing portal.

Investors benefit from minimum procedural safeguards. Screening rules must be transparent and non-discriminatory, affected parties must have access to an effective judicial remedy, and they must be given an opportunity to express their views before an investment is prohibited, unwound or authorised subject to mitigation measures.

Romania: an existing mechanism that requires targeted alignment

Romania already operates a national FDI screening mechanism under GEO No. 46/2022, as amended. It provides for the prior authorisation of investments made by foreign investors and, in certain cases, EU investors. The applicable threshold is EUR 5 million, although lower-value investments may also be screened if they are capable of affecting national security, public order or projects and programmes of Union interest. Similar or interdependent transactions carried out within one year between the same parties and concerning the same undertaking may be treated as a single investment. Interdependent transactions individually valued below EUR 5 million must be aggregated, and the notification obligation arises when their cumulative value reaches that threshold.

GEO No. 17/2026 extended the mechanism to asset deals, covering acquisitions of tangible or intangible assets in sensitive sectors as well as acquisitions of shares or equity interests. Romanian legislation already covers many sectors included in the new EU minimum scope: critical and advanced technologies, critical infrastructure, pharmaceuticals, defence, agri-food, artificial intelligence, robotics, semiconductors, cybersecurity, quantum and nuclear technologies, biotechnology, energy, transport, healthcare, communications, data processing and storage, and electoral and financial infrastructure. Targeted amendments will nevertheless be required, notably for strategic raw materials and certain critical financial infrastructures.

The Romanian mechanism also provides for ex post review, conditional authorisation and structural or behavioural measures. Where an investment was completed without the required authorisation and affects national security or public order, the Commission for the Examination of Foreign Direct Investments (CEISD) may propose measures designed to restore the previous situation. It may also recommend authorisation subject to commitments. These features are broadly consistent with the new Regulation's approach to non-notified investments and mitigation measures.

Under the current national procedure, CEISD may authorise an investment, authorise it subject to conditions or recommend rejection. Complex cases may undergo an in-depth investigation lasting 90 calendar days, extendable once by up to 45 days; the Supreme Council of National Defence may also be consulted. Romania's planned digital filing application will need to interoperate with the secure EU exchange system, European database and any online Union portal.

In practice, Romania's framework already contains much of the architecture required by Regulation (EU) 2026/1386. The main task will be precise legislative alignment: completing the sectoral scope, coordinating national and EU digital systems, adapting deadlines and notification flows, and managing the interaction between FDI screening and merger control from the transaction-structuring stage.

By Cristina Bojica, Partner, Gruia Dufaut & Asociatii

*This is an expert corner.