In 2020 Austria introduced a dedicated Investment Control Act (ICA), in the wake of COVID and international trade tensions during Trump’s first presidency, to protect national security and public order, including the continued supply of essential services in a crisis, and to operate the EU cooperation mechanism under the Foreign Direct Investment (FDI) Screening Regulation. Six years on, the authority has completed 427 proceedings, taken 44 into in-depth review, attached conditions to 18 and prohibited one. This post looks at what the regime catches, who decides and what the numbers say. Our next post will look at what we can learn from the case practice.
Three questions decide whether you file
1. How much are you acquiring? Acquiring voting rights of 10%, 25% or 50% in a company active in the sectors listed in Part 1 of the annex of the ICA requires clearance. For target companies that are active in the sectors mentioned in Part 2 of the annex, an acquisition of voting rights of 25% or 50% requires clearance. Percentages are not the whole test: acquiring decisive influence or essential assets can result in a notification obligation, whatever the shareholding. A veto over the budget or over continued supply to customers can trigger a filing.
2. Is the acquirer a foreign person? The law defines a foreign person as a natural person without EU, EEA or Swiss citizenship, or a legal person seated or headquartered outside the EU, the EEA and Switzerland. There are no privileged third countries, nor is there an exemption for listed acquirers. What can easily be missed, however, is the chain: the criterion of a foreign person is fulfilled if there is a single third-country entity in the chain between the acquiring entity and the ultimate beneficial owner, even where the ultimate owner is from the EU.
3. What are the target’s business activities? Part 1 of the annex is exhaustive and contains five items: defence goods and technologies, critical energy infrastructure, critical digital infrastructure including 5G, water and systems safeguarding the Republic’s data sovereignty. For these sectors, the acquisition of 10% of voting rights is enough. Part 2 is very much wider. It runs to fourteen categories of critical infrastructure: energy, information technology, transport, health, food, telecommunications, data processing and storage, defence, constitutional institutions, finance, research institutions, social and distribution systems, the chemical industry and real estate essential to any of them. These categories are complemented by three further heads: (i) critical and dual-use technologies, from artificial intelligence and semiconductors to quantum, nano- and biotechnology; (ii) security of supply with critical resources including energy, raw materials, food and medicines; and (iii) access to sensitive data and media plurality.
These sector lists are already very broad. However, as Part 2 of the annex is illustrative, and the ministry interprets the sectors “accessorily”, further sectors can be caught. Any supplier of inputs into critical sectors can also be considered as operating in a “critical sector”, falling under Part 2 of the annex. In one reported case, technical drawings for agricultural machinery were subsumed under food supply. It remains to be seen whether this expansive interpretation of the regime by the ministry will ultimately be supported by the courts.
The ministry now publishes a negative list, and it is worth reading. It names, inter alia, advisory services without operational activity, training and technical support, marketing and communications including websites, logistics and payroll, recruitment, municipal waste collection and street cleaning, paints and coatings, the sale of air freight capacity, refreshments from vending machines, burger stands and frozen chips, and sportswear. These examples allow conclusions on the principles: ancillary IT services that merely serve the main business are not subsumed under information technology, and health and food mean human medicine and human food. Gambling, running the other way, falls under finance, apparently because of money-laundering risk.
De minimis exemption. One carve-out is worth knowing: targets with fewer than ten employees and turnover or total assets below €2m fall outside the regime altogether.
Who decides, and how many “cooks” are in the kitchen
This is a political decision, by design. The Act creates no independent agency. It assigns the decision to a minister of the federal government – the Minister for Economy, Energy and Tourism. The officials preparing it are bound by instruction in the ordinary way. No board, no independent decision-maker, no separation between investigation and decision (unlike in Austrian merger control, see our recent blog post here). And the regulator is – compared to the Bundeswettbewerbsbehörde (BWB) with 63 employees – thinly staffed with 13 employees, eight of them lawyers. Investment screening sits in Division II/7 of the Federal Ministry for Economy, Energy and Tourism, in the section for EU and international market strategies. The same division is Austria’s national contact point towards the Commission and the other Member States. Roughly a hundred proceedings a year are handled by that team.
The minister has many advisers. The Investment Control Committee seats every relevant federal ministry plus a representative of every province whose remit a transaction touches. A sitting is mandatory before an in-depth review is opened and again before any decision closing one. Members get five to ten working days to respond, silence counts as consent, and the minister is bound neither by the recommendation nor by any dissent.
On top sits the European layer, and it stretches the timetable. Every case is notified into the EU cooperation mechanism, where the Commission and 26 other Member States may comment, and their periods run before the national clock even starts. In practice that means 15 calendar days, a further 20 if any Member State or the Commission signals an intention to comment, and five more for a Commission opinion – and only then does the national month begin, with two further months if the case goes to phase 2. This takes the review period in a straightforward phase 1 case to roughly two months.
What the numbers say
Clearance certificate – the quick route that often is not. Where the notification obligation is unclear and the parties seek legal certainty, they can request a “clearance certificate”, saying that the deal is not notifiable. However, of 75 such applications, 20 became approval proceedings.
In-depth review is not exceptional. Between 2020 and 2024 – the period for which data has been published – 44 of 427 proceedings went to phase 2, roughly 10%. Compare that with Austrian merger control, where only 4 out of 374 cases in 2025 went into phase 2 (roughly 1%).
Conditions are more common than in Austrian merger control. Eighteen of those 44 in-depth reviews ended with conditions – roughly two in five. While decisions are not published, behavioural remedies appear to be much more common than structural remedies, which is in line with the decision practice of many FDI regulators across Europe. For instance, in one case remedies included capping the investor’s supervisory board nominations, barring it from proposing amendments to the articles, and imposing reporting duties to the ministry.
But: entering phase 2 does not necessarily mean there are real concerns. In some cases the ministry has opened phase 2 – and said as much to the parties – simply because the phase 1 clock was about to run out, and has then cleared the case in phase 2 without conditions.
Hardly any case has been tested in court. Where a case is cleared subject to conditions the acquirer can live with, there is no one left to appeal – and little incentive to try, because, unlike in Austrian merger control, the courts are under no hard deadline to decide.
Failing to file is not just a commercial risk – it is a criminal one. Closing a notifiable transaction without clearance is punishable by up to one year’s imprisonment, up to three years in aggravated cases, and Austrian criminal law applies to acts committed abroad. The target company faces an administrative fine of up to €40,000 for failing to notify a transaction it knows about. The ministry is an actively screening regulator: between 2020 and 2024, it required an application in ten cases where none had been filed, and opened proceedings on its own in four more.
Between the lines: what to take away
Three questions (acquisition above a threshold, foreign investor, and what the target does) decide whether you file.
The decision is then taken by a member of the government, advised by a committee of every ministry and every affected province, after Brussels has had its say.
The initiation of an in-depth review is a real possibility (10% of notifications), not a tail risk.
Conditions are much more common (roughly 4% of notifications) than in Austrian merger control – and typically behavioural in nature.
The next post looks at the practice – which investors get screened, which sectors and what the conditions look like.
Disclosure: This article was written the way we work. The topic, the analysis, the arguments and the final wording are ours. We use AI as a research and drafting tool along the way. The result is meant to speak for itself.