On 27 April 2026 the Foreign Investment Security Review Office (National Development and Reform Commission) made a prohibition decision on a foreign acquisition of the Manus project, requiring the parties to unwind the transaction. According to public reporting, the deal had drawn wide attention, involving the international environment, key technology, data security and capital arrangements.
What is being reviewed
Foreign-investment security review is not a new system, but applying it to a flagship AI project carries clear signal value.
The review typically asks three things: whether the target involves key technology or important data; whether the transaction affects national security and the public interest; and the background and control relationships of the foreign investor. AI projects naturally fall into the first two — model capability is frontier technology, and the user and behavioural data accumulated in training and operation are high-value data assets.
Prohibiting the investment and requiring unwinding is the heaviest outcome. It means not only that the transaction cannot complete, but that parts already advanced must be rolled back. For the parties, the time cost, liability for breach and reputational loss all follow.
Three tests for AI cross-border deals
First, whether the target technology is a key field. Foundation models, core algorithms, training frameworks and key vertical models are all in focus.
Second, whether the data constitutes important data or involves large-scale personal-information processing. Data assets are a major component of AI valuations and a focus of security review — see our data-compliance service and our analysis of duties of large personal information processors.
Third, whether the control arrangements are clear. Actual control formed through contractual control, nominee holdings or multi-layer structures will be looked through in review.
Knock-on effects on going-global planning
The impact goes beyond the transaction itself and touches AI companies’ choice of going-global path.
First, structure design needs advance assessment. Many AI companies early on place the entity or data offshore to connect with overseas markets and capital. Whether this arrangement engages security review or data-export rules should be assessed when the structure is built, not at the financing or M&A stage — see our financing and equity service.
Second, cross-border data flow needs a compliant path. Data exports involved in training and inference should use the security-assessment, standard-contract or certification path — see our GDPR and cross-border service.
Third, exit paths must be recalculated. AI companies whose main exit is acquisition by an offshore party should assess that path’s feasibility and prepare alternatives — see our M&A and exit service.
Fourth, a multi-jurisdiction lens is essential. Both the outbound and inbound sides of the rules must be examined — see our multi-jurisdiction service.
What to do before the deal
For AI companies planning cross-border deals, three things are worth doing early: a pre-deal compliance check to identify whether security review applies; conditions precedent and break-fee clauses in the deal documents to allocate review risk; and data-export compliance material prepared in parallel so approval does not become the bottleneck.
Security review is not a rejection of deals but a clarification of their boundaries. The earlier the boundaries are identified, the less likely a late-stage rollback. For support on cross-border deal structures, security-review filing and data export, see our M&A and exit service.
This article is based on public information concerning the Foreign Investment Security Review Office (NDRC)’s security-review decision on 27 April 2026 regarding the foreign acquisition of the Manus project. It is for general reference only and does not constitute legal advice.