– How does the Security Act affect your business?

The Security Act came into force in Norway in 2019. The purpose of the Act is to protect the nation's fundamental national security interests and ensure the stability and welfare of society. The legislation is set out to, protect sensitive information and information systems, ensure critical and important infrastructure, and prevent businesses of crucial importance to fundamental national functions from being acquired by foreign powers in violation of Norway's security interests.

– Businesses that are subject to the Security Act are considered to be particularly important to Norway's security, and are therefore given greater responsibility for securing their operations. It is essential that these companies recognize and manage the risks associated with potential security threats in order to prevent unwanted incidents, says Partner Heidi Jorkjend.

– Despite the fact that the Security Act is relatively new, it has already been revised and significantly expanded. This legal area is relatively immature, and it can be challenging to obtain an overview of what the Act actually entails. It is also somewhat difficult to predict how the authorities will put it into practice, partly because this is done on a case by case basis, by different authorities and oftentimes not publicly disclosed.

Increased uncertainty in transaction processes

In June 2023, the Security Act was revised with several important changes – including expanded rules on ownership control with the aim of strengthening the authorities' supervision of foreign investments that could potentially harm national security interests. The changes have only partially entered into force.

New rules related to ownership control will lead to a significantly larger number of transactions becoming subject to mandatory notification.

– This slightly unpredictable situation increases the importance of well-functioning routines for assessing and managing security risks in transactions. So far, the focus has been on mandatory notification for transactions where the company is directly subjected to the Act, but we are receiving more and more questions about FDI and security risk assessment from other companies too.

This may be because companies assume they might be made subjected to the Act, but also because Norwegian authorities can intervene in transactions regardless of whether the company is subjected to the Security Act.

– The authorities have made use of this authority – in the sale of diesel and gas engine manufacturer Bergen Engines in 2021. The transaction was halted by the Norwegian authorities late in the process, says Heidi.

– The buyer company had ties to the Russian authorities, and the target company's operations were of strategic importance to Russia. Bergen Engines also sits at a strategic location at the entrance to the Port of Bergen. In retrospect, this case may appear relatively clear-cut, but we cannot rule out that the authorities may also intervene in less clear-cut cases. There is a large element of unpredictability in the practice of the provision, she continues.

– Two pivotal considerations frequently collide in these matters; a desire for foreign investment in Norway and national security. The balance between these two has changed in recent years. Countries all over the world are adopting new FDI rules. It is essential for businesses today to be aware of and consider risks related to national security in transactions. Could, for example, your target be made subject to the Security Act in the near future, or is it a supplier to a business already subjected to the Act? adds Specialist Counsel Hedvig Moe.

But the Security Act isn't relevant for my business, is it?

Hedvig's prediction is that the Security Act will affect more Norwegian businesses in the coming years.

– With increased focus on the importance and relevance of national security, both among the general public and amongst politicians, the balance between commercial interests and national security considerations is changing. Adding the amendments to the Security Act, we believe that more businesses will be made subject to the Security Act or have to comply with it in their capacity as suppliers or subcontractors to subjected businesses.

– Thommessen's lawyers have substantial experience from relevant government agencies. We advise clients on dialogue with the authorities as well as during the implementation phase if an entity is made subject to the Act.

The Act, and corresponding practice, has a very short history, and the concept of "national security" is ever evolving. A best practice is not yet in place, and may not even arise, given the sector-based case by case non public nature of this area of the law. However, identifying the most important company specific national security risks, as well as becoming familiar with the Security Act, is vital to Norwegian businesses in 2023 and in the years to come, concludes Hedvig.