M&A Lawyers Spain 2026: FDI Screening, Merger Control and Tech & Life Sciences Risks

Foreign acquirers, PE sponsors and in-house M&A teams considering cross-border transactions in Spain face a materially different regulatory landscape in 2026 than even two years ago. Expanded foreign direct investment (FDI) screening under Real Decreto-ley 1/2025, the detailed procedural framework established by Royal Decree 571/2023, and the ongoing transitional prior-authorisation requirement for EU/EFTA investors through 31 December 2026 mean that M&A lawyers Spain practitioners must now map notification obligations at the earliest stage of deal planning. The stakes are highest in two sectors experiencing a surge in inbound investment, technology and life sciences, where overlapping national-security, data-protection and supply-chain concerns create multi-layered risk.

This guide provides the actionable checklists, timelines and SPA drafting strategies that general counsel and deal teams need to navigate these parallel regulatory tracks with confidence.

Executive Summary: Five Key Takeaways

Before diving into each regulatory layer, the following points capture the critical planning issues for any foreign investor contemplating an acquisition in Spain during 2026:

• Prior authorisation still applies to EU/EFTA investors. The transitional regime has been extended to 31 December 2026, meaning that investors from EU and EFTA member states remain subject to the same FDI screening obligations as non-EU investors for transactions in designated sectors.
• Royal Decree 571/2023 governs the procedural detail. Since its entry into force, this decree has established the Investment Register, detailed the notification questionnaire and codified review timelines that were previously scattered across ministerial orders.
• Decree-Law 1/2025 broadened the screening scope. Published in the Boletín Oficial del Estado (BOE) on 29 January 2025, this instrument expanded the categories of transactions and investors caught by Spain’s FDI regime.
• Merger control and FDI screening run on parallel but distinct tracks. Both may apply to the same deal, each with its own thresholds, suspensory effects and remedies, requiring careful SPA conditionality drafting.
• Tech and life sciences transactions carry heightened scrutiny. Deals involving data infrastructure, AI models, clinical trials or pharmaceutical supply chains face sector-specific red flags that go beyond standard FDI analysis.

FDI Screening in 2026: Which Transactions Trigger Notification?

The threshold question for any cross-border deal is whether the transaction falls within the scope of Spain’s foreign investment screening regime. Industry observers expect the volume of notified transactions to increase significantly in 2026, driven by both the legislative expansion and growing enforcement visibility. The answer depends on three variables: investor origin, sector and the nature of control acquired.

Key Thresholds: Value, Sector and Control

Foreign investment screening Spain obligations are triggered when a non-resident investor acquires a stake that confers control or significant influence over a Spanish company active in a designated sector. The concept of control is broadly defined and includes acquisition of 10% or more of share capital in listed companies, or any percentage conferring effective participation in management or control in unlisted targets. For transactions involving sovereign wealth funds, state-owned enterprises or investors from jurisdictions that lack adequate anti-money-laundering frameworks, the thresholds are interpreted even more conservatively.

The EU/EFTA transitional extension means that, until 31 December 2026, an investor from France, Germany or Norway faces the same prior-authorisation requirement as an investor from the United States or China when the target operates in a listed sector.

Who Is the Competent Authority?

The Directorate General of International Trade and Investment, within the Ministry of Industry, Commerce and Tourism, is the competent authority for receiving and processing FDI notifications. The Council of Ministers retains decision-making power on authorisation, suspension or prohibition, acting on a proposal from the Junta de Inversiones Exteriores. For lower-risk filings, the Ministry’s model notification forms and published guidance streamline the process and enable a fast-track review within 30 business days.

Decree-Law 1/2025, RD 571/2023 and 2026 Changes: The Legal Backbone

Understanding the legislative timeline is essential for any M&A lawyers Spain team advising on deal conditionality. Three instruments form the backbone of the current regime, each building on the last.

The combined effect is that FDI screening Spain 2026 now operates as a comprehensive, sector-based prior-authorisation regime with no practical carve-out for intra-EU investment. This represents one of the broadest screening frameworks in the European Union and aligns with the direction set by the EU’s own investment screening regulation.

Which Sectors Are High Risk?

The designated sectors broadly follow Article 7bis of the Foreign Investments Act and include critical infrastructure (energy, transport, water, health, communications, media, data processing, aerospace, defence, electoral and financial infrastructure), critical technologies (including artificial intelligence, robotics, semiconductors, cybersecurity, quantum computing, biotechnology and dual-use technologies), supply of critical inputs (energy, raw materials, food security), access to sensitive information (including personal data), and media plurality. For tech M&A Spain transactions, the overlap between data infrastructure, AI and cybersecurity designations is particularly acute. Life sciences M&A Spain deals attract scrutiny where the target holds clinical trial data, manufactures biologics or maintains strategic supply-chain positions.

Merger Control vs FDI Screening: Parallel Tracks and Practical Interplay

Many cross-border acquisitions in Spain trigger both merger control Spain obligations (before the Comisión Nacional de los Mercados y la Competencia, or CNMC) and FDI screening requirements simultaneously. These are distinct regimes with different objectives, competition protection versus national security, but they interact in ways that directly affect deal timing, conditionality and risk allocation.

Where both regimes apply, the practical challenge is sequencing. Neither authority defers to the other, and the standstill obligations are independent. Industry observers expect deal teams to file in parallel wherever possible, because sequential filing can add two to four months to the closing timeline, a material commercial risk in competitive auction processes.

Spanish Merger Control Thresholds and Filing Mechanics

The CNMC must be notified of any concentration that meets either the turnover test or the market-share test described above. The notification is made using the CNMC’s prescribed forms and must be filed before closing. Phase I review takes approximately one month, after which the CNMC either clears the transaction, clears it with conditions, or refers it to an in-depth Phase II investigation. Phase II can add up to two further months. Gun-jumping, completing a transaction before clearance, attracts significant fines.

Practical SPA Drafting Checklist for M&A Lawyers Spain

Managing the interaction between merger control and FDI screening in transaction documents requires specific contractual architecture. The following clauses should be considered for every cross-border SPA in a designated sector:

• Dual conditions precedent. Make closing conditional on both CNMC clearance and Council of Ministers FDI authorisation. Specify that neither condition is waivable without the other party’s consent.
• Long-stop date calibration. Set the long-stop date to accommodate worst-case timelines for both processes running in parallel, typically nine to twelve months from signing.
• Reverse break fee. Include a buyer-side reverse break fee triggered if FDI authorisation is refused or conditioned in a manner that is commercially unacceptable, providing the seller with economic protection against regulatory risk.
• Interim operating covenants. Define obligations on the seller to operate the business in the ordinary course during the regulatory review period, with carve-outs for actions required by the screening authority.
• Hell-or-high-water clause (if applicable). Where the buyer is willing to accept remedies, include an undertaking to accept conditions imposed by either authority up to a defined materiality threshold.

Sector Deep Dive: Tech M&A Spain Risks

Technology transactions are among the most scrutinised under Spain’s FDI regime. The convergence of data infrastructure, cybersecurity, AI and dual-use technology designations means that tech M&A Spain deals frequently trigger notification even where deal values are modest. The screening authority’s concern centres on whether an acquisition would transfer control over critical data, encryption capabilities or digital infrastructure to a foreign entity.

Data and Cybersecurity Red Flags

Deal teams should conduct a specific data and cybersecurity risk assessment at the due diligence stage. The following indicators typically escalate FDI scrutiny:

• Access to personal data of Spanish or EU citizens at scale. Targets processing health data, financial data or national-ID-linked records are high risk.
• Critical infrastructure data processing. Companies providing cloud, hosting or managed services to government entities or critical-infrastructure operators face enhanced review.
• Encryption and cybersecurity tools. Targets developing or deploying encryption software, intrusion-detection systems or cybersecurity platforms may fall within dual-use technology controls.
• Remote access and data localisation. Post-acquisition plans to migrate data to non-EU servers or grant remote access to non-EU personnel are scrutinised closely.
• AI model transfer. Where the target’s core IP includes trained AI models, the screening authority may assess whether transfer of model weights or training data raises national-security concerns.

IP, Talent and Cross-Border Exits

Beyond data, tech acquisitions raise FDI concerns where the target holds strategically significant patents (particularly in semiconductors, quantum computing or communications standards), where the acquisition would result in key R&D talent relocating outside Spain, or where the acquirer’s business plan involves consolidating Spanish IP into a non-EU holding structure. Mitigation steps include ring-fencing Spanish IP in a local subsidiary, committing to retain R&D headcount, and offering data-localisation undertakings as part of the FDI notification.

Sector Deep Dive: Life Sciences and Healthcare M&A Spain

Life sciences M&A Spain transactions attract FDI screening attention for different but equally complex reasons. The healthcare sector is explicitly designated as critical infrastructure, and transactions involving pharmaceutical manufacturers, biotech R&D companies, medical-device producers and clinical-research organisations are subject to prior authorisation. The screening authority’s focus is on supply-chain continuity, patient-data protection and the preservation of domestic manufacturing capacity for essential medicines and biologics.

Regulatory and Clinical Continuity Red Flags

The following factors will elevate scrutiny in a life sciences acquisition:

• Active clinical trials. Targets conducting clinical trials in Spain that are critical to national health programmes or involve rare-disease therapies may be considered strategically sensitive.
• Marketing authorisations and regulatory dossiers. Acquisition of the holder of Spanish or EU marketing authorisations for essential medicines raises continuity-of-supply concerns.
• Patient data and biobank holdings. Targets maintaining genomic databases, patient registries or biobank collections are subject to overlapping GDPR, Spanish Organic Law 3/2018 and FDI scrutiny.
• Controlled substances licences. Companies holding licences for the manufacture, storage or distribution of controlled substances face additional regulatory approval requirements from the Spanish Agency of Medicines and Medical Devices (AEMPS).

Manufacturing, Supply Chain and Export Control Flags

Where the target manufactures active pharmaceutical ingredients (APIs), finished dosage forms or biologics in Spain, the screening authority will assess whether the acquisition could lead to offshoring of production capacity or disruption to supply chains for essential medicines. Export controls on dual-use biological agents and precursor chemicals add a further compliance layer. Effective SPA protections in this sector include seller representations on regulatory-approval status, buyer covenants to maintain Spanish manufacturing operations for a defined period, and indemnities for losses arising from post-closing regulatory challenges to licence transfers.

Process Timelines, Practical Checklist and Notification Pack

Timely and complete notification is the single most important factor in avoiding delays, sanctions and deal uncertainty. The following timeline reflects current practice for a standard FDI notification under the framework established by RD 571/2023:

• Pre-notification engagement (optional but recommended): 2–4 weeks. Informal contact with the Directorate General to discuss scope, sector classification and documentation requirements. Early indications suggest that pre-notification engagement materially reduces the risk of information requests during formal review.
• Formal notification filing: Day 0. Submission of the complete notification pack to the Directorate General of International Trade and Investment.
• Standard review period: 30 business days from acceptance of a complete filing.
• Extended review (if triggered): Up to 3 months from notification. Extended review is initiated where the transaction raises complex national-security issues or where additional information is required.
• Council of Ministers decision: Authorisation (unconditional or with conditions), suspension for further review, or prohibition.

Notification Pack Template

The Ministry’s model notification forms require the following core documents. Preparing these in advance can save weeks of back-and-forth during formal review.

Sanctions, Remedies and Enforcement Trends

The penalties for non-notification of a reportable foreign investment in Spain are severe and have become increasingly visible as enforcement capacity grows. Under the framework codified by RD 571/2023, consequences include administrative fines proportionate to the value of the transaction, the possibility of annulment of the completed transaction (requiring unwinding or divestment), and referral for criminal investigation where deliberate evasion is suspected. The screening authority may also impose interim measures, including suspension of voting rights attached to acquired shares, pending resolution of a non-compliance investigation.

The likely practical effect for deal teams is that penalties for non-notification now represent a genuine commercial risk rather than a theoretical one. Industry observers expect enforcement activity to increase through 2026 as the Investment Register becomes fully operational and cross-referencing with public registries (Registro Mercantil) becomes automated. The recommended response if non-notification is discovered post-closing is immediate voluntary disclosure to the Directorate General, combined with a standstill on integration activities until authorisation is obtained.

Practical Negotiation Checklist: Pre-Signing and Pre-Closing

For M&A lawyers Spain practitioners advising on transactions that may trigger FDI screening, merger control or both, the following checklist should be integrated into the deal process from the letter-of-intent stage:

• Pre-signing due diligence. Map the target’s sector classifications against the Article 7bis designated list. Identify any government contracts, critical-infrastructure relationships or sensitive-data processing. Confirm the investor’s ultimate beneficial ownership chain and any state-linked entities.
• Notification risk assessment. Determine whether FDI screening, merger control or both apply. If both, model parallel filing timelines and adjust the long-stop date accordingly.
• SPA conditionality. Draft dual conditions precedent (CNMC clearance + Council of Ministers authorisation). Include reverse break fees calibrated to the seller’s opportunity cost if regulatory approval fails.
• Escrow or holdback mechanics. Consider escrowing a portion of the purchase price pending final regulatory clearance, particularly where extended review is likely.
• Integration planning restrictions. Covenant against any integration steps (data migration, personnel changes, IP transfers) that could be characterised as gun-jumping before both clearances are obtained.
• Remedies and mitigation offers. Prepare a menu of potential commitments (data localisation, employment guarantees, operational ring-fencing) that can be offered proactively during the screening process to expedite authorisation.

Conclusion: Immediate Actions for Cross-Border Deal Teams

Spain’s foreign investment screening regime in 2026 is broader, more procedurally detailed and more actively enforced than at any point in its history. For M&A lawyers Spain specialists and the international deal teams they advise, the key to successful transaction execution lies in early classification, parallel-track filing strategies and robust SPA protections that allocate regulatory risk fairly between buyer and seller.

The following quick checklist summarises the essential actions:

• Classify the target’s sector against the Article 7bis designated list at the LOI stage.
• Map the investor’s ultimate beneficial ownership chain, including any state-linked entities.
• Determine whether FDI screening, merger control or both apply, and model parallel timelines.
• Engage in pre-notification discussions with the Directorate General before formal filing.
• Draft SPA conditionality to cover both regulatory tracks with appropriate long-stop dates, reverse break fees and interim covenants.
• Prepare the full notification pack using the Ministry’s model forms before signing.
• Consult the Global Law Experts lawyer directory to identify experienced cross-border M&A counsel in Spain.

Sources

1. BOE, Real Decreto-ley 1/2025 (Decree-Law 1/2025)
2. BOE, Real Decreto 571/2023 (Foreign investments)
3. Ministerio de Industria, Comercio y Turismo, Foreign investment model statements
4. European Commission, Investment screening (EU framework)
5. CMS Expert Guide, Spain FDI screening
6. White & Case, Foreign direct investment reviews 2026: Spain
7. UNCTAD Investment Policy Monitor, Spain extends FDI screening for EU/EFTA investors to 2026