Economic Security Rules Now Decide How You Enter a Market

TL;DR: Investment screening, outbound investment rules and procurement exclusions now work as one family of economic security rules, and all of them ask who ultimately controls a company. The answer changes which route into a market is cheapest, and the rules on both sides are still being written.

Key takeaways:

• Since 30 June 2025, Chinese-origin suppliers cannot win EU public tenders for medical devices worth 5 million euros or more, and Chinese content in a winning bid is capped at 50 percent of contract value.
• China answered on 6 July 2025 by barring EU firms from government medical device purchases above 45 million yuan, while exempting European companies that manufacture in China.
• From 17 January 2028 every EU member state must screen foreign investment in a common list of sectors, and EU subsidiaries controlled from outside the EU are caught too.
• The US COINS Act, signed on 18 December 2025, extends outbound investment rules to hypersonics and high-performance computing and gives Treasury about 450 days to write the new regulations.

A Netherlands-registered company with one employee won a French hospital group's lot for laparoscopic surgery robots, offering a robot made in China.[^1][^2] On 22 July 2026 a Lyon judge annulled the award. The judge did not find the company Chinese, but held that the buyer, UniHA, had to check whether it had real business operations in the Netherlands and who held dominant influence over it, and had not done so.[^2] That check now sits inside an ordinary hospital tender because of a rule written in Brussels about China.

Three Gates on the Same Deal

Economic security, in the sense governments now use the term, is the set of rules a state uses to decide who may own, fund or sell to the parts of its economy it treats as strategic. Three of those rules now reach ordinary commercial decisions.

• Selling to the state. Commission Implementing Regulation (EU) 2025/1197, in force since 30 June 2025, excludes Chinese-origin suppliers from EU medical device tenders of 5 million euros or more, net of VAT, and caps Chinese-origin devices at 50 percent of contract value for everyone else.[^4][^5] Tenders below the threshold make up about 96 percent of procedures but only about 41 percent of value, so the measure reaches most of the money.[^5]
• Being bought. Regulation (EU) 2026/1386, published on 26 June 2026, requires all 27 member states to screen foreign acquisitions in defence, dual-use goods, critical technologies, critical raw materials, critical infrastructure, electoral systems and parts of financial market infrastructure, with full effect from 17 January 2028.[^7][^8] An initial review runs 45 days and an in-depth review has no fixed deadline.[^7][^8]
• Investing abroad. The COINS Act, part of the FY2026 defence authorisation law signed on 18 December 2025, writes the Treasury outbound programme that began on 2 January 2025 into statute. It adds hypersonics and high-performance computing to semiconductors, quantum and AI, and names Cuba, Iran, North Korea, Russia and Maduro's Venezuela alongside China.[^9][^10] The EU has asked member states to review outbound deals in semiconductors, AI and quantum completed since 1 January 2021, with a full report due by 30 June 2026.[^11]
• The look-through test. The procurement and screening rules both look past the legal entity. Under the procurement rule, a company without substantive operations where it is registered takes the origin of whoever holds dominant influence over it, presumed from majority capital, votes or board appointments.[^3] The new screening regulation looks through to the ultimate controller, so an EU acquisition vehicle does not avoid a filing.[^7][^8]

The Exemption Tells You Where the Policy Points

What the record shows: both sides of the medical device dispute wrote their rules so that local production escapes them. China's 6 July 2025 notice bars EU firms from government purchases above 45 million yuan but exempts European companies that have invested and manufacture in China.[^6] The EU rule treats a company registered and substantively operating in a country as originating there, which is why the Lyon case turned on whether a one-employee Dutch firm had real operations at all.[^1][^3]

What we infer: the exemptions are the most useful part of each rule to read, because they show what the government wants a foreign supplier to do. Here both want a factory, not a shipment. Exporting into the other side's public market has become the expensive route, and a supplier that sets up a thin local entity to keep exporting now risks a court annulling the award.[^1][^2]

The local route has its own gate, which depends on how a company gets there. Buying an existing EU business in a covered sector means a filing, a 45-day first review and possibly a longer second phase. Regulators can also call in deals that did not need a filing for at least 15 months and up to five years after completion.[^7] Greenfield projects fall outside the EU's mandatory scope, although member states may still screen them nationally.[^7][^8] For a US company the question runs the other way: building or funding a plant in China in a covered technology can fall under the outbound rules before a host-country rule ever applies.[^9]

What we recommend: treat the exemption clause as the starting point of any market entry case in a sector a government calls strategic, then cost each route against the gate it triggers. This is where geopolitical risk enters the spreadsheet, as a filing timeline and a set of eligibility rules rather than a country score.

What Economic Security Rules Do to the Entry Case

A board paper for entry into a strategic sector should run each route against these rules separately.

1. Export and bid. Check whether the target market has a procurement exclusion or a mirror measure, and what origin test it uses. In EU medical devices, Chinese-origin bidders are out above 5 million euros, and in China, EU firms that do not manufacture there are out above 45 million yuan.¹²
2. Acquire a local company. Price in a screening filing, an open-ended second phase and call-in exposure for years after closing, from 17 January 2028 in every EU member state.³
3. Build greenfield. This route escapes the EU's mandatory screening scope today.³ For a US parent investing in China in semiconductors, quantum, AI, hypersonics or high-performance computing, it may need notification or be prohibited outright under the outbound rules.⁴⁵
4. Take a minority stake. Look at control rights as well as percentages. Majority voting rights or the power to appoint most of the board can decide a company's origin for procurement when it lacks substantive operations of its own.⁶

Two changes sit ahead of any plan made now. Treasury's new outbound regulations are due within 450 days of enactment, around March 2027, and the current programme stays in force until then.⁴⁵ On 3 December 2025 the Commission also said it would bring in European preference criteria for public procurement in certain strategic sectors.⁷ The entry case needs a review date tied to each. The fragmentation piece prices the wider split, the platform ban ladder shows how access is withdrawn in stages, and the technology sector page covers the sectors both outbound regimes target.

Fortius Intel note: The open question is whether the EU's planned European preference criteria will define "European" the way the procurement instrument does, by where a supplier operates, or the way the screening regulation does, by who ultimately controls it. The answer decides whether a Chinese-owned factory inside the EU counts as a local bidder, and any company planning an EU plant to win public contracts should know which test it will face before it commits capital.

Methodology: this analysis draws on the IPI regulation text, legal analysis from Dechert, White & Case, Baker McKenzie, CMS, Paul Weiss, Cuatrecasas, Debevoise, A&O Shearman, Akin Gump, Noerr, Covington and Osborne Clarke, and reporting from DeviceMed, the Associated Press and China Daily. Each dated fact was checked against a second independent source where one exists.

---

Footnotes

1. White & Case, "EU imposes first International Procurement Instrument measure restricting Chinese access to medical devices procurement," June 2025, https://www.whitecase.com/insight-alert/eu-imposes-first-international-procurement-instrument-measure-restricting-chinese (retrieved 23 October 2026). Source for: Commission Implementing Regulation (EU) 2025/1197 of 19 June 2025, effective 30 June 2025; the exclusion of PRC-origin economic operators from tenders of 5 million euros or more net of VAT across all medical device CPV codes; the 50 percent cap on Chinese-origin devices as a share of contract value; the threshold covering about 59 percent of EU medical device procurement by value; and the investigation opened on 24 April 2024 and concluded on 14 January 2025. ↩

2. Associated Press, "China retaliates against EU with a ban on European medical devices," 6 July 2025, https://www.clickondetroit.com/business/2025/07/06/china-retaliates-against-eu-with-a-ban-on-european-medical-devices/, and China Daily, "Steps taken against EU medical device curbs," 7 July 2025, https://epaper.chinadaily.com.cn/a/202507/07/WS686b0332a31072f9198f3b84.html (both retrieved 23 October 2026). Source for: China's Ministry of Finance notice of 6 July 2025 excluding EU companies from government medical device procurement with budgets above 45 million yuan; and the exemption for EU-invested companies that manufacture in China. ↩

3. Paul, Weiss, "The New EU FDI Screening Regulation: Key Dates Now Known," 1 July 2026, https://www.paulweiss.com/insights/client-memos/the-new-eu-fdi-screening-regulation-key-dates-now-known, and Cuatrecasas, "New EU Regulation on the screening of foreign investments," 2026, https://www.cuatrecasas.com/en/global/competition-eu-law/art/new-regulation-eu-screening-foreign-investments (both retrieved 23 October 2026). Source for: Regulation (EU) 2026/1386 of 17 June 2026, published in the Official Journal on 26 June 2026 and fully applicable from 17 January 2028; mandatory screening in all 27 member states; the mandatory sectors; filing obligations looking through to the ultimate controller so that an EU acquisition vehicle does not avoid notification; greenfield investments falling outside the mandatory scope; the 45-day initial review; and call-in powers for non-notifiable deals of at least 15 months and up to five years after completion. ↩ ↩²

4. Baker McKenzie, "President Trump Signs COINS Act Codifying and Expanding Outbound Investment Regulations," 19 January 2026, https://foreigninvestment.bakermckenzie.com/2026/01/19/president-trump-signs-coins-act-codifying-and-expanding-outbound-investment-regulations/ (retrieved 23 October 2026). Source for: the COINS Act signed on 18 December 2025 within the FY2026 National Defense Authorization Act; its codification of the Outbound Investment Security Program in effect since 2 January 2025; the countries of concern; the addition of hypersonic systems and high-performance computing and supercomputing to semiconductors, quantum and AI; and the 450-day deadline for Treasury regulations, around March 2027, with the existing programme in force until then. ↩ ↩²

5. Akin Gump, "President Signs New Outbound Investment Law," December 2025, https://www.akingump.com/en/insights/alerts/president-signs-new-outbound-investment-law (retrieved 23 October 2026). Source for: cross-check of the 18 December 2025 signing date, the list of countries of concern, the new technology sectors, the 450-day rulemaking deadline and the existing programme remaining in effect until Treasury issues implementing regulations. ↩ ↩²

6. Regulation (EU) 2022/1031 of the European Parliament and of the Council of 23 June 2022 (International Procurement Instrument), Article 3(1)(b) and second subparagraph, as reproduced at https://lawplayer.com/eu/act/32022R1031 (retrieved 23 October 2026). Source for: the origin of a legal person being the country under whose laws it is constituted and in which it has substantive business operations; the fallback to the origin of persons exercising dominant influence; and the presumption of dominant influence from majority capital, majority votes or the power to appoint more than half of the board. ↩

7. Covington & Burling, Global Policy Watch, "Strengthening EU Economic Security: More of the Same or a New Approach?," December 2025, https://www.globalpolicywatch.com/2025/12/strengthening-eu-economic-security-more-of-the-same-or-a-new-approach/, and Osborne Clarke, "New EU economic security roadmap resets the bar for foreign investment in Europe," December 2025, https://www.osborneclarke.com/insights/new-eu-economic-security-roadmap-resets-bar-foreign-investment-europe (both retrieved 23 October 2026). Source for: the Commission and High Representative's joint communication on economic security of 3 December 2025, and its plan to introduce European preference criteria in public procurement for certain strategic sectors. ↩