On 5 November 2026, ABB said it had been informed by SoftBank that the "Office of the Working Mechanism for Foreign Investment Security Review in China" had prohibited SoftBank's acquisition of ABB's robotics business in China. The wider global deal carried an enterprise value of $5.375bn, according to Silicon Republic's report of ABB's statement. The Financial Times, citing sources, reported that Beijing was concerned about China-developed assets moving to a Japanese owner and about robot-operations data leaving the country, including for AI model training. Beijing has not published its reasoning, so those motives are reported, not confirmed.
The strongest case for Beijing
A security regulator has a serious argument here. A robot fleet in a factory generates detailed records of production layouts, process parameters, supplier relationships and failure modes. Aggregated across thousands of installations, that is a map of a national manufacturing base. An AI model trained on it could be valuable to a competitor or a hostile state. China is also ABB Robotics' largest market, accounting for more than 90% of its demand per the same report, so any control question is a question about Chinese factory floors. Every large economy treats some data and some assets as strategic. Governments in the US, EU and elsewhere also block or condition foreign deals on data grounds.
A different legal route
What is new is the instrument. China's cross-border data regime has been run mainly by the Cyberspace Administration of China (CAC). Its Provisions on Promoting and Regulating Cross-Border Data Flows, published 22 March 2024 and effective on publication, set explicit tiers:
- Non-critical-infrastructure processors that have sent personal information of fewer than 100,000 individuals abroad since 1 January (excluding sensitive information) need no assessment, standard contract or certification.
- Those sending 100,000 to under 1 million individuals' data must sign a standard contract or obtain certification.
- Transfers of important data, or of 1 million or more individuals' personal information (10,000 or more for sensitive information), trigger a security assessment.
The tiers have a stated logic, and companies can read them and plan around them.
The ABB decision did not come through that route. The Measures for Security Review of Foreign Investment, issued by the National Development and Reform Commission (NDRC) and the Ministry of Commerce as Order No. 37 and effective 18 January 2021, apply to foreign investment that "affects or may affect national security." Article 3 puts the review office inside the NDRC, led jointly by the NDRC and MOFCOM. Article 4 lists covered sectors, including important information technology and internet products and services, where the investor obtains actual control. The measures define actual control as more than 50% of equity, or enough voting rights to materially influence board or shareholder resolutions, or other material influence over operations, personnel, finance or technology.
The Data Security Law, adopted 10 June 2021 and effective 1 September 2021, supplies the link. Article 24 establishes a data security review for processing activities that affect or may affect national security, and says decisions made under it are final. Article 31 leaves exit rules for important data to the CAC and other departments.
Why the route matters
This is an inference from the published texts, not a finding about how this specific case was decided. A CAC data-export filing asks whether a defined data transfer meets published thresholds. A foreign-investment security review asks whether a transaction may affect national security, and that standard is open-ended. The review's outcome can be a prohibition, and under Article 24 of the Data Security Law a data security review decision is final. If the reported reasoning is accurate, robot-operations data and the assets that generate it have been folded into the security review as a ground for blocking a deal. Neither the 2024 data-flow provisions nor the 2021 measures say so on their face.
That has three consequences.
Predictability falls. The 2024 CAC provisions were a deliberate loosening, with thresholds that let most routine corporate transfers proceed without a filing. A deal-level veto based on data and asset concerns sits outside that framework. A multinational cannot read a threshold table to learn whether its China operations carry data that a security reviewer will regard as strategic.
Divestments get harder. Global manufacturers have been restructuring their China exposure. If an exit buyer from a third country can be blocked because the business's data or know-how is considered a national asset, the exit costs rise. That raises the price of entering China in the first place.
The AI-training framing is broad. Reported concern that operations data could feed overseas model training can describe almost any industrial data. A restriction that wide, applied case by case, becomes a general power over foreign ownership of Chinese industrial businesses.
A proportionate alternative
Security interests can be protected with narrower tools. Authorities can publish what categories of industrial data they consider sensitive, as the CAC regime already attempts for important data. They can approve a deal with conditions, such as local data storage, access controls, and audited limits on model training, instead of prohibiting it. They can give a written rationale that other firms can learn from. Open data flows are the basis of the global robotics and AI industries, and restrictions work best when they are specific, narrow and explained. A blanket veto does little to protect data that conditions and audits could protect, and it teaches investors to treat China's sophisticated, partly liberalised data regime as a facade.
The prohibition also shows the limits of what we know. The review office has not published reasoning, and the specific data and asset concerns come from sources quoted by the FT. Observers should avoid treating one blocked deal as proof of a new doctrine. But the incentive for other regulators is plain: if a foreign-investment screen can double as a data-localisation tool, others may copy it. The better lesson for governments is to keep security reviews tied to named risks and published criteria.