On 5 November 2026, ABB confirmed that SoftBank had told it that the Office of the Working Mechanism for Foreign Investment Security Review in China had prohibited the acquisition of ABB's robotics business in China. The deal was a roughly $5.375bn enterprise-value carve-out (Silicon Republic). Neither ABB nor SoftBank has said what the full transaction's fate is, and no Chinese official has published reasons.
The reasons that have circulated come from anonymous sources. Financial Times sources, as relayed by Silicon Republic, said authorities were concerned about Chinese-made assets and data being moved to Japan to train AI models. That is unconfirmed. But it is a useful prompt to ask what legal framework China's data-localisation rules actually provide, and whether a deal veto is the right tool for the job.
The strongest case for Beijing's position
Industrial robots are not neutral boxes. Deployed in factories, they generate data on production processes, tolerances, supply chains and worker movements. A country that hosts most of a robot maker's demand could reasonably worry that this data, once aggregated and exported, becomes training material for foreign AI systems and a map of its manufacturing base. Every major economy screens investments for national-security risk, and data is a legitimate input to that analysis. Seen this way, a security review that asks where data goes is ordinary sovereign behaviour, not protectionism.
The stakes are concentrated. Silicon Republic reports that China accounts for more than 90% of demand for ABB's robotics unit, so a review in China is not a peripheral matter for the deal.
What the Cybersecurity Law actually requires
The localisation rule people usually cite is Article 37 of the Cybersecurity Law, in force since 1 June 2017. It says operators of critical information infrastructure must store personal information and important data collected and generated in mainland operations inside China. If transfer abroad is truly necessary, they must pass a security assessment under rules set by the cyberspace authority (Cybersecurity Law, Articles 37 and 79, CAC text).
That is a rule for a defined class of operators. It is not a general ban on moving industrial data. Whether a foreign robot maker's China subsidiary is a critical-infrastructure operator is not something the public record shows, and nothing published says the ABB unit was designated one.
The cross-border regime has also been loosening for ordinary businesses. The Cyberspace Administration's Provisions on Promoting and Regulating Cross-Border Data Flows, published 22 March 2024, exempt non-CII processors that transfer personal information of fewer than 100,000 individuals (excluding sensitive data) in a calendar year. They require a full security assessment only for important data, or above 1 million individuals' personal information, or 10,000 sensitive-information subjects. They also say a processor need not file important data for assessment unless regulators have notified it or published that the data is important (CAC Order No. 16). The direction of travel in 2024 was predictability for foreign business.
The gap this veto exposes
If the reported rationale is accurate, the data concern was handled not through these data rules but through the foreign investment security review. That regime was set up by the NDRC and MOFCOM measures effective 18 January 2021. It reaches any direct or indirect foreign investment that may affect national security, run through a working-mechanism office housed in the NDRC (WilmerHale summary). Its decisions come without published reasoning.
This is the core policy problem. A company can read Article 37 and the 2024 thresholds and plan compliance around them. It cannot plan around a review whose reasoning surfaces only through leaks. If data export is the real concern, then the same concern can arise in any deal where a Chinese operation holds operational data, and no published standard tells a buyer what mitigation would suffice, such as local storage, a ring-fenced data enclave or an audit regime. Reports about this deal mention a possible demand to keep some manufacturing capacity in China, but that too is anonymous-source reporting and not a stated rule.
Why proportionality matters here
Our editorial position is that security measures should be proportionate and evidence-based, and that open data flows underpin innovation. Three points follow.
- Publish the test. If robotics operational data is a security category, the regulator should say so through the important-data catalogue process the 2024 Provisions already contemplate, rather than through case-by-case prohibition.
- Prefer remedies to vetoes. Data-handling conditions, local storage and audit rights address the stated risk while leaving the investment and the jobs, tooling and technology transfer that come with it. A blanket prohibition is the bluntest option available.
- Be honest about uncertainty. We do not know that data was the deciding factor. Other reported reasons, such as manufacturing retention, may matter more, and an anonymous-source account is not a finding.
The cost of ambiguity falls on investors across borders. A rule-based localisation regime lets a firm price compliance. A discretionary one adds a risk premium that chills exactly the technology-sector cooperation that benefits Chinese manufacturers as much as foreign ones.
What to watch
Three things will show whether this is a one-off or a template: whether ABB and SoftBank disclose the full scope of the prohibition; whether Chinese authorities publish anything on the grounds; and whether regulators start to classify industrial and robotics data as "important data" under the cross-border framework. Until one of those happens, the lesson for foreign buyers of China-heavy businesses is that the written data rules and the real approval risk have come apart.