Trade Controls, Foreign Investment and National Security: New Regimes and Continuing Changes for 2026

In 2026, boards of directors will continue to navigate a shifting U.S. regulatory environment shaped by an assertive and transactional approach to trade and national security.

Uncertainty surrounding the most significant U.S. trade development in decades continues into the new year as the U.S. Supreme Court is expected to rule in the coming weeks on the validity of the “reciprocal tariffs” imposed by the second Trump administration against most U.S. trading partners.

Beyond tariffs, 2025 included the introduction of new regulatory regimes restricting U.S. outbound investment and cross-border data flows involving China and other so-called “countries of concern,” while the sanctions and export control environment intensified in late 2025, with the introduction (and subsequent one-year suspension) of the “Affiliates Rule” and sanctions against Russian oil producers Rosneft and Lukoil. Taken together, these developments may require companies and their boards of directors in 2026 to fundamentally reassess supply chain and investment strategies, compliance architectures and vendor relationships.

Evolving U.S. Tariff Landscape

At the start of the second Trump administration, the U.S. government enacted sweeping tariffs on a significant portion of imports entering the United States. These measures included an initial reciprocal tariff framework supplemented by targeted country-specific escalations. Although the most expansive of these tariffs—the so-called “reciprocal tariffs”—are expected by many to be overturned by the Supreme Court in early 2026, President Trump and senior members of his administration have signaled their commitment to an expansive tariff agenda, potentially relying on alternative legal authorities to reinstate any tariffs that may be overturned. Concurrently, the Trump administration has continued to advance tariffs under more conventional statutory authorities, a practice expected to continue into 2026.

In addition, the U.S.-Mexico-Canada Agreement (USMCA) requires the three countries to review the agreement by July 1, 2026. How the review will unfold is uncertain, but the U.S. Trade Representative (USTR) reported to Congress that “a rubberstamp of the Agreement is not in the national interest” and that the USTR would consider both bilateral and trilateral arrangements to address a list of Trump administration concerns, including rules of origin, critical minerals and economic security alignment.[1]

In light of the above, boards may consider assessing exposure to potential changes in tariffs across key products, suppliers and markets, as well as mitigation strategies such as supply-chain diversification, tariff evaluations, supplier negotiations, cost reductions, exclusion requests and use of foreign trade zones.

Inbound and Outbound Investment Restrictions

In February 2025, President Trump issued the America First Investment Policy, which set forth a policy to “cease the use of overly bureaucratic, complex, and open-ended ‘mitigation’ agreements” in reviews conducted by the Committee on Foreign Investment in the United States (CFIUS). The Trump administration also has advanced a new expedited “fast-track” process for investments from certain investors in allied countries. CFIUS currently is conducting a pilot program for the fast-tack process by using a “Known Investor Portal” to gather information and reduce filing burdens for low-risk, repeat investors. Furthermore, CFIUS has demonstrated a willingness to revisit the need for existing mitigation agreements, which could provide investors from allied countries with an opportunity to terminate or restructure costly mitigation compliance obligations.

As of January 2025, U.S. persons are now subject to the U.S. Outbound Investment Security Program (OISP), which prohibits or requires notification of certain types of outbound investments by U.S. persons into entities with links to specified semiconductor, AI or quantum computing activities in China, Hong Kong or Macau. The 2026 National Defense Authorization Act (2026 NDAA), signed into law in December 2025, provides a statutory basis for the regime and directs the U.S. Department of the Treasury to issue new rules, subject to notice and comment, including a few notable changes such as the addition of certain targeted countries (Cuba, Iran, North Korea, Russia and Venezuela “under the regime of Nicolas Maduro”[2]) and activities (high-performance computing / supercomputing and hypersonic systems).

Sanctions and Export Controls

The latter half of 2025 saw a resurgence of sanctions activity. In July, comprehensive territory-wide sanctions against Syria were formally terminated, followed by the repeal of remaining broad-based secondary sanctions against Syria with the passage of the 2026 NDAA. In October, the United States imposed sanctions on major Russian oil producers Rosneft and Lukoil, marking one of the most significant escalations in energy sector sanctions since the start of the war in Ukraine. Later that month, the United States sanctioned the President of Colombia, Gustavo Petro and certain of his associates. Notwithstanding the recent removal of Nicolás Maduro, U.S. sanctions against Venezuela should be expected to remain in effect in the near future until the U.S. government determines how to move forward given recent developments. Boards of companies with touchpoints in Latin America or the energy sector should continue to closely monitor the U.S. sanctions posture against Venezuela, Cuba and other Latin American countries.

In September, U.S. export controls administered by the U.S. Department of Commerce, Bureau of Industry and Security (BIS) were significantly, albeit temporarily, reshaped by the introduction of the “Affiliates Rule,” which expanded the application of the Entity List and Military End-User List restrictions to foreign entities that are 50% or more owned by such listed entities. However, following negotiations with China, the White House announced that it would suspend implementation of the Affiliates Rules until November 10, 2026. Boards of directors should anticipate continued evolution in both the sanctions and export controls landscape, particularly as U.S.-China trade negotiations continue and other geopolitical tensions persist.

Bulk Data Restrictions

In December 2024, the U.S. Department of Justice (DOJ) issued, as part of a new Data Security Program, a final rule implementing a new regulatory program designed to prevent certain countries (China, Cuba, Iran, North Korea, Russia and Venezuela) and related foreign entities and individuals from having access to Americans’ bulk sensitive personal data and U.S. government-related data (the Bulk Data Rule). The rule restricts, and in some cases prohibits, U.S. persons from engaging in “covered data transactions,” which include transactions that involve any access by a country of concern or covered person to any bulk U.S. sensitive personal data or government-related data and that involve data brokerage or certain types of agreements. Unlike regulations such as HIPAA, the Bulk Data Rule does not contain a consent exemption or individual opt-out mechanism. After a period of limited enforcement concluded on July 8, 2025, regulators now expect individuals and entities to be in full compliance with the Bulk Data Rule.

Boards of companies possessing data potentially implicated by the Bulk Data Rule should ensure that contracts and other arrangements with service providers, cloud vendors, business partners, employees and other parties are assessed by management for potential data flows to countries of concern. To the extent they have not already done so, affected companies should develop an appropriate compliance program including cybersecurity protocols and recordkeeping procedures to facilitate compliance with the Bulk Data Rule.

[1] Ambassador Jamieson Greer, USTR, “Opening Statement for House Ways and Means and Senate Finance Committees” (December 16‑17, 2025), available here.

[2] Although Nicolás Maduro has since been removed from power (discussed in greater detail below), the situation in Venezuela remains fluid and it remains to be seen how Treasury will implement this provision.