Who is really behind your research partner?

What MI5’s warning establishes

The alert calls for immediate review of ongoing or planned CGTRI collaborations and advises academics collaborating with Chinese institutions to establish the ultimate funding source. It recommends independent legal advice for institutions or individuals continuing research ultimately funded by CGTRI.

This is a specific warning about research funding. It does not establish that every contributor acted knowingly or that Chinese researchers generally pose a threat.

Follow the value your collaboration creates

For business leaders, our wider lesson applies wherever teams co-develop a product, commission specialist research, or run a pilot with a university or technology partner. These relationships can involve unreleased designs, proprietary software, test data, or access to the people who understand how a product works. Reviewing the organisation signing the agreement is a starting point; also establish who else can receive or use your contribution.

Consider what your team can teach a partner through interpreting results or explaining why an experiment failed. The value may lie in judgement developed over years. A completed report is only one output; a collaborator may also gain the ability to reproduce a method, avoid costly mistakes, or develop a competing capability.

The commercial question is what the organisation could lose control of. A method shared beyond its agreed purpose could help another party develop a competing capability. Unclear rights to use the results could also leave your own investment difficult to exploit. Identifying these questions early helps leaders negotiate a collaboration whose benefits and boundaries they understand.

International collaboration brings expertise and opportunities that businesses need. The National Protective Security Authority’s Trusted Research programme supports secure collaboration. The management task is to understand the relationship well enough to agree appropriate boundaries.

Make research partner due diligence proportionate

UK Research and Innovation’s principles and expectations, published on 13 June 2025, call for appropriate partner checks, understanding ownership and affiliations, and formal agreements governing data and intellectual property. They apply to organisations UKRI supports; they are not a blanket legal obligation on every business. They offer a useful reference for wider commercial practice.

Our recommended approach starts with the contribution’s sensitivity. Discussing already published findings may justify modest checks. Sharing unreleased designs, source code, valuable methods, or sensitive datasets calls for closer scrutiny. Agree access in stages, so an initial discussion need not authorise everything the full project might eventually require.

Ask for evidence suited to the project: the partner’s legal identity and ownership, relevant funding or sponsorship records, named project participants, and written terms covering recipients and use of the work. Check important details against independent records where available. A familiar introduction is useful context; it does not answer all those questions.

Record the checks, unresolved questions, agreed limits, and person authorised to accept the remaining risk. A sales or research lead should have a clear route to request a decision rather than having to judge a national-security concern alone. A senior security adviser can help connect that decision with the organisation’s existing risk processes.

Give staff a useful route to raise concerns

People closest to a project may notice an unexplained participant, an unexpected request, or a change of purpose first. Make it clear whom they can contact and what information will help: the proposed contribution, people involved, funding details, and reason the request seems different.

Practical human risk awareness should help people make these decisions and ask for support. A person who reports a concern should receive a considered response, including whether work can continue within narrower limits while the question is resolved. Apply the review to the project’s facts, funding, access, and intended use; nationality alone is not an adequate assessment.

For research institutions, the government’s Research Collaboration Advice Team provides advice on national-security risks in international research. Obtain independent legal advice where the facts raise legal questions; an internal checklist cannot settle them.

Five questions to put beside the proposal

1. Who is behind the relationship?Identify the partner, relevant owners, ultimate funder, and any intermediary. Record what remains unverified.
2. What exactly are we contributing?Name the information, expertise, facilities, and access involved. Explain their commercial sensitivity.
3. Who can use the results, and how?Clarify recipients, onward sharing, publication, and rights to reuse or develop the work, including after the project ends.
4. Who approves the boundaries?Agree permitted access, its duration, the decision owner, and the route for security or legal questions.
5. What would trigger another review?Include changes to funding, participants, scope, requested access, or intended use.

Choose one important collaboration and see whether its file answers those questions. Turn the review into a recorded decision: proceed within agreed limits, seek clarification before granting additional access, or decline the proposed arrangement. Name the owner and the next review point.

At project close, review accounts and shared workspaces, and remove access that is no longer required. Confirm how any continuing rights to retain or use information will be managed under the agreement. The depth of review should reflect your project and circumstances.

CyberSolace can help leadership teams review how partnership decisions, information access, and human risk awareness support the protection of valuable expertise.