BIOSECURE Act included in Senate version of the 2026 NDAA

The 2025 BIOSECURE Act reflects a bipartisan push to reduce U.S. government reliance on biotechnology supply chains connected to foreign adversaries, especially China. If enacted, the BIOSECURE Act will bar the use of “biotechnology equipment or services” provided by “biotechnology companies of concern” in the performance of federal procurement contracts, grants, and loans.

Key aspects of the 2025 BIOSECURE Act included in the Senate version of the NDAA:

• No naming of “companies of “concern”: Unlike prior versions of the BIOSECURE legislation, the 2025 version no longer names companies directly. Instead, designation will be made through listing on a new White House Office of Management & Budget (OMB) List and through the U.S. Department of Defense “Section 1260H” list of companies determined to have ties to the Chinese military. Companies should monitor both lists and any updates.
• Prospective application: BIOSECURE’s prohibition on acquisition of “biotechnology equipment or services” from “companies of concern” under federal contracts, grants, and loans is prospective, and will apply only to such U.S. government commitments made after the BIOSECURE restrictions go into effect.
• Biotechnology equipment or services “produced or provided” under federal contracts: BIOSECURE restrictions are intended to cover down the supply chain underlying federal agreements. Whether an item or service would be restricted will depend on whether: 1) it qualifies as “biotechnology equipment or service”; or 2) the contractor “knows or has reason to believe” it is “produced or provided … in the performance” of any given contract, grant, or loan.
• The definition of “biotechnology equipment or services” is expansive: The definition is broad enough to sweep in a wide range of biologics, pharmaceuticals, and medical devices, including in vitro diagnostics (IVDs) and a wide range of products that incorporate components, software, or services—particularly those involved in genomic sequencing, data analytics, or biomanufacturing.
• Effective date: Implementation of BIOSECURE will require various steps by OMB and the Federal Acquisition Regulation (FAR) Council, for which they are allotted a period of up to three years. Ultimately, however, when BIOSECURE goes into effect will depend on how quickly OMB and the FAR Council move to implement their respective requirements.
• Five-year “grandfathering” of contractor agreements with “companies of concern”: The grandfathering provision applies to commercial agreements executed prior to the Act’s effective date. The provision permits the federal government to obtain restricted biotechnology equipment or services for five years after BIOSECURE implementation.
• Exemptions and waivers remain limited.

Below we discuss BIOSECURE’s key implications for entities that do business with the federal government.

Scope: As noted, BIOSECURE would prevent the federal government from procuring or obtaining any “biotechnology equipment or service produced or provided by a biotechnology company of concern” in the performance of “contracts,” federally funded agreements (including grants, cooperative agreements, and other transaction agreements), and loans. The restriction is quite broad. The federal government is prohibited from paying for biotechnology equipment or services from any biotechnology company of concern. Thus, prime contractors must ensure that they are not acquiring any biotechnology equipment or services from any subcontractor that would be delivered to the government. In this way, it covers the entire supply chain.

Since the initial BIOSECURE measures were introduced in the last Congress, there has been discussion about BIOSECURE’s scope being broad enough to potentially encompass federal health care programs generally (including Medicare and Medicaid), given that those programs are implemented by way of reimbursement and other agreements that could be described as “contracts.” The 2024 BIOSECURE legislation was amended to explicitly provide that covered “contracts” are limited to “any contract subject to the Federal Acquisition Regulation,” clearly excluding federal health care programs. See H.R. 8333, 118 Cong. § (k)(3). This language is retained in the 2025 BIOSECURE Act.

Key federal contracting agencies that utilize FAR contracts for the acquisition of biotechnology and pharmaceuticals include the Departments of Veterans Affairs, Defense, and Health and Human Services, including the Centers for Disease Control and the Strategic National Stockpile. These agencies also serve as sponsors for federal grants and other vehicles for research and development of biotechnology, including the National Institutes of Health, Advanced Research Projects Agency for Health, Biomedical Advanced Research and Development Authority, and Defense Advanced Research Projects Agency.

The head of an executive agency may waive the BIOSECURE prohibitions on a case-by-case basis for a period of one year and an additional period not to exceed six months. Additionally, BIOSECURE includes carve-outs for the following:

• Certain intelligence activities and national functions;
• Health care for U.S. government personnel overseas;
• The acquisition, use, or distribution of lawfully compiled, commercially or publicly available human multiomic data; and
• Certain medical products used in direct response to a public health emergency.

“Biotechnology companies of concern”: The version of BIOSECURE in the NDAA does not name companies as “biotechnology companies of concern,” as last year’s BIOSECURE legislation had. Instead, companies can be deemed “biotechnology companies of concern” by being included on one of two Federal government listings:

• The list of Chinese military companies operating in the United States pursuant to section 1260H of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (“Section 1260H List”). The list is maintained by the Department of Defense, updated annually, and published in the Federal Register. This list currently includes the BGI Group (BGI Genomics, Forensic Genomics International, and MGI Tech), but it does not include WuXi Biologics or WuXi Apptec, both of which had been named in 2024 BIOSECURE measures.
• A list that the Director of the OMB is required (per BIOSECURE) to compile and publish in consultation with various federal agencies. This “OMB List” is required to be updated annually, with the first publication taking place within one year after the date of enactment of BIOSECURE. Companies on this list would be entitled to advance notice and due process rights, which include an opportunity to object to the listing before the OMB List is published.

“Biotechnology equipment or service” is defined as follows:

(A) equipment, including genetic sequencers, or any other instrument, apparatus, machine, or device, including components and accessories thereof, that is designed for use in the research, development, production, or analysis of biological materials as well as any software, firmware, or other digital components that are specifically designed for use in, and necessary for the operation of, such equipment;

(B) any service for the research, development, production, analysis, detection, or provision of information, including data storage and transmission related to biological materials, including—

(i) advising, consulting, or support services with respect to the use or implementation of an instrument, apparatus, machine, or device described in subparagraph (A); and

(ii) disease detection, genealogical information, and related services; and

(C) any other service, instrument, apparatus, machine, component, accessory, device, software, or firmware that is designed for use in the research, development, production, or analysis of biological materials that the Director of the Office of Management and Budget, in consultation with the heads of executive agencies, as determined appropriate by the Director of the Office of Management and Budget, determines appropriate in the interest of national security.

OMB is authorized, in consultation with other agencies, to expand this definition for national security reasons.

BIOSECURE implementation date: If enacted, when BIOSECURE will be implemented will depend in part on how quickly OMB and the FAR Council accomplish their respective requirements. OMB has up to one year to publish its list of companies of concern and up to an additional 180 days to issue implementation guidance. The FAR Council is allotted up to one year to revise the FAR accordingly. The Act's prohibitions will then take effect 60 days after the FAR revision for companies on the Section 1260H List and 180 days after FAR revision for those on the OMB List. 

Prospective application + grandfathering: Should BIOSECURE be enacted, its prohibition on biotechnology equipment or services being produced or provided in the performance of Federal contracts, grants, and loans will apply prospectively to new federal contracts, grants, and loans once BIOSECURE becomes effective. However, BIOSECURE contains a grandfathering provision that would allow existing commercial agreements between biotechnology companies of concern and federal commercial contractors (in contrast to government agencies) to continue for a period of five years in support of federal contracts, grants, and loans, so long as such commercial agreements were executed prior to FAR implementation of BIOSECURE.  This provision, which in earlier drafts had only applied to companies listed on the OMB list, was revised to extend the five-year grandfathering to companies on the 1260H list.

As a practical matter, as written, the grandfathering provision permits companies with “pre-existing” contracts with companies of concern (executed prior to the effective date of BIOSECURE) to  continue to provide the federal government with biotechnology equipment or services under federal contract or grant for a period of five years, which can result in application of grandfathering for a period of time under contracts awarded after BIOSECURE goes into effect. In this way, the grandfathering period allows additional time for companies to transition to make alternative arrangements with contract development and manufacturing organization (CDMOs).   

Given the complexity of switching CDMOs, companies should anticipate substantial lead time will be needed to transition to an alternative CDMO. Under FDA regulations, sponsors must report manufacturing changes and obtain prior approval for any change that could adversely affect product safety or efficacy. Switching to a new CDMO often involves changes to and qualification of equipment, facilities, and personnel. Typically, these changes require a prior approval supplement or amendments to an investigational new drug application for drugs, or a PMA supplement, a new 510(k), or amendments to an investigational drug exemption for devices—triggering significant FDA review timelines that can extend beyond standard goal dates due to inspection issues, major amendments, technology transfer delays, or reductions in force at FDA.      

Impact on life sciences companies: BIOSECURE could well affect pharmaceutical, biotechnology, and medical device companies that obtain biotechnology equipment or services from companies of concern in terms of the loss of future federal procurement contracts, grants, or loans.  Companies will be well-served to closely monitor the 1260H and OMB lists and to determine whether federal contract performance or specific deliverables involve “biotechnology equipment or services.” To avoid BIOSECURE restrictions, companies could seek to revisit terms with existing CDMO partners and identify alternative CDMO partners that are not classified as biotechnology companies of concern and that would not be expected to be so classified in the future. In short, companies operating in the sector can benefit from assessment of their supply chains and federal funding exposure to determine whether the BIOSECURE framework presents compliance risks.

It is also at least conceivable that—beyond the loss of future contracts and grants—there could be broader implications in terms of the scope of BIOSECURE's impact on pharmaceutical and biotechnology companies. It is possible, for example, that failure to offer “BIOSECURE-compliant” product for procurement on government-wide Federal Supply Schedule (FSS) contracts could be found to impact compliance with other statutory requirements (e.g., the Veterans Health Care Act of 1992¹). This could ultimately restrict the ability of federal agencies to purchase product and pose an obstacle to payment with federal funds under the federal health care programs, including Medicaid and Medicare Part B.² But the chances of this happening are quite slim, and there would be opportunities to challenge, and potentially, to block this action. It is also possible that implementing regulations could define BIOSECURE's restriction on “provid[ing]” biotechnology equipment or services “in the performance” of a contract narrowly to effectively limit BIOSECURE's scope.

Next steps for the BIOSECURE Act: In terms of next steps, the House and Senate will go to conference (whether formally or informally) to reconcile the competing versions of the NDAA. During conference, the House and Senate conferees may decide to include the operative version of BIOSECURE in the NDAA conference report (the version that is signed by the President into law). The text could be revised or even removed in conference. Given that the BIOSECURE Act passed the House in the 118th Congress, and that prior Senate opposition appears to have given way to permitting its inclusion in the recently passed Senate NDAA, it is likely that the BIOSECURE Act may be adopted into law this year, absent any groundswell of opposition from stakeholders. Should such opposition arise, there could still be an opportunity to strip the measure from the NDAA before it is passed.

We will continue to monitor the NDAA process closely and provide updates as the legislation progresses through Congress. We would be pleased to assist in engaging with lawmakers, evaluating your organization's exposure, or preparing a compliance roadmap.

Authored by Joy Sturm, Mike Druckman, Cybil Roehrenbeck, Allison Pugsley, Ashley Grey, and Ashley Ruhe