BIOSECURE Act Update

Read the Japanese version.

The BIOSECURE Act, which restricts the ability of U.S. executive agencies to contract with “Biotechnology Companies of Concern,” is now law. First introduced in the 2023-2024 legislative session and nearly passed into law last year, the BIOSECURE Act was included in the FY 2026 National Defense Authorization Act (FY 2026 NDAA), which the President signed on December 18, 2025. The BIOSECURE Act is expected to have significant impacts on the biotech industry supply chain, with the potential loss of federal dollars substantial enough to force compliance.  

Legislative History

Despite strong support, the BIOSECURE Act failed to pass during the 2023-2024 legislative session, due in part to concerns about the adequacy of due process for targeted companies.[1]In fact, the bill actually became part of the near-final FY 2025 NDAA but was cut at the last minute.

However, in July 2025, Senator Bill Hagerty proposed an amendment to the Senate’s version of the FY 2026 NDAA that revived the BIOSECURE Act, with a version largely based on the previous, unsuccessful bill.[2] Although the Senate passed a version of the FY 2026 NDAA that included this BIOSECURE Act in October 2025, the House version did not include the bill, and therefore its fate depended on how the reconciliation process would unfold.

On December 7, 2025, the final reconciled FY 2026 NDAA was released, and it included a revised version of the BIOSECURE Act that the Senate passed in October 2025.[3] While the core elements of the Act remained intact, the reconciled version incorporated a number of adjustments that were more favorable to industry.

Note: For a more detailed legislative history, please refer to our previous blog post on the topic.

What’s Stayed the Same

Across all iterations of the BIOSECURE Act, its core element has remained unchanged: U.S. executive agencies are prohibited from contracting with or funding companies that are designated “Biotechnology Companies of Concern.” The reconciled BIOSECURE definition of “Biotechnology Company of Concern” includes both (A) entities on the Department of Defense’s section 1260H list of Chinese military companies operating in the United States and (B) entities that will be named through a process headed by the Office of Management and Budget (OMB).

Key Differences

While largely similar, the reconciled version includes industry-friendly changes that have slightly softened the potential impact of the BIOSECURE Act:

• Stricter knowledge requirement for violations means less onerous compliance burden for contractors

The Senate version prohibited executive agencies from contracting with any entity that “enters into any contract the performance of which such entity knows or has reason to believe will require, in performance of the contract with the executive agency, the use of biotechnology equipment or services produced or provided by a biotechnology company of concern.” The reconciled version of the BIOSECURE Act drops this “has reason to believe” requirement, thereby alleviating compliance burdens for companies that rely on large procurement networks that they might not have full control over, or potential downstream transactions of which they are unaware.

• Protections for drug access and pricing

The reconciled version of the Act includes a new section titled “Compliance with Limitation on Drug Prices.” Under this provision, a manufacturer will not lose eligibility for federal rebate agreements (including those under Medicaid and Medicare Part B) solely because BIOSECURE restrictions prevent them from entering into or maintaining a VA Federal Supply Schedule contract. This addresses a key concern that the BIOSECURE Act would have unintended consequences on drug pricing.

The reconciled version also clarifies provisions meant to protect access to healthcare for U.S. employees, service members, and their beneficiaries living abroad.

• “Affiliates” of named Biotechnology Companies of Concern are no longer automatically covered

The Senate version included in the definition of a Biotechnology Company of Concern “any subsidiary, parent, affiliate, or successor of an entity [named a Biotechnology Company of Concern].” However, the reconciled version drops affiliates from this definition.

Key Takeaways of the BIOSECURE Act

A primary implication of the BIOSECURE Act is that using equipment or services—such as outsourcing the manufacturing of a drug substance or active pharmaceutical ingredient (API) for a pharmaceutical product—from a Biotechnology Company of Concern could render that product ineligible for sale to U.S. executive agencies.

The Act also has implications for pharmaceutical companies relying on U.S. federal grants to support drug research and development. These companies will need to structure funded projects so that federal dollars are not directed to Biotechnology Companies of Concern. In addition, companies seeking reimbursement for past expenses must be ready to certify in their grant applications that the costs at issue did not involve payments to any such companies.

To limit disruptions across the industry, the Act’s requirements will be implemented over time and include transition periods, grandfathering provisions, and targeted exemptions. Under the statute, OMB must publish the initial list of Biotechnology Companies of Concern within one year of enactment, supplementing the existing 1260H list. OMB then has 180 days to issue implementing guidance. Within one year after that guidance, the FAR Council must revise the Federal Acquisition Regulation, with the new requirements applying to contracts and awards issued 60–90 days afterward.

While it is theoretically possible that enforcement could begin as early as 2026, it is far more likely that OMB and the FAR Council will take the majority of their statutorily allotted time to issue the list, guidance, and regulation. At a maximum, BIOSECURE’s restrictions for 1260H list companies will be effective 970 days (about 2 years and 8 months) after enactment, with restrictions for OMB list entities following 30 days after that.

The Act also provides a five-year transition period for existing contracts, grants, and loans—except for those involving companies already on the 1260H list, for which restrictions take effect 60 days after the FAR is updated. Although the rollout is staged, the planning window remains tight, particularly for organizations with multi-year agreements already underway.   

See below for a visual summary of these compliance timeframes.

Next Steps

Impacted companies should begin preparing now to ensure compliance. Here are some steps companies can take:

• Begin mapping exposure to existing entities on the 1260H list and suppliers that may be designated through the OMB process.
• Update mergers and acquisitions, licensing, and investment due diligence questions to directly include BIOSECURE Act risk questions.
• Closely monitor forthcoming OMB, FAR, and other federal guidance, as OMB’s designation list will be pivotal, the FAR revisions will shape the compliance framework, and agencies such as the National Institutes of Health, Department of Defense, National Science Foundation, Centers for Medicare & Medicaid Services, and Department of Veterans Affairs could issue sector-specific updates.
• If your company suspects it is being swept up by the potential designation, engage early with counsel and policymakers, including by preparing submissions for OMB’s review process and working through relevant trade associations that are likely to play an important role in shaping implementation.
• If your company receives or expects to receive substantial revenue from sales of pharmaceutical products to U.S. executive agencies, it should: (i) evaluate its manufacturing processes, particularly any outsourced manufacturing, (ii) determine whether the processes for products that are, or may become, the subject of government contracts rely on equipment or services from a Biotechnology Company of Concern (or from a company that could potentially be designated as one), and (iii) consider revising those processes to remove such dependencies.
• This assessment is especially critical for contractors already listed on the 1260H list. Although entities identified by OMB benefit from a five-year grandfather period for existing contracts, no such grace period applies to companies on the 1260H list; the prohibitions will apply 60 days after the FAR is updated to incorporate them.

For pharmaceutical and biotech companies that currently depend on Biotechnology Companies of Concern, transitioning away may be difficult. Shifting manufacturing from one contract development and manufacturing organization (CDMO) to another requires significant time and resources. Depending on the extent of the changes, companies may need to amend their drug approvals and obtain prior regulatory authorization before commercializing products made by the new CDMO. Because any modification to the manufacturing process of an FDA-approved drug must be reported to the FDA—and may require a prior-approval supplement if it could affect the drug’s identity, strength, quality, purity, or potency—these transitions can be especially burdensome.

The BIOSECURE Act is also likely to impose greater burdens on small biopharmaceutical companies than on large ones. Larger companies often (i) operate their own manufacturing facilities, reducing reliance on CDMOs, and (ii) have greater resources to manage a CDMO transition, which can be complex and labor-intensive.[4] They are also more likely to work with multiple manufacturing partners, making it easier to shift production elsewhere. Smaller companies, by contrast, typically depend more heavily on outsourced CDMO services and may lack the resources needed to transition if their CDMO is designated a Biotechnology Company of Concern.

Conclusion

The BIOSECURE Act offers a clear view of congressional priorities and areas of durable, bipartisan collaboration heading into 2026. The Act reflects a broad, cross-party consensus that biotechnology has become a strategic national security domain, and that reducing U.S. dependency on foreign-adversary linked suppliers—particularly in genomics, data analytics, and biomanufacturing—is an urgent policy imperative. Its inclusion in the NDAA signals that bio‑industrial security, domestic biomanufacturing capacity, protection of U.S. genomic data, and reshoring of critical supply chains will remain high on the legislative agenda. This policy imperative is reinforced by the Department of Justice’s new Data Security Program, which further underscores the federal government’s expanding focus on safeguarding sensitive U.S. data, including human ’omic data (genomic, epigenomic, proteomic, and transcriptomic data), and scrutinizing foreign access risks across the life sciences and technology sectors. The Act also underscores Congress’s willingness to pair restrictive measures with capacity-building programs, suggesting that future bipartisan efforts may focus not only on limiting foreign influence in the bioeconomy but also on expanding U.S.-based innovation. Against this backdrop, companies should proactively assess their exposure to forthcoming policy shifts and position themselves to engage early in emerging federal programs and rulemaking processes. 

Associate Kara Podraza in the Washington, D.C. office also contributed to this article.

[1] Josh Abbott, “BIOSECURE Act passes through US House,” BioProcess International (Sept. 11, 2024), https://www.bioprocessintl.com/regulations/biosecure-act-passes-through-us-house; Fraiser Kansteiner, “After BIOSECURE Act passes in House, targeted Chinese companies say they’re ‘deeply’ concerned” (Sept. 10, 2024), https://www.fiercepharma.com/pharma/china-focused-biosecure-act-passes-house-heres-what-targeted-companies-are-saying; Steven T. Dennis and Roxana Tiron, “Biosecure Act Out of Key Defense Bill in Win for Chinese Biotech,” Bloomberg (Dec. 7, 2024), https://www.bloomberg.com/news/articles/2024-12-08/biosecure-act-out-of-key-defense-bill-in-win-for-chinese-biotech.

[2] S. Amend. 3236 to S. 2296, 119th Cong. (2025).

[3] House and Senate Armed Services Committees Release Final NDAA Text, https://armedservices.house.gov/news/documentsingle.aspx?DocumentID=6359.

[4]Miranda McLaren, “A quick guide to transferring a commercial drug product to a new fill-finish CDMO,” Pharmaceutical Technology (Sept. 4, 2024), https://www.pharmaceutical-technology.com/sponsored/a-quick-guide-to-transferring-a-commercial-drug-product-to-a-new-fill-finish-cdmo/#:~:text=Fill%20finish%20is%20a%20pivotal%20phase%20in%20drug,out%20the%20journey%20from%20onboarding%20to%20batch%20release.