After failing to be included in the Fiscal Year (“FY”) 2025 National Defense Authorization Act (“NDAA”) or passed as a standalone piece of legislation, the BIOSECURE Act has moved closer to finally being enacted after it was included in the final FY 2026 NDAA text released by Congress on December 7, 2025.  Section 851 of the FY 2026 NDAA is titled “Prohibition on Contracting with Certain Biotechnology Providers,” but includes in substance what was previously introduced and considered in Congress as the BIOSECURE Act. 

The bill has the potential to impose significant restrictions on the use of certain Chinese companies in the supply chain for products procured by the U.S. Government and accordingly has been of interest to industry over the last few years.  This blog post summarizes the scope of the bill, highlights the changes in the FY 2026 NDAA text as compared to prior iterations of the bill, and flags key considerations for government contractors in the life sciences space.

The BIOSECURE Act prohibits executive agencies from procuring biotechnology equipment or services from biotechnology companies of concern (“BCOC”), as well as using government loan or grant funding to procure, obtain, or use biotechnology equipment or services from a BCOC.  The prohibition also applies to U.S. government contractors and subcontractors, who would be barred from using biotechnology equipment or services from BCOCs in performance of a U.S. government contract, or engaging subcontractors to do the same.

Biotechnology Companies of Concern

The bill, as included in the FY 2026 NDAA, provides for three categories of BCOCs:

1. Entities included on the Department of War’s (“DoW”) 1260H List, if that company is “to any extent involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or service.”  The 1260H List is a list of Chinese military companies operating in the United States, pursuant to section 1260H of the FY 2021 NDAA, and is updated at least annually by DoW.
2. Entities included on a list to be developed by the Office of Management and Budget (“OMB”) (the “OMB List”) based on certain criteria set out in the bill.  Those criteria indicate that the entity must be:
   • Subject to the administrative governance structure, direction, control, or operates on behalf of the government of a foreign adversary (North Korea, China, Russia, and Iran),
   • To any extent involved in the manufacturing, distribution, provision, or procurement of a biotechnology equipment or service, and
   • Poses a risk to the national security of the United States based on:
     • Engaging in joint research with, being supported by, or being affiliated with a foreign adversary’s military, internal security forces, or intelligence agencies,
     • Providing multiomic data obtained via biotechnology equipment or services to the government of a foreign adversary, or
     • Obtaining human multiomic data via biotechnology equipment or services without express and informed consent.
3. Any subsidiary, parent, or successor of a BCOC, if that entity meets the criteria set out for the OMB List.

Earlier versions of the bill considered by Congress last year specifically named five BCOCs: WuXi AppTec, WuXi Biologics, BGI, MGI, and Complete Genomics.  Those entities are no longer specifically identified in the bill, but BGI and MGI are currently included on the 1260H list and recent reporting indicates that DoW plans to add WuXi AppTec to the 1260H List as well.  Any of these entities could also potentially be included on the OMB List when that is developed.

The bill includes a process by which entities are informed that they have been designated as a BCOC, and the final FY 2026 NDAA text includes a new process for named BCOCs to request to be removed from the BCOC list.

Prohibitions and Scope

The BIOSECURE Act does not completely prohibit government contractors from doing business with a BCOC or even using biotechnology equipment and services from a BCOC.  Instead, the prohibition is limited to use in the performance of a government contract or subcontract or the use of loan or grant funds to fund work with a BCOC.  The definitions section of the bill reinforces this limitation by specifying that only Federal Acquisition Regulation (“FAR”) covered contracts and Other Transaction Authority (“OTA”) agreements under DoW’s OTA authority are included in the meaning of “contract.” 

The BIOSECURE prohibition applies to the use of “biotechnology equipment and services” which is broadly – and not entirely clearly – defined to include:      

• “[E]quipment, including genetic sequencers, or any other instrument, apparatus, machine, or device, including components and accessories thereof, that is designed for use in the research, development, production, or analysis of biological materials as well as any software, firmware, or other digital components that are specifically designed for use in, and necessary for the operation of, such equipment;”
• “[A]ny service for the research, development, production, analysis, detection, or provision of information, including data storage and transmission related to biological materials, including (i) advising, consulting, or support services with respect to the use or implementation of an instrument, apparatus, machine, or device described in [the definition of equipment]; and (ii) disease detection, genealogical information, and related services;” and
• “[A]ny other service, instrument, apparatus, machine, component, accessory, device, software, or firmware that is designed for use in the research, development, production, or analysis of biological materials that the [OMB Director], in consultation with the heads of executive agencies, as determined appropriate by the [OMB Director], determines appropriate in the interest of national security.”

The act contemplates both implementing guidance and FAR revisions following enactment, and affected contractors should closely review these materials for language helpful in determining exactly what “biotechnology equipment and services” is intended to encompass, and thus determine the scope of the statutory prohibition.  

The final text of the FY 2026 NDAA included a new provision regarding “Compliance with Drug Prices,” which states that “if the Secretary of Veterans Affairs determines that the manufacturer would comply (and has offered to comply) with the provisions of [38 U.S.C. § 8126], and would have entered into a master agreement under such section” but for the prohibitions under BIOSECURE, it will not be excluded from participation in Medicare and Medicaid under the Veterans Health Care Act.  This provision clarifies that although BIOSECURE may prevent the sale of certain products to the U.S. Government, it should not be an impediment to a company’s compliance with the requirements at 42 U.S.C. 1396r-8(a)(1).

Waivers, Grandfathering, and Exceptions

The bill provides a process to request a waiver, but waivers are not guaranteed and are time limited, with a one-year base period and only one six-month extension allowed.  Waivers require significant government coordination and must be approved by the head of the relevant procuring agency with approval from the Director of OMB.  Securing the six-month extension also requires coordination with the Secretary of Defense.

The bill also includes a five-year grandfathering period for pre-existing contracts and agreements with BCOCs (including pre-negotiated contract options), which may offer companies more extended relief than the waiver process.  In order to be eligible for the grandfathering period, the contract or agreement with a BCOC must be in place prior to the applicable effective date when the bill’s prohibitions will be applied to that BCOC.  Additionally, the bill includes a safe harbor provision directing that the prohibition does not reach equipment or services that were formerly, but are no longer, produced or provided by the BCOC.

The bill includes certain narrow exceptions, including for the procurement of medical countermeasures in response to a public health emergency, and for healthcare services overseas for U.S. government employees and their dependents and beneficiaries.

Implementation Timeline

While the BIOSECURE Act may soon become law, it will be several years before any of the prohibitions become effective.  The bill provides for a long implementation period following enactment, as indicated below:

• The OMB List must be published within 1 year of enactment.
• Implementing guidance must be issued within 180 days of the OMB List publication.
• The FAR must be revised to implement BIOSECURE within 1 year of the implementing guidance being released.
• The prohibitions as to BCOCs on the 1260H list are effective 60 days after the FAR is revised, and the prohibitions as to all other BCOCs are effective 90 days after the FAR is revised.
• The five-year grandfathering period begins when the FAR is revised.

We will continue to monitor for updates on the BIOSECURE Act and similar sourcing restrictions and will report on them here.