BIOSECURE Act Included in the FY2026 National Defense Authorization Act

What’s New: How the Final BIOSECURE Act Differs From Earlier “Five-Company” Proposals

Earlier versions of the BIOSECURE Act focused on five specifically named Chinese biotechnology firms. The version included in the NDAA takes a different approach. Instead of naming individual companies, the revised framework relies on two mechanisms for designating covered biotechnology companies: (1) automatic designation through the Department of Defense (DoD) Section 1260H list of “Chinese military companies,” most recently updated in January 2025, and (2) a criteria-based pathway administered through an interagency process led by the Office of Management and Budget (OMB). 

The shift is significant. Two of the five companies targeted in earlier drafts already appear on the 1260H list. And according to Bloomberg, Deputy Defense Secretary Stephen Feinberg informed Congress in an October 7 letter that the department should add a third company from the prior list to the 1260H list. These developments illustrate why the final bill’s reliance on Section 1260H elevates the importance of that list for biotech procurement compliance.

Scope of the Prohibitions

Section 851 bars executive agencies from procuring or obtaining biotechnology equipment or services from any “biotechnology company of concern.” The provision also restricts agencies from entering into, extending, or renewing contracts with any entity that

1. uses covered biotechnology equipment or services acquired after the effective date in performing the government contract or 
2. knowingly enters into a downstream contract that requires the use of such covered equipment or services.

These restrictions apply when the equipment or services at issue are produced or provided by a biotechnology company of concern; they do not bar the use of biotechnology equipment or services from non-designated providers. 

Section 851 also prohibits agencies from obligating or expending loan or grant funds to procure covered biotechnology equipment or services or to enter into or renew contracts with entities that would use those items in performance. 

Section 851 defines “biotechnology equipment or service” broadly. Covered items include

• instruments and components used for research, development, production, or analysis of biological materials
• software and firmware necessary to operate such equipment
• services for research and analysis related to biological materials (including data storage and transmission)
• disease detection and genealogical services
• any additional items or services that OMB designates as necessary to protect national security

Designation Mechanics: What Is a “Biotechnology Company of Concern”

Section 851 directs OMB to publish a list of biotechnology companies of concern within one year. OMB must compile the list based on a list of suggested entities to be provided by the Secretary of Defense in coordination with other national security and public health agencies. 

In addition to companies on the DoD 1260H list that are involved in manufacturing, distributing, providing, or procuring of biotechnology equipment or services, covered entities include those

• subject to the direction or control of a foreign adversary
• involved in biotechnology equipment or services
• assessed to pose specified national security risks such as affiliations with foreign adversary militaries or intelligence services, provision of multiomic data to a foreign adversary, or collection of human multiomic data without express and informed consent

Parents, subsidiaries, or successors that meet the same criteria as above are also included. 

Unlike the 1260H list, Section 851 provides procedural protections for entities designated through this pathway. Newly designated companies must receive notice and have 90 days to submit information or arguments opposing the designation. OMB must also maintain a process for periodic review and for considering removal requests. Designations remain nonpublic until OMB issues a final determination after reviewing any submissions. 

Effective Dates, Waivers, and Exceptions

The prohibitions under Section 851 take effect following revisions to the Federal Acquisition Regulation (FAR). The timing depends on the basis for a company’s designation: 60 days after the FAR update for entities designated via the Section 1260H list and 90 days after for entities designated through the broader, criteria-based process. 

The statute includes several important transition provisions. A five-year rule of construction protects legacy agreements — including previously negotiated options — from being invalidated by the new restrictions. A safe harbor further clarifies that items no longer produced or provided by a biotechnology company of concern are not treated as covered items. And OMB, with interagency input, must issue implementation guidance followed by FAR amendments.

Agency heads may grant limited, case-by-case waivers when doing so is in the national security interest. The statute also provides several narrow exceptions, including for

• authorized intelligence activities
• certain overseas healthcare acquisitions for U.S. personnel
• use of lawfully compiled publicly or commercially available human multiomic data
• procurement of medical countermeasures during a declared public health emergency 

Medicaid Drug Rebate Program Safe Harbor

Section 851 also includes a targeted safeguard for drug manufacturers participating in the Medicaid Drug Rebate Program. It provides that a manufacturer will not be penalized solely because it cannot execute a Veterans Affairs (VA) master agreement when that inability results from the national‑security contracting prohibitions. The safe harbor ensures that Medicaid drug rebate participation remains intact in such circumstances, distinguishing these situations from cases in which a manufacturer fails or refuses to meet VA pricing requirements. 

Potential Action Items

The following tailored, near-term steps can help companies mitigate BIOSECURE Act risks and prepare for implementation.

For Chinese biotechnology companies

• Avoid 1260H designation: Take all feasible steps to remain off DoD’s 1260H list, which is updated annually and does not require predesignation notice. Placement on the list triggers the BIOSECURE Act’s faster effective dates.
• Engage proactively with DoD before any listing decisions: Seek early briefings with the 1260H team and relevant defense, intelligence, procurement, and policy offices. Voluntarily provide technical, ownership, and governance information and offer concrete remedial commitments where appropriate. Because after-the-fact challenges under the Administrative Procedure Act are limited, early engagement is the most effective means of influencing outcomes.
• Map and de-risk operations: Identify any current or planned use of covered biotechnology equipment, software/firmware, or related services in the performance of U.S. federal work, and transition to qualified alternative sources where needed.
• Mitigate 1260H risk factors: Strengthen corporate governance, transparency, and controls related to government or military affiliation, data security, and cross-border human multiomic data practices — areas that may carry weight in DoD’s risk assessments.
• Monitor listings and prepare filings: Track updates to the 1260H list and developments in the OMB criteria-based designation process. Prepare substantiated materials for potential submissions to OMB, which provides notice-and-response protections not available in the 1260H process.

For non-Chinese companies (contractors, grant/loan recipients, and suppliers)

• Supplier diligence: Conduct targeted diligence on suppliers in connection with federal work. Verify ownership/control, any DoD Section 1260H or other designations, equipment/software provenance, and human multiomic data practices. 
• Contract safeguards: Consider supplementing supplier agreements with tailored representations, warranties, covenants, and flow downs addressing 1260H status; the use (and timing) of any covered equipment or services after effective dates; data handling standards; audit and termination rights; and notice obligations.
• Usage evaluation: Identify any current or planned use of biotechnology equipment, software/firmware, and related services in performing federal work.
• Exposure assessment: Evaluate relationships with 1260H-listed companies and entities that may be designated through OMB’s criteria-based process.
• Contract review and alternatives: Examine contract portfolios for reliance on covered equipment or services and determine whether viable alternative sources exist.
• OMB engagement: Where appropriate, prepare to participate in OMB’s notice-and-comment and designation-review processes.
• Implementation planning: Factor the five-year rule of construction for legacy agreements, available waiver pathways, and the expected timeline for FAR revisions into transition planning and compliance program updates.