Overview
In December 2025, Congress enacted revised BIOSECURE provisions as Section 851 of the National Defense Authorization Act (NDAA) for Fiscal Year 2026, signed into law on December 18, 2025 (effective date). These provisions establish new restrictions on the use of certain biotechnology equipment and services in federally funded activities, with the stated goal of addressing national security risks related to biotechnology supply chains and sensitive biological data.
Unlike earlier legislative proposals, the enacted law does not name specific biotechnology companies. Instead, it relies on a designation process led by the Office of Management and Budget (OMB), with automatic linkage to the Department of Defense’s Section 1260H list of Chinese military companies. This approach creates a compliance framework that evolves over time rather than a fixed list of prohibited entities.
Why This Matters for Universities and Research Institutions
Although Section 851 primarily applies to executive agencies (federal departments and agencies), it significantly impacts universities, research institutions, non-profits, and other organizations through the prohibition on the use of federal loan and grant funds, which is outlined in subsection (a)(2).
Federal funds may not be used directly or indirectly to obtain biotechnology equipment or services from a biotechnology company of concern (BCC) after the effective date. This broad and immediate restriction impacts all federally funded research (grants or loans), including projects supported by NIH, NSF, DoD, and HHS, and affects sequencing services, data analysis platforms, CDMO relationships, and other essential inputs.
Organizations that are also federal contractors or subcontractors may face additional requirements once the Federal Acquisition Regulation (FAR) is updated.
How the Designation Process Will Work
Rather than naming companies in statute, Section 851 establishes a dynamic designation framework. OMB will publish and maintain a list of biotechnology companies of concern through an interagency process, with updates at least annually. Companies tied to DoD’s Section 1260H list will be automatically implicated if they meet the biotechnology criteria.
Because designations may change at any moment, ongoing monitoring is critical for compliance, not a one-time review.
Key Dates to Watch
While the law is already enacted, implementation will occur over several years:
- December 18, 2025: Law enacted
- June 16, 2026 OMB implementation guidance expected approximately 180 days after law enactment
- December 18, 2026: The initial BCC list will be published, and then updated on an annual basis..
- June 2027: FAR amendments expected 1 year after OMB guidance
- Late 2027: Prohibitions take effect following FAR updates
The statute also includes a five-year exemption after FAR amendments take effect period for contracts entered into before the effective date. This allows organizations time to adjust without immediate disruption.
What Organizations Can Do Now
Although prohibitions will not take effect immediately, the long lead times common in biotechnology supply chains make early planning imperative. Institutions should act now by assessing supplier dependencies, updating data-handling protocols, revising internal policies, and establishing compliance-monitoring processes to ensure readiness for eventual compliance.
BIOSECURE Act Compliance Resource
To support these early planning efforts, we have prepared a one-page BIOSECURE Act readiness checklist for federal contractors, grant recipients, and research institutions. Download and use this checklist now to review supplier lists, evaluate compliance risks, document mitigation steps, and track progress as guidance and regulations are released.
