Draft NIH Biosafety Policy: Key Changes and Next Steps

Introduction

The National Institutes of Health (NIH) is requesting public comment through Notice NOT-OD-26-112 on a proposed NIH Biosafety Policy for Research Involving Biohazards. If finalized, the policy would replace the longstanding NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules and establish a broader framework for biomedical laboratory research involving biohazards. NIH released the notice on August 19, 2026, and will accept comments through October 19, 2026.

The proposal would extend NIH biosafety oversight beyond recombinant and synthetic nucleic acid research. It would also introduce risk-based review categories and new institutional requirements related to oversight, assurances, incident reporting, documentation, and transparency.

Because the policy remains in draft form, these provisions are not yet final requirements.

Why NIH Is Proposing a New Biosafety Policy

Nearly 50 years ago, NIH established its foundational guidelines for research involving recombinant DNA. NIH states that the increasingly multidisciplinary, cross-sector, and global nature of modern science requires biosafety oversight that can keep pace with evolving risks and rapidly advancing science and technology.

NIH announced its Biosafety Modernization Initiative in September 2025. It then gathered input through six regional listening sessions, smaller stakeholder engagements, and an open comment portal.

According to NIH, that feedback helped shape a proposal intended to:

• Broaden oversight to encompass biohazards beyond recombinant and synthetic nucleic acid technologies
• Reduce administrative burden for some low-risk research
• Strengthen the role of Institutional Biosafety Committees
• Increase public safety, transparency, and accountability

The Draft Would Expand the Scope of NIH Biosafety Oversight

The current NIH Guidelines center on research involving recombinant or synthetic nucleic acid molecules. The proposed policy would cover biomedical research conducted in laboratory settings when the research involves a known or potential risk to human health and one or more specified categories of biohazards:

• Wild-type bacteria, viruses, fungi, or parasites that cause disease in humans
• Genetically modified cells, viruses, or organisms, other than plants
• Toxins, prions, and other self-aggregating proteins
• Cells or organisms, other than plants, containing any of those materials

NIH describes this as a shift toward broader, risk-calibrated oversight rather than oversight primarily centered on a specific technology.

The draft’s definition of laboratory research includes work conducted in Biosafety Level or Animal Biosafety Level 1-4 containment facilities. These settings may include vivaria, core facilities, and some clinical environments. The definition does not include deliberate release of a biohazard outside biocontainment, such as field-release research.

The Policy Could Reach Beyond Individual NIH-Funded Projects

One of the proposal’s most consequential provisions is its potential reach beyond projects directly funded by NIH.

The draft would apply to research supported in whole or in part by NIH, regardless of the funding level or mechanism. Its coverage would include NIH intramural research as well as applicable extramural grants, contracts, cooperative agreements, Other Transactions, and other funding agreements.

The policy would also apply to covered, non-NIH-funded research conducted at an institution that receives any NIH funding. The draft states that institutions conducting NIH-supported research would be responsible for ensuring that covered research conducted at or sponsored by the institution complies with the policy, regardless of the individual project’s funding source.

Institutions reviewing the proposal will therefore need to consider its potential reach across their broader research portfolios, not only laboratories or projects receiving NIH support.

Oversight Would Be Calibrated to Risk

The proposed policy would establish three broad levels of oversight:

• Research requiring both NIH and IBC approval
• Research requiring full IBC review and approval
• Lower-risk research and some minor amendments eligible for delegated review

The applicable level would depend on the risks or uncertainties associated with the research.

Certain research involving emerging, novel, or zoonotic agents without an established Risk Group classification or recommended containment level would require NIH and IBC approval before initiation. The same would apply to certain initial requests to lower containment.

Other covered research would require review by the full IBC. Some lower-risk activities could be reviewed by an individual or subgroup of IBC members, although delegated reviewers could refer a project to the full committee.

NIH is asking whether this structure appropriately balances risk, accountability, transparency, and administrative burden. It is also seeking feedback on the continued use of Risk Groups as a baseline for risk assessment, particularly when biological agents are genetically modified, compared with greater reliance on Biosafety Levels described in the Biosafety in Microbiological and Biomedical Laboratories.

Institutional Biosafety Committees Would Have Expanded Responsibilities

IBCs would remain central to institutional biosafety oversight. The draft more fully defines their responsibilities for:

• Reviewing and approving covered research
• Conducting independent risk assessments
• Determining appropriate containment
• Monitoring approved research
• Reviewing and reporting incidents
• Documenting committee decisions and activities

The proposal also includes committee membership and expertise requirements.

An institution would be required to appoint a Biological Safety Officer when it conducts covered research at BSL-3 or BSL-4 or research involving gene drive modified organisms. The proposed policy would continue to require at least two IBC members who are not otherwise affiliated with the institution.

Institutions could approve research for up to three years. After that period, investigators would submit a new registration for review. Investigators would also need IBC approval before implementing any changes that could affect the original biosafety assessment.

Expanded Institutional Responsibilities

Beyond the IBC review process, the draft would introduce or strengthen several institution-level responsibilities.

Biosafety Assurance – Institutions would need an NIH-approved Biosafety Assurance documenting compliance with the policy. Authorized Organizational Representatives would submit the assurance to NIH, which could approve it for up to 4 years. Covered research could not proceed until NIH approved the assurance.

The submission would identify institutional lines of authority, relevant biosafety personnel, and elements of the institution’s IBC and biosafety operations. To the maximum extent possible, it would also include links to publicly available information about institutional biosafety procedures, committee membership, meeting minutes, incident reports, training, and relevant contacts.

Public Information and Recordkeeping – IBCs would need to approve meeting minutes no later than their next convened meeting and post the approved minutes on a public-facing institutional webpage after appropriate redactions.

Institutions would also post final incident reports. For incidents reported to NIH, institutions would post the agency’s final response alongside the report. Institutions would maintain public access to meeting minutes and incident reports for at least five years.

Incident Reporting – The draft distinguishes between significant incidents that require NIH notification and lower-risk incidents that the institution or IBC addresses.

Certain incidents that pose a significant risk to human health would require notification to NIH within 24 hours or as soon as the institution becomes aware of the incident. A complete report would follow after the relevant information is gathered, no later than 30 days.

Examples include confirmed or potential laboratory-acquired infections, releases with potential community risk, certain incidents in BSL-3 or BSL-4 settings, and specified compliance violations. Lower-risk incidents could remain subject to institutional review even when reporting to NIH is not required.

NIH has released draft templates for incident reporting and IBC meeting minutes for review, along with the proposed policy.

Collectively, these provisions would require institutions to evaluate their management of biosafety oversight, documentation, reporting, redaction, record retention, and public-facing information.

A Proposed Center Would Analyze Biosafety Incident Data

The draft would establish a National Biosafety Data and Safety Analysis Center to aggregate, de-identify, and analyze data about laboratory biosafety incidents, near misses, and anomalies.

Institutions would be encouraged to submit voluntary, confidential reports about certain near misses, secondary failures, and procedural issues. Under the draft, NIH would not use voluntarily submitted data for enforcement or funding action when the incident did not result in an environmental release or laboratory-acquired infection.

NIH describes these data-collection and transparency measures as part of its effort to strengthen accountability and improve understanding of biosafety incidents across the research enterprise.

What NIH Wants Commenters to Address

NIH welcomes comments on any part of the proposal. Respondents may address one, several, or all of the listed topics and are not expected to respond to every question.

NIH specifically seeks input on:

• The scope of covered research, including the definition of biohazards and any potential gaps in oversight
• The division of oversight among NIH, institutions, IBCs, and investigators
• Whether the proposed tiered approach is appropriately calibrated to risk
• The continued use of Risk Groups compared with Biosafety Levels in risk assessment
• Compliance and enforcement mechanisms, including voluntary compliance by entities not subject to the policy
• Implementation resources and areas where additional guidance would be useful

The agency is also requesting comments on its draft incident-reporting and IBC meeting-minutes templates. NIH has published a summary table of proposed changes to assist stakeholders in reviewing the draft.

Why This Matters

If finalized, the proposal would replace NIH’s recombinant and synthetic nucleic acid guidelines with a broader biosafety framework that covers additional categories of biomedical laboratory research.

The implications extend beyond the definition of covered research. The proposed policy could affect how institutions:

• Determine which research requires biosafety review
• Assign responsibilities among investigators, IBCs, and institutional officials
• Document risk assessments and committee decisions
• Report and review incidents
• Maintain institutional records
• Share information publicly

Its applicability to covered non-NIH-funded research at institutions receiving NIH funding could also make the policy relevant well beyond projects supported directly by NIH.

At the same time, the draft would allow IBCs to use delegated review options for certain lower-risk activities. Organizations reviewing the proposal should evaluate where the policy would expand oversight responsibilities and identify opportunities to streamline review processes.

What Organizations and Individuals Can Do Now

Organizations involved in biomedical research may benefit from coordinating their review across biosafety, research administration, compliance, environmental health and safety, sponsored programs, institutional leadership, and investigator communities.

Useful next steps include:

• Review the official notice, draft policy, summary of changes, and proposed templates.
• Identify research that could newly fall within the policy’s scope.
• Compare current IBC membership, review, documentation, and reporting practices with the draft.
• Evaluate the potential effect of extending the policy to covered non-NIH-funded research.
• Review the proposed Biosafety Assurance and public-posting requirements.
• Submit comments on unclear responsibilities, potential oversight gaps, implementation challenges, or opportunities to reduce unnecessary burden.

NIH will accept comments through October 19, 2026, using its online response form. Responses are voluntary and may be submitted anonymously.