Key Points

• The BIOSECURE Act restricts federal agencies from procuring or funding biotechnology equipment or services from designated “Biotechnology Companies of Concern,” and use of covered items — even indirectly — may jeopardize eligibility for federal contracts, grants, or loans.
• OMB will publish an initial designation list within 12 months, building on DoD’s Section 1260H framework; designations can include entities linked to China, Russia, Iran, or North Korea, or those posing national security risks through data access or foreign control.
• Compliance timeline: OMB list within 12 months; OMB guidance 180 days later; FAR revisions within one year after guidance; restrictions become effective 60–90 days post-FAR update; existing contracts are grandfathered for five years, except entities already on the 1260H list face prohibitions 60 days after the FAR update.

A Major Shift in Policy

Signaling a major shift in U.S. policy on biotechnology supply chain security, Congress has enacted the BIOSECURE Act as part of the Fiscal Year 2026 National Defense Authorization Act (NDAA), The Act imposes broad restrictions on federal contracting and funding involving certain foreign-linked biotechnology companies, with significant implications for pharmaceutical, biotech, and life sciences organizations.

Scope of Restrictions
Federal agencies are now prohibited from procuring biotechnology equipment or services from entities designated as “Biotechnology Companies of Concern,” and these restrictions also extend to federally funded projects, grants, and loans. Use of covered equipment or services — direct or indirect — can jeopardize eligibility for federal contracts or funding.

Designation Process
The Office of Management and Budget (OMB) will publish an initial list of designated companies within one year of enactment, supplementing the Department of Defense’s Section 1260H list of Chinese military‑linked entities. Designations may include companies tied to foreign adversaries — China, Russia, Iran, and North Korea — or those posing national security risks through data access or foreign control.

Compliance Timeline
The Act sets a staged rollout: OMB list published within 12 months; OMB guidance issued 180 days after the list; FAR revisions within one year of guidance; restrictions effective 60–90 days after the FAR update. Existing contracts are grandfathered for five years, except for entities already on the 1260H list, which face prohibitions 60 days after the FAR update.

Supply Chain and Data Security
The Act creates immediate exposure for companies relying on foreign-linked CDMOs or sequencing platforms, as use of covered inputs may render products ineligible for federal sales or reimbursement and force transitions that can require FDA prior‑approval supplements and significant resources. The BIOSECURE Act also amplifies federal priorities around genomic data protection and reshoring biomanufacturing, foreshadowing increased oversight from agencies such as NIH, DoD, CMS, and VA.

Action Steps
Companies should begin planning for transitions by evaluating manufacturing dependencies and alternative CDMOs or in‑house capabilities, monitoring OMB’s designation list, FAR revisions, and agency updates, engaging early where designation risk exists, assessing exposure to entities on the 1260H list or likely to be designated, and updating diligence processes for M&A, licensing, and investment decisions to incorporate BIOSECURE‑specific risk factors.

Bottom Line
The BIOSECURE Act reflects a durable, bipartisan commitment to bio‑industrial security. Pharma, biotech, and life sciences companies should act now to assess exposure, mitigate risk, and prepare for compliance as implementation unfolds.

This information is intended to inform firm clients and friends about legal developments, including the decisions of courts and administrative bodies. Nothing in this alert should be construed as legal advice or a legal opinion. Readers should not act upon the information contained in this alert without seeking the advice of legal counsel. Views expressed are those of the authors and not necessarily this law firm or its clients.