After failing to pass in the previous Congress, a revised version of the BIOSECURE Act (“Act”) was signed into law by President Trump on December 18, 2025, as Section 851 of the National Defense Authorization Act (NDAA) for Fiscal Year 2026 (P.L. 119-60). The new law will restrict US federal procurement and grants involving biotechnology products or services provided by “biotechnology companies of concern” (BCC).

While amended and clarified in key areas, the Act follows the same basic prohibition as the original legislation, such that federal agencies must not enter into, extend, or renew any “contract” with an entity that uses “biotechnology equipment or services” from a BCC in performance of their federal contracts.

Below we summarize the scope of the new law, and highlight the changes as compared with prior iterations of the legislation.

The Act provides that a federal “executive agency” may not:

1. Procure or obtain any “biotechnology equipment or service” produced or provided by a BCC; or
2. Enter into a contract or extend or renew a contract with any company that either:
   • Uses “biotechnology equipment or services” produced or provided by a BCC in performance of a contract with the “executive agency;” or
   • Enters into any contract the performance of which will require, in performance of the contract with the “executive agency,” the use of “biotechnology equipment or services” produced or provided by a BCC.

In each of these latter two scenarios, the essence of the prohibition will be to prohibit federal “executive agencies” from entering into contracts with companies that use “biotechnology equipment or services” produced or provided by a BCC in the performance of contracts with those agencies.

In addition, “executive agencies” may not extend loans or grant funds to procure biotechnology equipment or services produced or provided by a BCC.

Executive agency is defined as a US federal government “executive department,” a “government corporation,” or an “independent establishment.” Examples of executive departments include the Department of Veterans Affairs and the Department of Health and Human Services and Defense, which includes the Food and Drug Administration, the Centers for Disease Control, and the National Institutes of Health.

The definition of “biotechnology equipment or services” is broad, and encompasses any instrument or service in “research, development, production, or analysis” related to “biological materials”:

• Equipment will include such items as genetic sequencers, or any other instrument, apparatus, machine, or device, including components and accessories, and any software and firmware necessary to operate such equipment.
• Services will include data storage and transmission related to biological materials, including “disease detection, genealogical information, and related services” and consulting, advising, and support services related to biotechnology equipment.
• The Office of Management and Budget (OMB) will also be empowered to name any other “service, instrument, apparatus, machine, component, accessory, device, software, or firmware” to count as biotechnology equipment or services as “appropriate.”

The new law includes a safe harbor provision making clear that the Act will not apply to “biotechnology equipment or services” that were previously, but are no longer, produced or provided by BCCs.

The Act also excepts from its restrictions certain intelligence activities, acquisition or provision or overseas healthcare services, acquisition of publicly or commercially available multiomic data, and declared public health emergencies.

Unlike prior versions of the legislation which named specific companies as BCCs, the Act defines BCCs as any entity that “is to any extent involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or service” as determined by the Director of OMB. The Act provides for three categories in which entities can be included on the list of BCCs published by OMB, which must be published no later than December 2026, and will include a comprehensive list of all BCCs from the three categories below:

1. Entities included on the Department of Defense’s (DoD) 1260H List, if that company “is to any extent involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or service.” The 1260H List is a list of Chinese military companies operating in the United States, pursuant to Section 1260H of the FY2021 NDAA, and is updated at least annually by DoD.
2. Entities based on certain criteria set out in the Act. Those criteria indicate that the entity must:
   1. Be subject to the administrative governance structure, direction, control, or operates on behalf of the government of a foreign adversary (i.e., China, North Korea, Russia, or Iran);
   2. To any extent be involved in the manufacturing, distribution, provision, or procurement of a biotechnology equipment or service; and
   3. Pose a risk to the national security of the United States based on:
      1. Engaging in joint research with, being supported by, or being affiliated with a foreign adversary’s military, internal security forces, or intelligence agencies;
      2. Providing multiomic data obtained via biotechnology equipment or services to the government of a foreign adversary; or
      3. Obtaining human multiomic data via biotechnology or services without express and informed consent.
3. Any subsidiary, parent, or successor of a BCC, if that entity meets the criteria set out for the OMB List.

The Act requires that entities not on the 1260H List that are designated as BCCs, be informed of the criteria used to designate them and offered an opportunity to challenge the designation, which could lead to their designation being rescinded.

In addition, the head of an executive agency may waive the Act’s restrictions for up to 365 days, with approval of the Director of OMB. This waiver can be renewed once for an additional 180 days.

The prohibitions set forth in the Act will not apply immediately upon enactment, including to entities currently on the 1260H List. The following is the maximum estimated timeline:

• Within one year of enactment (December 2026), OMB must publish the list of designated BCCs.
• Within 180 days of enactment (June 2027), OMB must issue guidance implementing the provisions of the Act.
• Within one year after guidance is issued (June 2028), the Federal Acquisition Regulatory Council must revise the Federal Acquisition Regulation (FAR) to implement the requirements of the prohibitions.
  • For 1260H entities, the Act’s prohibitions will become effective 60 days after the FAR is revised.
  • For all other entities designated as BCCs, the Act’s prohibitions will become effective 90 days after the FAR is revised.

The Act includes a grandfathering period for certain contractual arrangements with BCCs. Specifically, contracts entered into before the applicable effective date are grandfathered for five years from the date the FAR is revised with respect to that BCC. The grandfathering period is unavailable for existing contracts with companies named on the 1260H List as of December 18, 2025.

The Veterans Health Care Act of 1992 (38 U.S.C. § 8126) requires that pharmaceutical companies make “covered drugs” “available for procurement” by the government through the Veterans Affairs Federal Supply Schedule (VA FSS). Moreover, a VA FSS agreement is required for a pharmaceutical company to be eligible for reimbursement under Medicaid and Medicare Part B programs. As a result, manufacturers that use covered equipment or services from a BCC to perform an FSS contract will be ineligible to enter, extend, or renew that contract, absent a waiver or exception.

Under prior versions of the legislation, there was concern that if the law prohibited a manufacturer from entering into an FSS contract, that manufacturer could be deemed to have failed to comply with the provisions of Section 8126, and as a result, the manufacturer’s drugs would not be payable under Medicaid or Medicare Part B.

The Act includes a specific new “deeming” provision to avoid collateral consequences for reimbursement under Medicaid and Medicare Part B when the Act’s restrictions are the only barrier to a VA master agreement. Specifically, for purposes of Medicaid and Medicare Part B, a manufacturer is deemed to satisfy Section 8126 (including the requirement for a VA FSS contract) if the Secretary of Veterans Affairs determines that the manufacturer would comply and has offered to comply with Section 8126, and would have entered into required agreements with the government, but for the Act’s prohibitions.

• In light of the Act’s prohibitions, pharmaceutical and life sciences companies should monitor and assess the potentially disruptive impact of the Act if they (1) have or may enter into contracts with federal “executive agencies” and (2) source “biotechnology equipment or services” from listed biotechnology companies or from potentially targeted biotechnology-related companies with ties to the governments of China, Russia, Iran, or North Korea.
• Companies that are concerned about their relationships with BCCs should assess in advance how to mitigate its potential effects. The long lead times often associated with projects that rely on such “biotechnology services and equipment” from listed biotechnology companies or potentially targeted companies make this advance planning more urgent.
• Companies should include termination rights and technology transfer provisions in contracts being entered into with current or potential BCCs.
• Given that it may not always be readily apparent whether a counterparty could be designated in the future as a BCC, as part of transactional due diligence, companies should consider screening potential counterparties to seek to identify entities that may be at risk of meeting the criteria for BCCs under the Act. In the event that such a counterparty is identified, companies should explore whether the potential relationship with the counterparty could impact their contracts with US federal “executive agencies.”
• For companies that are concerned about potentially becoming designated as BCCs in the future, it would be prudent to proactively develop and implement mitigation strategies to minimize the risk of designation. For example, such companies should evaluate whether they have joint research with or being supported by a “foreign adversary’s” military, internal security forces, or intelligence agencies; by providing multiomic data to a “foreign adversary’s” government; or by obtaining multiomic data without express and informed consent.

*****

Bruce J. Linskens, Senior Policy Advisor, has contributed to this legal update.