On December 18, 2025, President Trump signed the FY2026 National Defense Authorization Act (NDAA) into law, enacting the BIOSECURE Act as Section 851 — "Prohibition on Contracting with Certain Biotechnology Providers." After more than eighteen months moving through Congress as a standalone bill, the measure reached the statute books folded into the annual defense authorization, and it reaches further into federally funded biotech research than many institutions expected.
This piece lays out what Section 851 actually does, who it designates as a "biotechnology company of concern" (BCC/BCOC), and — the part most relevant to research administrators — how it applies to grant and loan funding, not just federal procurement contracts.
What Section 851 does
Section 851 prohibits executive agencies from procuring covered biotechnology equipment or services from a designated biotechnology company of concern, and separately prohibits agencies from obligating or expending loan or grant funds to procure, obtain, or use covered biotechnology equipment or services from a BCC, or to enter into or renew contracts with entities that would use such equipment or services in contract performance. The prohibition also extends to Department of Defense "Other Transaction" research agreements under 10 U.S.C. § 4021.
"Covered biotechnology equipment or services" is defined broadly: instruments and components used to research, develop, produce, or analyze biological materials; the software and firmware needed to operate that equipment; and services for research and analysis involving biological materials, including data storage and transmission tied to it. That last piece — data services, not just lab hardware — is why the restriction reaches beyond obvious equipment vendors into genomic sequencing, data analytics, and contract research relationships.
Who gets designated a "biotechnology company of concern"
Unlike earlier drafts of the standalone BIOSECURE Act, the enacted Section 851 text does not name specific companies in the statute itself. Reporting on the bill’s legislative history repeatedly named entities like BGI, MGI, Complete Genomics, WuXi AppTec, and WuXi Biologics as the intended targets of the original bill, but the version that became law removes company-specific language in favor of two designation paths:
- Automatic inclusion for any entity already on the Department of Defense’s Section 1260H list (companies identified as Chinese military-affiliated) that is "to any extent involved" in manufacturing, distributing, providing, or procuring biotechnology equipment or services; and
- A case-by-case designation process led by the Office of Management and Budget (OMB), assessing whether an entity is subject to the direction or control of a foreign adversary and poses specified national security risks — factors cited include military affiliation, transfer of biological data to a foreign government, and unauthorized collection of human genomic or health data.
Designated entities can petition OMB for removal from the list, with a 90-day review window built into the statute — a due-process mechanism that was largely absent from earlier drafts and was one of the changes credited with getting the bill over the finish line in conference.
Timeline: this is not an immediate cutoff
Section 851 phases in over roughly two years rather than taking effect on signature:
- OMB must publish the initial BCC list by December 2026.
- Federal Acquisition Regulation (FAR) revisions implementing the prohibition are due within one year after the list is published.
- For entities already on the DoD 1260H list, the contracting/funding prohibition takes effect 60 days after the FAR revision.
- For other OMB-designated BCCs, it takes effect 90 days after the FAR revision.
- Contracts and funding relationships that predate the applicable effective date are grandfathered for up to five years.
Limited exemptions exist for healthcare services provided to U.S. personnel and dependents overseas, medical countermeasures procured during a declared public health emergency, and equipment or services from a company that was formerly, but is no longer, affiliated with a BCC. Agencies also retain case-by-case waiver authority.
Why this matters for federally funded biotech research specifically
The statutory language reaching "loan or grant funds" is the detail research offices need to register now, even with implementation more than a year out. The federal agencies that sponsor the bulk of biotech research and development funding — the National Institutes of Health (NIH), the Advanced Research Projects Agency for Health (ARPA-H), the Biomedical Advanced Research and Development Authority (BARDA), and the Defense Advanced Research Projects Agency (DARPA) — are all grant- and cooperative-agreement-issuing agencies whose award funds would fall inside this restriction once the FAR revisions and effective dates land. In practice, once the list and implementing rules are final, an institution using a BCC-supplied sequencing instrument, contract genomics service, or affiliated software platform inside the scope of covered federal funding on grandfathered timelines could face a compliance question that looks a great deal like the export-control and foreign-influence disclosure questions institutions already manage under NSPM-33 and Section 117 — except keyed to a vendor list rather than a personnel-affiliation or gift-disclosure standard.
For research administrators, the practical to-do list between now and the December 2026 list publication is procurement mapping, not immediate divestment: identify where sequencing instruments, genomic data platforms, and contract research/manufacturing relationships touch federally funded projects, and flag which vendors would be exposed if named to the 1260H list or designated by OMB. Institutions that already maintain a research security compliance function — tracking export-controlled equipment, foreign-influence disclosures, and NSPM-33 program elements — have an existing structure to extend to BCC screening; institutions without one will need to stand up the mapping exercise from close to zero.
How this differs from the SAFE Research Act debate
Section 851 should not be confused with the SAFE Research Act, a broader affiliation-based research-security measure that was considered for the same FY2026 NDAA and ultimately dropped during conference negotiations after sustained pushback from the research community — a separate story covered in our companion piece on why the SAFE Research Act was removed. BIOSECURE’s named-entity, procurement-and-funding-list approach is narrower and more mechanical than SAFE Research Act’s proposed institution-wide affiliation standard, and it is a genuinely enacted law rather than a defeated proposal. It is also a distinct legal track from the export control fundamental research exclusion at 15 CFR 734.8, which — as covered in our fact-check of fundamental-research-exclusion "quiet shift" claims — has not itself been amended by BIOSECURE, NSPM-33, or Section 117 enforcement activity; these remain parallel compliance obligations, not a single unified rule change.
Frequently asked questions
Is the BIOSECURE Act in effect right now?
The law is enacted (signed December 18, 2025), but its operative prohibitions are not yet in effect. OMB must first publish the list of biotechnology companies of concern (due by December 2026), and the FAR must then be revised before the funding and contracting restrictions become enforceable, with a further 60- or 90-day lag depending on designation type.
Does BIOSECURE apply to NIH and other research grants, or only to federal contracts?
Both. Section 851’s prohibition explicitly extends to obligating or expending loan or grant funds to procure, obtain, or use covered biotechnology equipment or services from a designated company, in addition to the separate contracting prohibition. Grant-funding agencies including NIH, ARPA-H, BARDA, and DARPA fall within its scope.
Does the law name WuXi, BGI, or other specific companies as restricted?
No. The enacted statute does not name specific companies, in contrast to earlier standalone drafts of the BIOSECURE Act that did. Restricted status is instead determined either by inclusion on the DoD’s Section 1260H list or through a case-by-case OMB designation process, with a petition-based removal mechanism.
What should a research institution do before the list is published?
Map where genomic sequencing instruments, contract research/manufacturing relationships, and biological-data services touch federally funded (not just federally contracted) work, and note which vendors would create exposure if later listed. This is groundwork, not a compliance deadline — the earliest enforceable prohibitions are not expected until at least late 2027 given the statutory sequencing.
How does BIOSECURE relate to the export control fundamental research exclusion?
They are separate legal tracks. BIOSECURE is a procurement- and funding-restriction statute keyed to a designated-entity list; the fundamental research exclusion is an export-control concept under 15 CFR 734.8 governing when research is exempt from export licensing. Neither amends the other.
This overview reflects publicly available legislative text and law-firm client alerts published in December 2025 and January 2026, ahead of OMB’s list publication and the FAR rulemaking that will determine final implementation detail. Institutions should track OMB and FAR guidance directly as the list and implementing regulations are published.
