National Security Presidential Memorandum 33, issued in 2021 and operationalised through implementation guidance during 2022-2024, requires US federal research-funding recipients to disclose certain affiliations, support, and resources from foreign sources, with the aim of identifying conflicts of commitment and undue foreign influence. The major federal agency rollouts (NIH, NSF, DOE, DOD, NASA, USDA) became binding through 2024 and 2025. We are now 18 months into substantive implementation. This post is a status report.
What NSPM-33 requires
The disclosure requirements run across three axes. Current and pending support: applicants must disclose all sources of support for ongoing and planned research activities, including foreign sources, with structured detail. Biographical sketch: applicants must list all affiliations, including foreign ones, in a structured format. Conflicts of interest and commitment: applicants must disclose financial conflicts of interest, foreign relationships, and any obligations to entities that could constitute conflicts of commitment.
The structure is mostly common-form across agencies — the Common Forms work coordinated by NSTC’s Joint Committee on the Research Environment produced templated disclosure formats — though agency-specific variations persist. The CASRAI NSPM-33 entry tracks the common-form versions.
What worked
Three things have worked better than was expected at rollout.
First, institutional infrastructure. Most major research universities built the disclosure-collection and -review infrastructure during 2022-2024 in anticipation of binding requirements. By the binding date, most had functional systems: faculty-facing tools for disclosure entry, research-administration review workflows, integration with proposal-submission pipelines. The smaller and less-resourced institutions struggled more, but the AAU- and APLU-coordinated capacity-building efforts substantially closed the gap.
Second, the common-form approach. The Common Forms work was widely criticised during development for being slow and produced-by-committee. The result has held up well: a researcher applying to multiple agencies can use the same biographical sketch and current-and-pending-support disclosures with only minor agency-specific extensions. The pre-Common-Forms world had every agency requiring its own format; the post-Common-Forms world has substantial harmonisation.
Third, the compliance posture. The major agencies have, on the whole, used the disclosure requirements as compliance tools rather than enforcement weapons. The early concerns about a wave of investigations leveraging disclosure inconsistencies as the predicate for action have largely not materialised. Where investigations have proceeded, they have done so in cases with substantive concerns beyond disclosure failures alone.
What is broken
Three implementation problems persist.
First, retroactive disclosure. The requirements ask for disclosure of historical affiliations and support, often going back several years. Researchers have variable recollection and variable access to records of those years. Honest mistakes — forgotten honorary positions, misremembered dates, inaccurate amounts on past awards — produce disclosure inconsistencies that institutions then have to investigate and resolve. The investigation overhead is substantial; the underlying integrity concerns are usually minor.
Second, international-collaboration chilling. The disclosure requirements have, in our community’s observation, produced a chilling effect on international collaboration, particularly with collaborators in countries that the US identifies as competitor jurisdictions. Researchers report declining collaboration invitations they would previously have accepted, in part to avoid the disclosure overhead, in part out of caution about how the disclosed activity might later be interpreted. The chilling effect is hard to measure but is widely reported.
Third, the institutional-versus-individual line. The disclosure requirements ask the individual researcher to disclose their affiliations, but many “foreign affiliations” are institutional arrangements (university-to-university partnerships, MOUs, joint programmes) that the individual researcher discovers only when asked to disclose them. The institutional research administration knows the partnerships; the individual researcher often does not. Surfacing institutional partnerships in individual-disclosure workflows is an unsolved UX problem.
The ORCID interlock
One concrete improvement that NSPM-33 implementation has driven is tighter integration with ORCID as the canonical record of researcher affiliations. ORCID 4.0’s affiliation history with ROR IDs and date ranges is the natural source for the biographical-sketch component of NSPM-33 disclosures; agencies are increasingly accepting ORCID-derived biographical sketches and several are piloting direct ingestion from ORCID at submission. The CASRAI ORCID implementation guide has been updated with the NSPM-33 patterns.
The longer-term value of this integration is that it incentivises researchers to maintain a current and complete ORCID record, which has benefits well beyond compliance. The institutions that have invested in ORCID adoption are well-positioned for NSPM-33 compliance; the institutions that have not are pushing researchers to maintain disclosure information in institutional systems that diverge from ORCID, creating a synchronisation problem.
The CRediT angle
NSPM-33 does not require CRediT roles in disclosures, but the disclosure framework’s interest in “all sources of support” includes contributions to research activities. A researcher who contributed to a foreign-funded project — even without being a PI — has a disclosure obligation. The CRediT role framework provides a vocabulary for characterising those contributions, and several institutional implementations now use CRediT-aligned controlled vocabularies in their disclosure forms.
What’s still pending
Three institutional adjustments are still in motion 18 months in.
First, training and culture. The disclosure requirements need to become routine, the way IRB compliance has become routine. Most institutions still treat disclosure as a special workflow with episodic attention; the maturity target is that disclosure is built into hiring, promotion, sabbatical, and proposal workflows as a routine compliance item.
Second, institutional-individual reconciliation. The institutional partnerships and the individual disclosures need to be reconciled systematically. Several institutions have built dashboards that show, for each researcher, the institutional partnerships their disclosed affiliations imply, with prompts for confirmation. This is the right direction; it is not yet widely deployed.
Third, cross-institutional data sharing. When a researcher moves between US institutions, their disclosure history needs to travel with them. The current state is that it does not, reliably; the new institution rebuilds the disclosure profile from scratch. This is wasteful and produces unnecessary inconsistencies. ORCID-anchored disclosure portability is the right architectural answer; institutional adoption is the missing piece.
What CASRAI recommends
For research-administration offices, the priority for 2026 is to consolidate the operational maturity of disclosure workflows: routine integration with proposal submission, ORCID-anchored biographical sketches, institutional-partnership reconciliation, training programmes that treat disclosure as a standard compliance item. The CASRAI institutional research-security guide walks through the maturity model.
For researchers, the operating posture is to keep ORCID current, to maintain a personal log of affiliations and support that supports disclosure, and to treat disclosure as part of professional practice rather than as exceptional compliance.
For agencies, the priority is to continue the common-form harmonisation work and to consider further ORCID integration. The 2026 update to the Common Forms is in development and the indications are positive.