BIOSECURE Act Becomes Law

On December 18, the BIOSECURE Act became law as Sec. 851 of the National Defense Authorization Act (NDAA) for Fiscal Year 2026.

Introduction

The BIOSECURE Act will prohibit the U.S. government from contracting with any company that uses biotechnology equipment or services provided by an entity identified as a biotechnology company of concern (“company of concern”) in fulfilling that contract. While this is a seemingly narrow prohibition, it will have significant implications for any company designated as a company of concern and included on the list maintained by the Office of Management and Budget (OMB), as we expect they will see commercial partners rapidly shift to other service providers, even for contracted services not directly impacted by the law’s new prohibition.

The initial list of companies of concern will be released by OMB based on the Department of Defense’s (DoD) annually published list of Chinese military companies operating in the U.S. (the “1260H list”), and will include any other companies that OMB determines (in consultation with the Secretaries of the DoD, Health and Human Services, Homeland Security and the Attorney General (among others)) meet the statutory criteria. This BIOSECURE Act list will be reviewed and updated at least annually, and companies may be added or removed from the list with those updates.

For companies not currently on the 1260H list, the law requires advance notice to a company of its proposed designation as a company of concern and provides a non-public process to challenge being designated as a company of concern. The law also provides a formal process through which companies on the list of companies of concern may request to be removed by demonstrating they no longer meet the statutory criteria, which will generally result from divesting operations in China or by otherwise remediating any U.S. national security concerns.

Any company that provides biotechnology equipment or services and is added to the DoD’s annual 1260H list is expected to be included on the list of companies of concern and therefore subject to the BIOSECURE Act’s contracting restrictions.

Maximum Estimated Timeline

• BIOSECURE Act effective date (~Dec 2025)
• Within one year of enactment (~Dec 2026): Initial “company of concern” list released
• Within the following 180 days (~June 2027): Implementing guidance issued
• Within the following year (~June 2028): Final revisions to the Federal Acquisition Regulation (FAR)
  • 60 days later: Contracting prohibition effective for 1260H companies
  • 90 days later: Contracting prohibition effective for all other companies of concern
• Grandfathered: Any contract (including option years) that is finalized before the applicable contracting prohibition effective date, is grandfathered for five years from the date the FAR amendments are finalized.

Key Industry Concerns

While the BIOSECURE Act targets companies providing biotechnology equipment and services, there are specific limitations likely to impact some industries more than others.

U.S. Life Sciences Companies

Many U.S. life sciences companies rely on foreign contract research organizations (CROs) and contract development and manufacturing organizations (CDMOs) for everything from new product development to clinical trial support, to manufacturing finished drugs, biologics, and devices for U.S. patients. In many cases, the Food and Drug Administration authorization is tied to the specific manufacturing site and cannot be changed unilaterally. Some of those subcontractors and vendors are likely to end up on the list of companies of concern. Shifting projects to other appropriate Current Good Manufacturing Practice (cGMP)-compliant and GxP-compliant sites can be a years-long, expensive process.

This could increase costs for new product development and production, as alternative providers not designated as companies of concern may be able to charge a premium, particularly if global infrastructure (supply) for those services cannot meet the resulting increase in demand.

CROs and CDMOs

A large share of the contract research, development and manufacturing market is concentrated in China due to cost advantages and the availability of specialized technical capabilities. We expect some CROs and CDMOs based in China will be included on the list of companies of concern. As competitors in China are added to the list, expect to see growth in non-China CROs and CDMOs and increased demand for existing CROs and CDMOs outside of China. However, building out the physical infrastructure and recruiting appropriate technical expertise to meet the ensuing demand is expensive and will take time.

Medicare Part B, Medicaid and VA Drug Coverage Risks; Limited Exception for Medicare Part B, Medicaid Outpatient Drugs

Medicare Part B and Medicaid may only pay for drugs if the manufacturer meets certain requirements, including contracting with the Veterans Affairs (VA) to provide all the manufacturer’s covered drugs to the VA. Those VA contracting requirements will be subject to the BIOSECURE Act’s limitations. If even one drug in the manufacturer’s portfolio is made by a company of concern, or made using biotechnology equipment or services provided by a company of concern (and the manufacturing for that drug cannot be moved to an alternate facility before the grandfather protections expire), the VA could be prohibited from entering into or renewing the required contracts. This could result in the VA losing access to that manufacturer’s entire drug portfolio.

If a manufacturer cannot contract with the VA, it would have been unable to meet the Medicare Part B and Medicaid requirements that the manufacturer have those contracts. Therefore, Congress added an exception for Medicare Part B and outpatient drugs under Medicaid. This limited exception allows, in certain circumstances, a manufacturer to be “deemed” in compliance with the Medicare Part B and Medicaid outpatient drug eligibility requirement of having contracts in place with the VA.

Watch Your Supply Chains – Material Risk to VA; Medicaid Coverage

However, the current exception in the BIOSECURE Act is narrowly drafted to address the Medicare Part B, Medicaid outpatient drug coverage requirements. If the BIOSECURE Act were to prohibit the VA from contracting with a drug manufacturer because of a company of concern in its supply chain, both VA coverage for the manufacturer’s drugs, as well as Medicaid payments to drug manufacturers (other than for outpatient drugs), could still be impacted. Manufacturers should carefully monitor updates to the BIOSECURE Act’s company of concern list to ensure no vendors (or subcontractors) are named to that list that may trigger BIOSECURE Act restrictions.

What’s Next?

Over the next 18 months, we will see guidance on implementation of the BIOSECURE Act, followed by revisions to the FAR. Those may clarify the scope of the VA, Medicare, and Medicaid “deeming” exception. Otherwise, Congress may need to amend the exception to clarify its scope before the BIOSECURE Act prohibitions become effective.