On Thursday, December 18, the President signed the National Defense Authorization Act (NDAA) for Fiscal Year 2026. The NDAA contains several new national security regulatory controls, including a new Section 851 “Prohibition on contracting with certain biotechnology providers” (the Act). The prohibition in the Act is a revised version of a bill introduced almost two years ago intended to discourage the U.S. government and U.S. biotechnology companies more broadly from relying on certain government-designated biotechnology companies associated with particular countries of concern, the BIOSECURE Act.
The Act clarifies and limits certain elements of the BIOSECURE Act, and in doing so has potentially blunted some of its impact. Ultimately, the Act may prove to be less problematic for the biotechnology and pharmaceutical industry than its extended rollout and the Congressional debates on the original bill might have suggested. However, depending on the shape of the ultimate regulations, the additional restrictions still could have far-reaching consequences on U.S. companies’ ability to develop and market drugs while using equipment, services, or support from certain biotech companies in, e.g., the People’s Republic of China (PRC).
Implementing the Act: Big Changes for Government Procurement Regulations…
At its core, the Act prohibits executive branch agencies from entering into contracts or offering loans or grants to any company that uses “biotechnology equipment or services1—a broad set of equipment, devices, software, research and development and other information-related services—that are produced or provided by any designated “biotechnology company of concern” as part of that company’s performance of the contract with the executive branch agency. It also prohibits executive agencies from procuring such equipment or services themselves.
Biotechnology companies of concern, in turn, are those found on two specific lists. The first is a pre-existing list of PRC military companies (known as the 1260H list) whose products U.S. defense contractors are limited from using. There are currently only a few notable biotechnology companies on the 1260H list (such as BGI Genomics Co., Ltd.), though the Department of War does publish regular updates, and the Act will apply to any new entities that are added as well. The second will be a new list specific to the Act that will be determined by the executive branch, containing entities that meet the following three criteria:
- subject to administrative governance structure, direction, control, or operating on behalf of a government of a foreign adversary country (currently North Korea, the PRC, Russia, and Iran);
- involved in manufacturing, distribution, provision, or procurement of biotechnology equipment or services; and
- pose a national security risk to the U.S. by (i) conducting research projects with, receiving support from, or having ties to a foreign adversary’s military, internal security forces, or intelligence agencies; (ii) providing human multiomic data, collected through biotech equipment or services, with a foreign adversary’s government; or (iii) collecting human multiomic data through biotechnology tools or services without express, informed consent.
Certain subsidiaries, parents, or successors of entities on the two lists may also be considered companies of concern based on the Secretary’s to-be-determined listing process and criteria.
These prohibitions, however, will be rolled out on an extended timeline. Under the Act, no more than one year after the date of enactment, the Office of Management and Budget (OMB) will publish the initial list of entities to be included on that second list. No more than 180 days thereafter, OMB will publish implementation guidance on the Act for the public. Then, no more than one year later, the Federal Acquisition Regulation (FAR) will be revised to incorporate the requirements of the Act. The prohibitions under the Act will then take effect, either 60 days later in the case of the companies on the then-effective 1260H list, or 90 days later for companies on the Act-specific list. Assuming the government takes the full allocated time period, prohibitions under the Act will thus not be effective until sometime in the second half of 2028.
In addition, there are two safe harbors under the Act. Under the first safe harbor—a contract grandfathering provision—companies who enter into contracts (and other covered instruments like grants) with biotechnology companies of concern before the FAR revisions are issued—possibly in or around mid-2028—will not be subject to the limitations in the Act until five years after the publication of such revised FAR regulations (i.e. around mid-2033, assuming the government takes all allocated time.) Under the second safe harbor, the government is permitted to enter into contracts with entities who use biotechnology equipment or services that were formerly, but are no longer, produced or provided by a biotech company of concern.
Unlike the previous BIOSECURE Act, the new Act includes a non-public notice and review period for designated entities, which provides those entities with an opportunity to submit information and arguments in opposition to the designation. Entities may also request removal from the list of biotechnology companies of concern.
Finally, the contracting limitations apply to contracts subject to the FAR—i.e., procurement under traditional federal authorities—and also to contracts entered into under section 4021 of title 10, United States Code—i.e., so-called Other Transaction Authority (OTA) defense contracts. Notably, this does not include traditional Medicare and Medicaid procurement, which generally takes place under separate non-FAR, non-OTA contracting authorities. The Act also exempts the possible loss of Medicaid market access for Veterans Administration (VA)-administered medications, by deeming drug manufacturers compliant with VA pricing requirements if they would comply but for Act-related contracting prohibitions.
Effect of the Act: …But Potentially Fewer Changes for Biotechnology and Pharmaceutical Innovation
As a practical matter, the prohibitions in the Act may have less of an impact than the significant publicity around its passage may suggest. Because the relevant contracting limitations exclude most Medicare and Medicaid procurement, the greatest impact may be felt by entities that receive government loans and grants such as NIH grants—e.g., university research labs—and entities with relatively unusual procurement relationships with the U.S. government. For example, developers of drug candidates seeking to commercialize those drugs may face difficulties in, e.g., the VA procurement process if they rely on biotechnology company of concern CRO or other research assistance services. Pharmaceutical companies seeking to maximize the marketability of procured drug candidates from third parties may also demand a record of research that has no exposure to those companies. However, again, much federal drug procurement may remain unaffected.
In addition, the scope of many of the obligations described above will remain uncertain until the OMB implementation guidance and revised FAR regulations are published. For example, if the second safe harbor—covering services that were but are no longer provided by companies of concern—is interpreted broadly, it may be the case that nearly all usage of covered services is acceptable prior to the stage at which the parties enter into production with the federal government. On the other hand, if the executive branch chooses to implement the restrictions in the Act more broadly than expected—e.g., if they apply contracting limitations to government agreements outside the defined scope of “contracts”—then the Act would have much more far-reaching impact.
Right now, we suggest that companies in the biotech sector examine their exposure to potential biotechnology companies of concern in their supply chains to assess the effects of the Act on their compliance obligations. While many companies may not need to take immediate action, certain entities may wish to prophylactically address relationships to avoid future complications. And all companies with ongoing exposure should continue to monitor the issuance of named companies of concern and the initial guidance with respect to implementation.
For more information or any questions on the potential impact of the Act, please contact any member of the National Security and Trade practice at Wilson Sonsini.
[1] The full definition of biotechnology equipment or service is (A) equipment, including genetic sequencers, or any other instrument, apparatus, machine, or device, including components and accessories thereof, that is designed for use in the research, development, production, or analysis of biological materials as well as any software, firmware, or other digital components that are specifically designed for use in, and necessary for the operation of, such equipment; (B) any service for the research, development, production, analysis, detection, or provision of information, including data storage and transmission related to biological materials, including (i) advising, consulting, or support services with respect to the use or implementation of an instrument, apparatus, machine, or device described in subparagraph (A); and (ii) disease detection, genealogical information, and related services; and (C) any other service, instrument, apparatus, machine, component, accessory, device, software, or firmware that is designed for use in the research, development, production, or analysis of biological materials that the Director of the Office of Management and Budget, in consultation with the heads of executive agencies, as determined appropriate by the Director of the Office of Management and Budget, determines appropriate in the interest of national security.
