BIOSECURE Act Enacted

On December 18, 2025, President Trump signed into law the National Defense Authorization Act (The “NDAA”).¹ Among its provisions, the NDAA includes an updated version of the BIOSECURE Act (the “Act”). The Act restricts federal agencies and contractors from procuring biotechnology equipment or services from companies owned or controlled by foreign adversary governments.² Specifically, it prohibits federal agencies from procuring, contracting with, or utilizing biotechnology equipment or services from “biotechnology companies of concern” (“BCCs”), and bars contractors and grant recipients from using such equipment or services in the performance of federal contracts or grants.³

Biotechnology Companies of Concern

Unlike the bill of the BIOSECURE Act introduced to Congress in 2024, which was ultimately not passed, the Act does not specifically name WuXi AppTec, WuXi Biologics, BGI, MGI, or Complete Genomics as BCCs.⁴ Rather, the Act defines a BCC as an entity that is determined to be a BCC in one of two ways:

1. An entity that is (a) included in the 1260H list of “Chinese military companies operating in the United States” maintained by the U.S. Department of Defense (the “DoD”) and (b) involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or services, as determined by the Office of Management and Budget (the “OMB”) (such process of determining a BCC, the “1260H list process”).⁵ Notably, the current 1260H list includes BGI Group (BGI Genomics Co., Ltd., Forensic Genomics International, and MGI Tech Co., Ltd.), which was also named in the 2024 version of the proposed BIOSECURE Act, but Complete Genomics, WuXi AppTec, and WuXi Biologics are not included on the current list.⁶
2. An entity designated by the Director of the OMB to (a) be subject to the control of the government of a foreign adversary, (b) be involved in the manufacturing, distribution, provision, or procurement of biotechnology equipment or services, and (c) pose a risk to the national security of the United States (such process of designating a BCC, the “OMB criteria process.”)⁷ For the third factor, risk is assessed based on the entity’s engagement with, support from, or affiliation with a foreign military, the provision of multiomic data obtained by biotechnology equipment or services to the government of a foreign adversary, or the acquisition of human multiomic data by biotechnology equipment or services without express, informed consent.⁸

Using these two processes, the OMB will publish a list of entities that are BCCs no later than one year from December 18, 2025, based on a list of entities suggested by the Secretary of Defense in coordination with the U.S. Attorney General and other agencies responsible for national safety and security.⁹

A subsidiary, parent, or successor of a BCC that (1) is subject to the control of the government of a foreign adversary, (2) involved in the manufacturing, distribution, provision, or procurement of biotechnology equipment or services, and (3) poses a risk to the national security of the United States, is likewise considered a BCC under the Act.¹⁰

Contracts

Contracts subject to the Act are defined as any contract subject to the Federal Acquisition Regulation issued under section 1303(a)(1) of title 41, United States Code (FAR).¹¹ Medicaid national drug rebate agreements and Medicare Part D manufacturer discount agreements are not FAR-based contracts, as they do not involve federal government procurement of goods or services. However, the FAR applies to nearly all government contracts for the procurement of goods and services, including potential supply agreements with the Department of Veterans Affairs and certain contracts with the Centers for Disease Control and Prevention. Furthermore, transactions entered into under Section 4021 of Title 10 of the United States Code (other transaction agreements, or OTAs) are also considered contracts covered by the Act.¹²

Exceptions

The Act excludes certain categories of activities from the prohibitions on federal contracting or funding, such as intelligence activities, certain overseas health care services, and the acquisition, use, or distribution of commercially or publicly available multiomic data. Additionally, the procurement of medical countermeasures, medical products, and related supplies in direct response to a declared public health emergency is also exempted from the prohibitions under the Act.¹³

Effective Date and Grandfathering Provisions

The effective date of the Act for BCCs determined through the 1260H list process is 60 days after the FAR is revised to be applicable to such BCCs.¹⁴ For BCCs designated through the OMB criteria process or as subject affiliates of BCCs, the effective date is 90 days after the FAR is revised to be applicable to such BCCs.¹⁵

The Act establishes a five-year grandfathering period for contracts entered into with a BCC prior to the effective date of the Act for such BCC.¹⁶ This five-year period starts once the FAR is amended to reflect the Act’s requirements.¹⁷ During this time, entities are permitted to complete current contracts, transition to alternative suppliers, and gradually discontinue business relationships with BCCs.

Additionally, the definition of “biotechnology equipment or services” under the Act excludes equipment or services that were previously, but are no longer, manufactured or supplied by BCCs.¹⁸ As a result, entities may continue to use equipment or technology that was formerly produced or provided by a BCC, provided it is no longer associated with a BCC.

Designation, Waiver, and Removal of BCC-Status Designation

An entity that is designated as a BCC by the OMB criteria process will be issued a notice of designation, which may include recommended mitigation measures.¹⁹ If the company implements these measures, the government may, at its discretion, revoke the designation. The notice must outline the reasons for the company’s designation as a BCC, specifying the criteria and supporting information used, to the extent consistent with national security interests.²⁰ Such BCCs may contest their designation within 90 days of receiving notice.²¹ Upon challenge, the Director of the OMB, in coordination with relevant agencies, must issue a final determination to the company prior to publicly designating the entity as a BCC.²² The Act does not establish a specific timeframe for this final determination. Note that these notice and contest provisions do not apply to an entity that becomes a BCC through the 1260H list process.

If an entity identified as a BCC through either the OMB criteria process or the 1260H list process believes it no longer meets the definition of a BCC, it may submit information and arguments to the Director of the OMB to request removal of its BCC status.²³ The Director of the OMB must respond to such removal requests within 90 days of receipt.²⁴

Additionally, the head of an executive agency may waive the operative prohibitions of the Act, with approval from the OMB, on a case-by-case basis.²⁵ The duration of a waiver is one year, with an option for a one-time 180-day extension.²⁶ An agency head may grant a waiver only if such extension is in the national security interests of the United States, including overseas health care that supports the mission of U.S. government employees.²⁷

Updates from the October Bill Passed by the Senate

The enacted law includes several key updates from the prior version passed by the Senate on October 9, 2025 (see our prior Alert), including:

• Knowledge requirement. The enacted law revised the knowledge threshold that entities must have regarding the use of biotechnology equipment or services from BCCs.²⁸ Under the standard of the enacted law, the head of an executive agency is prohibited from entering into a contract with any entity that knowingly enters into contracts requiring the use of biotechnology equipment or services produced or provided by a BCC and acquired after the applicable effective date. This change lowers the threshold from the “knows or has reason to believe” standard in the October bill to actual knowledge of the entity, thereby reducing the government’s diligence required when contracting with entities.
• Effective date. The effective date for BCCs designated through the OMB criteria process or because of affiliate status has been shortened from 180 days after FAR revision in the October bill to 90 days after FAR revision in the enacted law.²⁹
• Grandfathering. The enacted law resolved ambiguity from the prior draft, clarifying that all BCCs will benefit from the five-year grandfathering provision.³⁰
• Exceptions. Employees of the United States need not have official duty stations located overseas or be on permissive temporary duty travel overseas to fall under the overseas health care services exception.³¹ Additionally, the Act extends the health care services exception to dependents of such employees and covered beneficiaries (dependents (spouses, unmarried children, parents) of uniformed service members/veterans, former spouses, and sometimes others such as certain orphans or foster children, who receive health care benefits through the TRICARE program).³²
• BCC definition. The category of BCCs determined through the 1260H list process is narrowed from the October bill to only those entities identified in the 1260H list published by the DoD who are “to any extent involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or services,” as determined by the OMB.³³
• Removal requests. A new provision allows an entity named as a BCC by either process, which believes it no longer meets the definition of a BCC, to request removal from the list by submitting information and arguments to the Director of the OMB, who must review and respond within 90 days.³⁴
• Compliance with limitations on drug prices. The Act now provides that, for purposes of section 1927(a)(1) of the Social Security Act, a manufacturer is considered to comply with drug price limitations under section 8126 of title 38 (including the requirement to enter a master agreement with the Secretary of Veterans Affairs) if the Secretary determines that the manufacturer would comply and would have entered such an agreement, except for this Act’s prohibitions.³⁵ This ensures that manufacturers remain eligible for Medicaid and other federal health program reimbursements, even if they are unable to enter into a master agreement with the Secretary of Veterans Affairs due to prohibitions imposed by the Act.

Biotechnology Industry Takeaways

By not naming WuXi AppTec and WuXi Biologics in the list of BCCs, the Act is less disruptive to the biotechnology industry compared to the 2024 version of the bill. Nonetheless, there is a clear process for additional companies to be named as BCCs. Life sciences companies and institutions should assess their supply chains and existing business practices to identify equipment and services sourced from potential BCCs. Federal agencies will be barred from procuring, contracting with, or using biotechnology equipment or services from BCCs, and from contracting with or extending grants to entities using such equipment or services in the performance of federal contracts or grants.³⁶ To maintain eligibility for doing business with the federal government, biotechnology companies and institutions must monitor companies of concern and consider exiting contractual arrangements with potential BCCs.

Businesses and institutions will also need to determine whether materials or services provided by BCCs used in federal contracts fall under the Act’s definition of “biotechnology equipment or services,” which includes equipment and services related to genetic and biological materials.³⁷ The OMB, in consultation with other agencies, may periodically expand this definition for national security, so companies should closely monitor the list for any changes.

1. _{Trump signs $1 trillion annual defense bill without fanfare. Reuters (December 18, 2025). https://www.reuters.com/business/aerospace-defense/trump-expected-sign-1-trillion-annual-defense-bill-2025-12-18/.}
2. _{National Defense Authorization Act for Fiscal Year 2026 (NDAA), Pub. L. No. 119-16, § 851(b).}
3. _Id.
4. _{3558, 118th Cong. (2024).}
5. _{NDAA § (f)(2)(A).}
6. _{NDAA § (f)(2)(A); Press Release, Jan. 7, 2025, U.S. Department of Defense, DOD Releases List of Chinese Military Companies in Accordance with Section 1260H of the National Defense Authorization Act for Fiscal Year 2021, https://www.defense.gov/News/Releases/Release/Article/4023145/dod-releases-list-of-chinese-military-companies-in-accordance-with-section-1260/.}
7. _{NDAA § (f)(2)(B).}
8. _{NDAA § (f)(2)(B)(iii)(I)-(III).}
9. _{NDAA § (f)(1).}
10. _{NDAA § (f)(2)(C).}
11. _{NDAA § (k)(3).}
12. _{NDAA § (k)(3).}
13. _{NDAA § (e)(4).}
14. _{NDAA § (c)(1).}
15. _{NDAA § (c)(2).}
16. _{NDAA § (c)(3)(A).}
17. _{NDAA § 851(c)(3)(A).}
18. _{NDAA § 851(c)(3)(B).}
19. _{NDAA § 851(f)(5)(A)(v).}
20. _{NDAA § 851(f))(5)(A)(ii).}
21. _{NDAA § 851(f)(5)(A)(iii).}
22. _{NDAA § 851(f)(5)(B), § 851(f)(6).}
23. _{NDAA § 851(f)(7).}
24. _{NDAA § 851(f)(7).}
25. _{NDAA § 851(f)(2)(A); § 851(d)(1)(A).}
26. _{NDAA § 851(d)(1)(B).}
27. _{NDAA § 851(d)(1)(B).}
28. _{NDAA § 851(a)(2)(B); S. Amdt. 3841 to S. 2296, 119^th Cong. (2025) § (a)(2)(B).}
29. _{NDAA § 851(c)(2); S. Amdt. 3841 to S. 2296, 119^th Cong. (2025) § (c)(2).}
30. _{NDAA § 851(c)(3)(A); S. Amdt. 3841 to S. 2296, 119^th Cong. (2025) § (c)(3)(A).}
31. _{NDAA § 851(e)(2)(A)(i); S. Amdt. 3841 to S. 2296, 119^th Cong. (2025) § (e)(2)(A)(i).}
32. _{NDAA § 851(e)(2)(A)(i); S. Amdt. 3841 to S. 2296, 119^th Cong. (2025) § (e)(2)(A)(i).}
33. _{NDAA § 851(f)(2)(A); S. Amdt. 3841 to S. 2296, 119^th Cong. (2025) § (f)(2)(A).}
34. _{NDAA § 851(f)(7); (f)(4)}
35. _{NDAA § 851(l).}
36. _{NDAA §§ 851(a)(1)-(2); (b)(1)-(2).}
37. _{NDAA § 851(k)(2).}