Key Takeaways
- The BIOSECURE Act, now part of NDAA, will put in motion government-wide restrictions on “biotechnology companies of concern” and eventually bar agencies from procuring their biotech equipment or services.
- Designations will focus on entities tied to foreign adversaries (including DoD 1260H Chinese military companies) and certain affiliates, with scope spanning sequencing platforms, software, and data services.
- Life sciences companies should begin preparing to closely monitor this space and existing work streams in anticipation of designations, and note a new process allowing designated companies to seek removal from the designations.
Congress ended months of uncertainty on December 17 by folding the BIOSECURE Act into the annual National Defense Authorization Act (NDAA), which authorizes funding for defense programs and outlines spending and new policy initiatives.
The effect of this legislation will be that so-called “biotechnology companies of concern” will no longer be able to provide certain biotechnology equipment or services to U.S. federal agencies, or to any other entities for use in connection with federal contracts, grants or loans, without jeopardizing customers’ federal funding.
Now that BIOSECURE is here, entities that work with the U.S. federal government or receive federal funding will want to take the new legislation into account when planning for procurement of equipment and services, while companies that are based in China or other designated countries and provide biotechnology equipment or services will want to take steps to ensure they are not designated as biotechnology companies of concern. Given the uncertain timing of the Act’s effective date and the evolving lists of prohibited companies, life sciences businesses and research institutions will want to monitor ongoing regulatory developments closely.
Background
In 2024, Congress sought to insert the BIOSECURE Act into the NDAA but it ultimately was not included in the final version due to concerns raised by various stakeholders and Members of Congress. After months of negotiations over the broader NDAA package, Congressional leadership gave the language the go ahead for inclusion this year as Section 851 of the NDAA.
After designating certain companies as “biotechnology companies of concern,” the BIOSECURE Act will place restrictions on those companies, and limit the ability of any business, institution or other entity to work with them on projects funded by federal government. Last year, the legislation explicitly named several companies in the bill – WuXi AppTec, BGI, MGI, and Complete Genomics, and WuXi Biologics – who have multi-faceted relationships with life sciences companies. While the latest version does not list companies, any entities that engage with the U.S. federal government need to be prepared for additional scrutiny of companies they contract with overseas.
There are several notable changes in the latest version. The final provisions are outlined below to assist in planning and navigating as the bill nears passage into law:
What is a Biotechnology Company of Concern?
Biotechnology companies of concern will be designated by the Office of Management and Budget (OMB), and can include: (1) entities involved with “biotechnology equipment or services” that are listed by the Department of Defense as Chinese military companies operating in the United States under a statutory list known as 1260H; and (2) entities involved with biotechnology equipment or services that are subject to the control or direction of a specified “foreign adversary” (currently North Korea, China, Russia and Iran) and that pose a national security risk, including through ties to foreign military or intelligence bodies, provision of multiomic data to a foreign adversary’s government, or obtaining human multiomic data without express and informed consent. Subsidiaries, parents, or successors of such entities that meet these risk criteria may also be included.
One new addition from prior iterations of the Act is that companies will have the ability to challenge their designation by providing information and arguments to request removal if they believe they do not meet, or no longer meet, the definition of a ‘biotechnology company of concern.’
“Biotechnology equipment or services” covers the tools and digital components used to work with biological materials—like genetic sequencers and related software or firmware needed to run them—as well as services that help research, develop, produce, analyze, detect, or provide information about biological materials, including storing or transmitting that data and offerings like disease detection and genealogy services; it also captures any additional items or services used with biological materials that OMB, after consulting relevant agencies, designates as necessary for national security.
What Restrictions Apply to a Biotechnology Company of Concern?
The bill would prohibit the head of any U.S. executive agency from procuring or obtaining biotechnology equipment or services produced or provided by a “biotechnology company of concern.” It also prohibits agencies from entering into, extending, or renewing contracts with, or expending loan or grant funds for, any entity that uses such covered equipment or services acquired after the effective date in performing work under the contract or using the funds.
When does the Act Become Effective?
Once the NDAA is signed into law, the Director of the OMB has up to one year to publish a list of entities that constitute biotechnology companies of concern. Thereafter, the OMB director has 180 days to establish guidance to implement the Act, and then the Federal Acquisition Regulatory Council has one year to revise the Federal Acquisition Regulation (FAR) to implement the Act.
Once the Federal Acquisition Regulation (FAR) is revised to implement the law, the prohibitions take effect on different timelines. For entities covered by the Department of Defense’s 1260H list, the prohibitions take effect 60 days after the FAR update. For other designated entities, they take effect 90 days after the FAR update, which was revised down from a previous version that gave 180 days.
Importantly, existing contracts are “grandfathered” for five years, meaning the prohibition on contracting with entities that use covered equipment or services does not apply to equipment or services produced or provided under contracts or agreements entered into before the applicable effective dates of the Act, including previously negotiated options. Contracts with newly designated biotechnology companies of concern that are entered into before the effective date of the designation are also grandfathered for five years after such effective date.
Next Steps
With the BIOSECURE Act now passed, the industry should watch for OMB’s initial list of “biotechnology companies of concern,” follow-on implementation guidance, and subsequent FAR updates that will trigger the prohibitions.
Stay tuned for more updates on the BIOSECURE Act implementation and its unique impact across industries.
