By the PharmaTradz BD Team. Published October 2026.
The BIOSECURE Act is a US law that stops federal agencies from buying biotechnology equipment or services from designated "biotechnology companies of concern", and from contracting with, or funding, organisations that use such equipment or services in federal work. After an earlier bill stalled in 2024, a revised version became law on 18 December 2025 as Section 851 of the National Defense Authorization Act for Fiscal Year 2026 (Public Law 119-60). Its prohibitions are not yet in force: as of October 2026 the official list of companies is still due, and the rules apply only after the Federal Acquisition Regulation is revised, which is expected around mid-2028.
The law does not ban private commercial trade, and it does not name any company. But because so many drug makers hold US government contracts, it is already shaping how pharma companies, CDMOs and their customers choose partners.
How the BIOSECURE Act became law
The idea went through two Congresses. The first version, H.R. 8333, passed the House of Representatives on 9 September 2024 by 306 votes to 81, under a fast-track procedure that needs a two-thirds majority. It named five companies directly and gave existing contracts a grandfathering period running to 1 January 2032. It was left out of the FY2025 defence bill in December 2024 and was never enacted, so it lapsed when the 118th Congress ended.
In the 119th Congress, a revised text was attached to the Senate's version of the FY2026 National Defense Authorization Act (NDAA), the annual defence policy law. The House's own NDAA did not include it. The final compromise kept it, and the revised version dropped the list of named companies in favour of designation through official processes.
| Date | Step |
|---|---|
| 9 September 2024 | H.R. 8333 passes the House, 306 to 81 |
| December 2024 | Left out of the FY2025 NDAA; the bill lapses with the 118th Congress |
| 9 October 2025 | Senate passes its FY2026 NDAA (S. 2296) with a revised BIOSECURE text |
| 10 and 17 December 2025 | House (312 to 112) and Senate (77 to 20) pass the final NDAA, S. 1071 |
| 18 December 2025 | Signed into law as Public Law 119-60; BIOSECURE is Section 851 |
| 8 June 2026 | US Department of Defense publishes an updated 1260H list that adds several biotechnology and genomics firms |
| By 18 December 2026 | Deadline for the Office of Management and Budget (OMB) to publish its list of biotechnology companies of concern |
| Within 180 days of that list | OMB implementing guidance due (around June 2027) |
| Within one year of the guidance | Federal Acquisition Regulation (FAR) revised (around June 2028) |
| 60 or 90 days after the FAR revision | Prohibitions take effect, depending on how a company was designated |
The later dates are statutory deadlines, not fixed events. Agencies can move faster or slower, so treat them as the expected outer path.
Who counts as a "biotechnology company of concern"
A biotechnology company of concern is a company that is involved to any extent in making, distributing, providing or procuring biotechnology equipment or services, and that is designated in one of three ways:
- The 1260H list. Any company on the Department of Defense's list of "Chinese military companies" (kept under section 1260H of the FY2021 NDAA) that is involved in biotechnology equipment or services.
- OMB designation. A company that is subject to the control or direction of the government of a foreign adversary (the law's list covers China, Russia, Iran and North Korea), is involved in biotechnology, and poses a national security risk. The risk factors include links to a foreign adversary's military or intelligence services, supplying multiomic data to such a government, and collecting human multiomic data without express, informed consent. Multiomic data means data about a person's genes, proteins, metabolism and similar biological layers.
- Related entities. Parents, subsidiaries and successors of a designated company that meet the same criteria.
Companies designated by OMB receive notice and 90 days to contest the designation, and any listed company can later ask to be removed. The enacted law itself names no company. The updated 1260H list of June 2026 does include several genomics and life sciences firms, and in August 2026 a federal district court granted one of them a preliminary injunction against its listing; that case is still open. Buyers should therefore check the official lists as they stand, rather than rely on press reports or older bill texts.
What the law prohibits
Biotechnology equipment or services is defined broadly. It covers instruments such as genetic sequencers and other machines used to research, develop, produce or analyse biological materials, with their software and firmware, plus related services such as research, production, analysis, data storage and transmission. OMB can add further items.
Once in force, the law stops US executive agencies from:
- Procuring biotechnology equipment or services produced or provided by a company of concern.
- Entering into, extending or renewing a contract with any organisation that uses such equipment or services, acquired after the effective date, in performing the federal contract, or that knowingly enters into contracts requiring their use.
- Using loan or grant funds to buy such equipment or services, or to pay others who will use them in the funded work.
There is a safe harbour for items a designated company used to provide but no longer does. Exceptions cover certain intelligence activities, health care for US personnel and their families overseas, publicly or commercially available multiomic data, and medical countermeasures in a declared public health emergency. An agency head may grant a waiver of up to 365 days with OMB approval, renewable once for up to 180 days.
A provision that matters to drug makers protects Medicaid and Medicare Part B access. Normally a manufacturer must hold a Department of Veterans Affairs pricing agreement to take part in those programmes. If BIOSECURE alone prevents that agreement, the manufacturer is treated as compliant, provided it would otherwise meet the pricing requirements.
Grandfathering and transition periods
Contracts and agreements entered into before the effective date for a given company, including previously negotiated options, can continue for five years from the FAR revision for that company. This is meant to give time to finish existing work and move to other suppliers. Several law-firm analyses read the text as giving no such runway to companies that were already on the 1260H list on 18 December 2025, so check that point with counsel.
A simple worked example. Suppose the FAR is revised in June 2028 and a CDMO is designated by OMB. The prohibition then applies from about September 2028 (90 days later). A drug developer that signed a development agreement with that CDMO in 2026 and uses it on a federally funded programme could keep that agreement running until about June 2033. A new agreement signed in October 2028 for the same federal work would not be allowed.
What it means for pharma companies, CDMOs and API buyers
The law reaches further than its federal focus suggests. Many manufacturers sell to the Department of Veterans Affairs or the Department of Defense, receive National Institutes of Health grants, or work on government-funded programmes. For them, any designated company in the chain becomes a commercial risk, even before the rules bite.
The definition is written around biological materials, so it bears most directly on biologics development and manufacture, cell and gene therapy, genomic sequencing, and laboratory testing on biological samples. Buyers of chemically synthesised APIs and intermediates are further from the core of the definition, but should still check whether any service in their chain, such as bioassays or biological testing, could fall inside it once the guidance is issued.
The practical response has three parts:
- Supply-chain mapping. List every supplier of biotechnology equipment, services and data handling, including sub-contractors and testing labs, and record ownership, site and country.
- Dual sourcing. For critical biologics steps, qualify a second source early. A tech transfer, comparability work and regulatory filing can take a year or more, which is why companies are starting now. Our guide to China and India as API sources covers the wider picture.
- Contract clauses. Add warranties that a supplier is not, and does not use, a designated company in your work; prompt notice if that changes; audit rights; and a termination or transition right with help on tech transfer.
What buyers should check
When you audit a supplier or prepare an RFQ, ask:
- Is the supplier, its parent or any subsidiary on the current 1260H list or the OMB list once published?
- Who owns and controls the company, and where is the work actually done?
- Which sequencers, analytical instruments or software does it use, and who makes them?
- Does it sub-contract any testing, sequencing or data storage, and to whom?
- Will it give a written BIOSECURE warranty and notify you within a set number of days of any designation?
- Does your product or programme touch any federal contract, grant or VA pricing agreement?
The usual quality questions still apply. Our guide to verifying a pharmaceutical supplier covers GMP status, certificates and red flags.
The opportunity for alternative suppliers
Stated plainly, the law only affects designated companies. Most manufacturers in China are not designated and remain open to US buyers, and Chinese regulatory pathways remain relevant for anyone selling into that market, as our explainer on the NMPA describes. China remains a major source of APIs and intermediates.
Still, companies that want to remove any doubt are spreading work across more countries. CDMOs, testing laboratories and equipment makers in the United States, Europe, India, South Korea, Japan and elsewhere are seeing more enquiries for second-source capacity. For those suppliers, the questions above are the ones customers will ask, together with inspection history, capacity and data-integrity controls. For buyers, the aim is resilience, not a blanket move away from any one country. Our overview of API price trends in 2026 looks at cost drivers and supply concentration.
How PharmaTradz can help
If you need a second source or want to map an existing chain, tell us the product, the services involved and whether the work touches US federal programmes. We match you with manufacturers and CDMOs in several countries and share their ownership, site and document details before you commit. Start with our CDMO guide hub, look up unfamiliar terms in our pharma abbreviations A-Z, or send us an RFQ directly.
Frequently Asked Questions(FAQs)
What is the BIOSECURE Act?
It is a US law that bars federal agencies from buying biotechnology equipment or services from designated "biotechnology companies of concern", and from contracting with or funding organisations that use such equipment or services in federal work. It is Section 851 of the National Defense Authorization Act for Fiscal Year 2026.
Has the BIOSECURE Act passed?
Yes. An earlier bill, H.R. 8333, passed the House in September 2024 but was not enacted. A revised version was signed into law on 18 December 2025 as part of the FY2026 NDAA (Public Law 119-60).
When does the BIOSECURE Act take effect?
Not yet. OMB must publish its list of companies by 18 December 2026, issue guidance within 180 days after that, and the FAR must then be revised within a year; the prohibitions apply 60 or 90 days after the FAR revision, which is expected around mid-2028.
Which companies are covered by the BIOSECURE Act?
The enacted law names no company. It covers biotechnology companies on the Department of Defense's 1260H list, companies OMB designates under the law's criteria, and their related entities, so check the current official lists rather than older bill texts.
Does the BIOSECURE Act ban importing APIs from China?
No. It does not ban imports or private commercial trade. It restricts US federal procurement, contracts, grants and loans involving designated companies' biotechnology equipment or services, which is why companies with federal business are reviewing their supply chains.
