BIOSECURE Act Included in Final Draft NDAA Compromise Text

On Sunday, December 7, 2025, Congress released the final draft compromise version of the FY 2026 National Defense Authorization Act (NDAA), and the package includes the BIOSECURE Act, reflecting weeks of additional negotiation. The House is expected to vote this week, with the Senate to follow before the end of December.

Key points for life sciences and health care companies:

BIOSECURE Confirmed. The compromise NDAA retains the core BIOSECURE framework: federal agencies, grant recipients, and loan recipients will be restricted from using equipment or services from identified “biotechnology companies of concern,” including those on the DoD 1260H list and companies designated through an OMB-led national security process. The timeline for implementation is as follows:

• 1260H List is updated by DoD on a periodic – typically annual – basis.
• OMB must publish the initial list of “biotechnology companies of concern” no later than one year after enactment (with annual updates).
• OMB then has no later than 180 days to issue implementing guidance.
• The FAR Council must then revise the Federal Acquisition Regulation no later than one year after guidance is issued.
• Prohibitions then take effect 60 days (for 1260H entities) or 90 days (for newly designated entities) after the FAR is revised.
• A five-year grandfathering / wind-down period applies to contracts/grants/loans involving biotechnology equipment and services from “companies of concern” as of this effective date.

Medicaid Safeguard Added. To avoid unintended consequences, the NDAA provides that manufacturers remain deemed compliant with the VA federal supply schedule agreement requirement for Medicaid Drug Rebate Program participation if BIOSECURE restrictions prevent them from entering into a VA agreement.

New DoD Biotechnology Initiatives. The NDAA also includes several provisions expanding DoD investment in biotechnology, including new funding authority for bioindustrial manufacturing, a Biotechnology Management Office, and programs focused on supply-chain resiliency and commercialization.

Companies operating in the biotechnology, data, manufacturing, clinical, or CRO/CDMO ecosystem should continue assessing potential exposure and planning for the multi-year implementation period. Please see our October 10 alert on BIOSECURE 2.0 for context and reach out to your Goodwin team for assistance.