Final FY 2026 NDAA Includes BIOSECURE Act Provisions and New Opportunities for Biotech as DOD National Security Priority

On December 18, 2025, President Trump signed the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2026 into law and enacted the BIOSECURE Act, which restricts the ability of US executive agencies to contract with “biotechnology companies of concern” (BCCs). The BIOSECURE Act will have significant impacts on the biotech industry supply chain; companies that are engaged with BCCs will be completely cut off from federal contract and grant funding if they do not comply with this law.

Key Points for Life Sciences and Healthcare Companies

The BIOSECURE Act Is in Effect

After two years of back-and-forth in the U.S. House of Representatives and Senate, the enacted 2026 NDAA retains a refined version of the BIOSECURE Act, though no longer under that name. (But, for ease of reference and per common industry vernacular, we will continue to refer to it as such.)

The BIOSECURE Act, as expected, restricts federal agencies, federal contractors, and recipients of federal grants and loans from procuring or using biotechnology equipment or services produced or provided by BCCs.

Unlike prior versions of the law that named specific BCCs, the enacted law designates BCCs via a combination of existing authorities and a new Office of Management and Budget–led interagency national security process.

Designation of Biotechnology Companies of Concern and Notice Provisions

Pursuant to the law, the Office of Management and Budget (OMB) must publish an initial list of BCCs no later than one year after the law’s enactment, and it must review and update that list at least annually. The BIOSECURE Act will result in BCCs being grouped into three categories, with different designation processes for each category:

• Category A: DOD 1260H Entities
  • Designation process? These are companies that the U.S. Department of Defense (DOD) has already identified as “Chinese military companies operating in the United States” under section 1260H of the FY 2021 NDAA or will identify as such in the future. This is a separate, DOD-driven process that the BIOSECURE Act incorporates by reference.
  • Notice provisions? The DOD process for identifying Chinese military companies is not public. DOD publishes an annual list, but there is no statutory requirement for advance notice to affected companies. There is also no obligation to disclose the evidentiary basis during deliberations.
• Category B: OMB-Designated Entities
  • Designation process? The law now gives the OMB the opportunity to designate other companies to the Biotechnology Companies of Concern list (the BCC list) if they meet a series of national security–focused criteria, including foreign adversary control or direction, involvement in biotechnology equipment or services, and identified national security risks (such as military affiliation or the handling of sensitive multiomic data). The OMB, together with other executive branch agencies, will annually review and update the BCC list, and it will evaluate whether additional entities should be designated or existing designations should be modified or removed, based on updated intelligence, risk assessments, and national security considerations.
  • Notice provisions? The statute provides a formal notice-and-review framework, under which the OMB issues a written notice of designation to the company that includes: (i) notice that a designation has been made; (ii) the criteria relied upon to make the designation “and, to the extent consistent with national security, the information [forming] the basis for the designation”; (iii) notice of the company’s right to “submit information and arguments in opposition” within 90 days; (iv) a description of the review process; and (v) when practicable, mitigation steps that could support rescission. The OMB must simultaneously transmit this notice to Congress and notify Congress within seven days of receiving any opposition materials from the company.
• Category C: Related Entities
  • Designation process? The BIOSECURE Act restrictions apply not only to the companies on the BCC list but also subsidiaries, parents, or successors of the first two categories that independently meet the same national security criteria applicable to the OMB-designated entities.
  • Notice provisions? The statute is technically silent on the notice mechanics specific to subsidiaries, parents, or successors; however, these entities must independently satisfy the same national security criteria applicable to OMB-designated entities. As a practical matter, these entities should expect an identical notice-and-review process, but forthcoming OMB guidance will be important to clarify this drafting gap.

Prohibition Timing

The BIOSECURE Act prohibitions do not take effect immediately. Instead, implementation will advance in phases:

• First, the OMB will publish the initial list of BCCs (“up to” one year after enactment).
• Next, the OMB will issue implementing guidance (“up to” 180 days after the list’s publication).
• Then, the Federal Acquisition Regulatory Council will revise the Federal Acquisition Regulation (FAR) to implement the BIOSECURE Act (up to one year after guidance is issued).
• Finally, the prohibitions take effect only after the FAR is revised, and then they apply on the following timelines:
  • 60 days for 1260H BCCs
  • 90 days for OMB-designated BCCs
  • 90 days for subsidiaries, parents, and successors of 1260H BCCs and OMB-designated BCCs

Safe Harbor and Grandfathering

Importantly, for five years after the FAR revision identifying a particular BCC, certain pass-through prohibitions do not “apply to biotechnology equipment or services […] provided under contract[s] or agreement[s], including previously negotiated contract options, entered into before the applicable effective date.” This provision ensures that relationships are not upended overnight but are subjected to a safe harbor period to permit an orderly transition to BIOSECURE Act compliance.

Medicaid Safeguard Added

The NDAA provides that manufacturers are deemed compliant with the Department of Veterans Affairs (VA) Federal Supply Schedule agreement requirement for participation in the Medicaid Drug Rebate Program if BIOSECURE Act restrictions prevent them from entering into or maintaining a VA agreement, provided the manufacturer would otherwise comply and has offered to do so.

New DOD Biotechnology Initiatives (A New Future Path for US Biotech Development?)

Beyond the BIOSECURE Act, the NDAA contains significant provisions for expanding the scope of and funding for the DOD’s involvement in the development of US biotechnology.

The NDAA’s DOD-focused biotechnology provisions find their origin in a report from earlier this year by the National Security Commission on Emerging Biotechnology (NSCEB), a bipartisan, bicameral independent advisory body to Congress, chaired by Sen. Todd Young (R-Ind). The report, “Charting the Future of Biotechnology: An action plan for American security and prosperity,” highlights how biotechnology is and needs to become a more significant decisive domain for both economic and military power and flags what many policymakers (as also evidenced by the BIOSECURE Act) have called a biotechnology race between the United States and China.

Consistent with the NSCEB’s recommendations, the NDAA directs the DOD to create a Biotechnology Management Office, develop and execute a defense biotechnology strategy, and align research, acquisition, and sustainment planning across the department. The statute directs the government to authorize programs to expand domestic production of defense-relevant biotechnology and use DOD purchasing power, advance market commitments, and public–private partnerships to create scalable US domestic supply capacity.

Companies across the biotechnology, data, manufacturing, clinical, contract research, and contract development and manufacturing ecosystem should continue assessing potential exposure and planning for a multiyear, phased implementation period.

Please read our prior BIOSECURE Act alerts for additional context and contact your Goodwin team with questions.