Final FY 2026 NDAA Includes BIOSECURE Provisions and New Opportunities for Biotech as DoD National Security Priority

On December 18, 2025, President Trump signed the FY 2026 National Defense Authorization Act (2026 NDAA) into law and enacted the BIOSECURE Act, which restricts the ability of U.S. Executive Agencies to contract with “Biotechnology Companies of Concern.” The BIOSECURE Act will have significant impacts on the biotech industry supply chain—companies that are engaged with “Biotechnology Companies of Concern” will be completely cut off from federal contract and grant funding if they do not comply with this law.

Key Points for Life Sciences and Healthcare Companies

The BIOSECURE Act is in Effect

After two years of back-and-forth in the House and Senate, the enacted 2026 NDAA retains a refined version of the BIOSECURE Act, though no longer under that name. (But, for ease of reference and per common industry vernacular, we will continue to refer to it as such.)

The BIOSECURE Act, as expected, restricts federal agencies, federal contractors, and recipients of federal grants and loans from procuring or using biotechnology equipment or services produced or provided by “Biotechnology Companies of Concern.”

Unlike prior versions of the law which named specific “Biotechnology Companies of Concern,” the enacted law designates “Biotechnology Companies of Concern” via a combination of existing authorities and a new Office of Management and Budget-led interagency national security process (“OMB-designation process”).

Designation of “Biotechnology Companies of Concern” and Notice Provisions

Pursuant to the law, the Office of Management and Budget must publish an initial list of “Biotechnology Companies of Concern” no later than one year after the law’s enactment, and must review and update that list at least annually. The BIOSECURE Act will result in “Biotechnology Companies of Concern” being grouped into three categories, with a different designation processes for each category:

• Category A: DoD 1260H Entities.
  • Designation Process? These are companies that the Department of Defense (DoD) has already identified as “Chinese military companies operating in the United States” under Section 1260H of the FY 2021 NDAA or identify as such in the future. This is a separate, DoD-driven process that the BIOSECURE Act incorporates by reference.
  • Notice Provisions? The DoD process for identifying Chinese military companies is not public. DoD publishes an annual list, but there is no statutory requirement for advance notice to affected companies. There is also no obligation to disclose the evidentiary basis during deliberations.
• Category B: OMB-designated entities.
  • Designation Process? The law now gives OMB the opportunity to designate other companies to the Biotechnology Companies of Concern (“BCC”) list if they meet a series of national security-focused criteria, including foreign adversary control or direction, involvement in biotechnology equipment or services, and identified national security risks (such as military affiliation or handling of sensitive multiomic data). OMB, together with other executive branch agencies, will annually review and update the BCC list, including evaluating whether additional entities should be designated or existing designations should be modified or removed, based on updated intelligence, risk assessments, and national security considerations.
  • Notice Provisions? The statute provides a formal notice-and-review framework, under which OMB issues a written notice of designation to the company that includes: (i) notice that a designation has been made; (ii) the criteria relied upon to make the designation and, to the extent consistent with national security, the information forming the basis for the designation; (iii) notice of the company’s right to submit information and arguments in opposition within 90 days; (iv) a description of the review process; and (v) where practicable, mitigation steps that could support rescission. OMB must simultaneously transmit this notice to Congress and must notify Congress within seven days of receiving any opposition materials from the company.
• Category C: Related Entities.
  • Delegation Process? The BIOSECURE restrictions apply not only to the BCCs listed, but also to “subsidiaries, parents, or successors” of the first two categories that independently meet the same national security criteria applicable to the OMB-designated entities.  
  • Notice Process? The statute is technically silent on notice mechanics specific to subsidiaries, parents, or successors; however, these entities must independently satisfy the same national security criteria applicable to OMB-designated entities. As a practical matter, these entities should expect an identical notice and review process, but forthcoming OMB guidance will be important to clarify this drafting gap.

Prohibition Timing

The BIOSECURE prohibitions do not take effect immediately. Instead, implementation will advance in phases:

• First, OMB will publish the initial list of BCCs (“up to” one year after enactment).
• Next, OMB will issue implementing guidance (“up to” 180 days after list publication).
• Then, the FAR Council will revise the Federal Acquisition Regulation to implement BIOSECURE (up to one year after guidance is issued).
• Finally, the prohibitions take effect only after the FAR is revised, and then apply on the following timelines:
  • 60 days for 1260H BCCs;
  • 90 days for OMB-designated BCCs; and
  • 90 days for subsidiaries, parents, and successors of 1260H BCCs and OMB-designated BCCs.

Safe Harbor and Grandfathering

Importantly, for five years after the FAR revision identifying a particular BCC, certain pass-through prohibitions do not apply to biotechnology equipment or services provided under contracts or agreements (including previously negotiated options) entered into before the applicable effective date. This provision ensures that relationships are not upended overnight, but rather subject to a safe harbor period to permit an orderly transition to BIOSECURE Act-compliance.

Medicaid Safeguard Added

The NDAA provides that manufacturers are deemed compliant with the VA Federal Supply Schedule agreement requirement for participation in the Medicaid Drug Rebate Program if BIOSECURE restrictions prevent them from entering into or maintaining a VA agreement, provided the manufacturer would otherwise comply and has offered to do so.

New DoD Biotechnology Initiatives (A New Future Path for U.S. Biotech Development?)

Beyond BIOSECURE, the NDAA contains significant provisions for expanding the scope of and funding for DoD’s involvement in the development of U.S. biotechnology.

The NDAA’s DoD-focused biotechnology provisions find their origin in a report from earlier this year by the National Security Commission on Emerging Biotechnology (NSCEB) (a bipartisan, bicameral independent advisory body to Congress, chaired by Sen. Todd Young).¹ The report, Charting the Future of Biotechnology: An Action Plan for American Security and Prosperity, highlights how biotechnology is and needs to become a more significant decisive domain for both economic and military power, and further flagging what many policymakers (and as evidenced by BIOSECURE) have called a biotechnology race between the United States and China.

Consistent with the NSCEB’s recommendations, the NDAA directs DoD to create a Biotechnology Management Office, develop and execute a Defense Biotechnology Strategy, and align research, acquisition, and sustainment planning across the Department. The statute directs the government to authorize programs to expand domestic production of defense-relevant biotechnology and to use DoD purchasing power, advance market commitments, and public-private partnerships to create scalable U.S. domestic supply capacity.

Companies across the biotechnology, data, manufacturing, clinical, CRO, and CDMO ecosystem should continue assessing potential exposure and planning for a multi-year, phased implementation period.

Please see our prior BIOSECURE alerts for additional context and contact your Goodwin team with questions.