OMB's list of biotechnology companies of concern is due December 18, 2026. Once the prohibitions take effect, federal grant funds can't pay for equipment or services from a listed company, or for contracts with suppliers that use them. Here is what the law says, when it bites, and how to prepare.
A law that stops federal grant and contract money from paying for biotech equipment or services from “biotechnology companies of concern.”
OMB names the companies by December 18, 2026. The bans start after a FAR rule: 2028 at the earliest.
Inventory the biotech you buy with federal funds, find who makes and owns it, and ask suppliers what they use.
The BIOSECURE Act is Section 851 of the National Defense Authorization Act for Fiscal Year 2026, signed December 18, 2025. It bars federal agencies from buying biotechnology equipment or services from “biotechnology companies of concern,” and bars grant and loan recipients, universities included, from using federal funds to do so.
Enacted as Sec. 851 of Public Law 119-60, the FY2026 NDAA, on December 18, 2025. The statute's own title is “Prohibition on Contracting With Certain Biotechnology Providers”; the BIOSECURE name comes from the earlier bills.
The Office of Management and Budget must publish the list of biotechnology companies of concern within one year of enactment: by December 18, 2026.
Sec. 851(f)(1)
The prohibitions start 60 or 90 days after the Federal Acquisition Regulation is revised to carry them. As of October 15, 2026, no OMB notice or FAR case has been published.
Sec. 851(c), (h)
A company becomes a biotechnology company of concern in one of three ways: it is on the Defense Department's Section 1260H list and OMB finds it is in biotech; OMB finds it meets three statutory criteria for control by a foreign adversary and national security risk; or it is a parent, subsidiary or successor of either.
Defense's Chinese military companies list, plus OMB's biotech test.
Foreign-adversary control, in biotech, and a security risk.
Of an A or B company, meeting the same criteria.
Due December 18, 2026, and reviewed at least once a year.
A company on the Section 1260H list that OMB's process finds is involved, to any extent, in making, distributing, providing or procuring biotechnology equipment or services. A 1260H listing alone is not enough; the biotech test still runs through OMB.
Sec. 851(f)(2)(A)
All three must hold: the company is under the direction or control of, or acts for, the government of China, Russia, Iran or North Korea; it is involved in biotechnology; and it poses a risk through ties to that government's military, security or intelligence services, by providing multiomic data to that government, or by obtaining human multiomic data without informed consent.
Sec. 851(f)(2)(B); “foreign adversary” per 10 U.S.C. 4872(f)
A subsidiary, parent or successor of a Pathway A or B company is covered too, if it meets the same Pathway B criteria. Ownership structure matters as much as the brand name on the instrument.
Sec. 851(f)(2)(C)
The OMB list is due December 18, 2026. OMB guidance follows within 180 days of the list, the Federal Acquisition Regulation is revised within a year of that guidance, and the prohibitions take effect 60 or 90 days after the FAR revision. If every deadline is met, that is 2028 at the earliest.
Sec. 851 of the FY2026 NDAA. Every later deadline counts from this date or from the list.
The Defense Department's annual list of Chinese military companies, the source of Pathway A, appeared in the Federal Register at 91 FR 35189 and includes several genomics and biotechnology companies. In August 2026 a federal court preliminarily blocked one company's 1260H designation; OMB's own Pathway B is not bound by that order.
The statutory deadline for the first list of biotechnology companies of concern.
Sec. 851(f)(1)
How agencies are to carry out the prohibitions.
Sec. 851(f)(3)
The FAR rule is what turns the prohibitions on, and will set how far they reach into subcontracts.
Sec. 851(h)
60 days for Pathway A companies, 90 days for Pathways B and C. The five-year window for existing contracts starts here.
Sec. 851(c)
The mid-2027 and mid-2028 dates are our arithmetic from the statute's deadlines, assuming each is met. Agencies often miss statutory deadlines; the list date is the one to plan around.
Until five years after the FAR revision that identifies a company, the prohibitions on contracting with an entity that uses that company's equipment or services do not apply to equipment or services provided under a contract or agreement, including previously negotiated options, entered into before the effective date.
Read the text closely: the window names only subsections (a)(2) and (b)(2). It does not, by its words, cover the separate bar on a grant recipient itself procuring, obtaining or using a company of concern's equipment or services with grant funds. That is our reading of the plain text; confirm it with counsel and watch for OMB's guidance.
Equipment or services a company formerly produced or provided, but no longer does, fall outside the law entirely.
Sec. 851(c)(3)(A)–(B)
The law reaches universities directly. An agency may not obligate grant or loan funds to, and a grant or loan recipient may not use those funds to, procure, obtain or use biotechnology equipment or services from a company of concern, or contract with an entity that uses them. The restriction follows the federal funds, not the whole institution.
Awards the grant or loan.
May not obligate funds for a listed company's biotech.Spends the grant funds.
Can't use grant funds to buy, obtain or use a listed company's biotech equipment or services.Does the work under contract.
Can't be paid with grant funds if it uses listed biotech on your work, or knowingly signs on to.The instruments and services your supplier relies on.
Reached through what your supplier knows; the FAR rule will set how far down.Sec. 851(k)(2)
Sec. 851(d)–(e)
Start now, before OMB publishes: inventory the biotechnology equipment and services paid for with federal funds, identify each maker, provider and parent company, ask your vendors and subcontractors what they use downstream, screen the inventory against the existing 1260H list, and add supplier terms to new contracts.
For agreements signed before the effective date, the five-year window can cover a supplier's use, but not your own buying or using.
Sequencers and other instruments, their software and firmware, reagents and consumables tied to an instrument platform, sequencing and analysis services, service and maintenance agreements, and biological data storage. Start with core facilities and the largest grant-funded labs.
Ask: which of these are charged, in whole or in part, to a federal award?Record the manufacturer, the reseller or service provider, and the parent company. Pathway C reaches parents, subsidiaries and successors, so a U.S.-branded subsidiary can still be covered.
Ask: who ultimately owns the company on the invoice?The law bars contracting with an entity that uses a company of concern's equipment or services in performing the contract, or that knowingly enters a contract requiring that use. Ask contract research organizations, sequencing vendors and subcontracted labs which instruments and downstream providers they use for your work.
Ask: will any of your work for us run on equipment or services from a listed company?Pathway A starts from a public list that exists today. Screen your inventory against it now, then again when OMB publishes in December 2026 and at every annual update.
Add a representation and flow-down to new and renewed biotechnology purchase and service agreements so suppliers must tell you if they use, or become, a company of concern. The five-year window protects agreements entered before the effective date, so the terms you sign now matter.
For anything that matches, note the award, the contract date, whether the five-year window could apply, and the alternative. A dated, documented review is what an auditor or sponsor will ask to see.
Short answers to the questions research security, sponsored programs and compliance offices ask most often about BIOSECURE Act. Each answer is a summary for orientation; the statute, regulation or agency notice cited on this page has the final word.
Yes. It was enacted as Section 851 of the National Defense Authorization Act for Fiscal Year 2026 (Public Law 119-60), signed December 18, 2025. The statute calls itself the “Prohibition on Contracting With Certain Biotechnology Providers”.
OMB must publish it within one year of enactment, by December 18, 2026. Pathway B designations stay non-public until OMB makes a final determination after a 90-day opposition period.
Yes, through federal grant and loan funds. A recipient may not use those funds to procure, obtain or use biotechnology equipment or services from a company of concern, or to contract with an entity that uses them. Institutional funds outside the award are not restricted by the statute.
60 days (Pathway A) or 90 days (Pathways B and C) after the Federal Acquisition Regulation is revised. The FAR revision is due within one year of OMB's guidance, which is due within 180 days of the list, so 2028 at the earliest if every deadline is met.
Partly. For five years after the FAR revision, the bars on contracting with entities that use a company of concern's products do not apply to equipment or services under contracts entered before the effective date. The window does not, by its text, cover a grant recipient's own procurement or use with grant funds.
No. Acquiring, using or distributing lawfully compiled human multiomic data that is commercially or publicly available is expressly excepted.
Indirectly. Agencies may not contract with an entity that uses a company of concern's equipment or services in performing the contract, or that knowingly enters a contract requiring that use, and grant recipients may not contract with such entities. How far down the supply chain this flows will be set by the FAR rule.
This page summarizes federal law and policy for orientation and is not legal advice. Your sponsored programs office and counsel have the final word on what your institution certifies and how it complies.
What the OMB list means for institutions: the designation pathways, the timeline, and the supplier audit.
Read the guide →What the Defense Department's list is, what a listing triggers, and how to screen collaborators against it.
Read the guide →Each agency's talent program certification side by side: effective date, notice, who certifies and how.
Read the guide →What to review before an audit, how to assess export-control exposure, and what a defensible mitigation plan holds.
Read the guide →What the CHIPS and Science Act forbids, what it protects, and where talent programs show up on the record.
Read the guide →The four factors Defense program officers weigh for fundamental research proposals, explained.
Read the guide →All guides → New to the terms? The research security glossary →
We'll show your office how SYSWERX screens researchers' collaborations and funding against government lists, and keeps every decision in a documented case.