BIOSECURE Act

^{Editors note: This article has been updated on 28 January 2026 to reflect the provisions as enacted in the National Defense Authorization Act for Fiscal Year 2026, which differ in certain respects from the original BIOSECURE Act (H.R. 8333) as passed by the House of Representatives.}

The National Defense Authorization Act for Fiscal Year 2026 includes provisions derived from the BIOSECURE Act (H.R. 8333), legislation which impacts supply chains and partnerships across the global biotechnology sector. For biopharma companies with US market exposure, understanding the implications is critical to maintaining business continuity.

The Act prohibits US federal agencies from contracting with companies that use biotechnology equipment or services from designated "biotechnology companies of concern." 

This extends beyond direct government contracts, it captures the entire supply chain, including grant and loan recipients.

Rather than naming specific companies (in comparison to the proposed BIOSECURE ACT H.R.8333), the legislation references the Department of Defense's "1260H list" of Chinese military companies operating in the United States. Additional companies may be designated through a formal review process if they meet specified criteria relating to foreign adversary control and national security risk. Biopharma companies should verify whether key suppliers appear on the current 1260H list or are designated through subsequent regulatory action.

• Supply chain exposure
  If your organisation relies on any of the companies on the 1260H list for sequencing services, contract development and manufacturing (CDMO) arrangements, or research partnerships, you may find yourself ineligible for US government contracts or federal funding. This isn't limited to defence contractors, it touches anyone in the federal procurement ecosystem.
• The multiomic data question
  The legislation takes a particularly keen interest in human multiomic data, defined as genomics, epigenomics, transcriptomics, proteomics, and metabolomics. Rather than directly prohibiting data sharing, the law uses multiomic data practices as criteria for designating companies as biotechnology companies of concern. Once designated, federal agencies are prohibited from procuring from or contracting with that company. Notably, an exception exists for multiomic data that is lawfully compiled and commercially or publicly available.
• Public health emergency exception
  Importantly, Section 881 includes an exception for the procurement of medical countermeasures, medical products, and related supplies in direct response to a public health emergency declared under the Public Health Service Act. This exception was not present in the original BIOSECURE Act and may provide relief for certain biopharma procurement activities during declared emergencies.
• Timeline pressures
  The law includes a limited 5-year safe harbor for certain existing assets/contracts.

This legislation reflects a broader trend towards dissecting biotechnology supply chains through a national security lens. Whether or not your organisation currently engages with US government contracts, the direction of travel is clear. Commercial partners and investors will increasingly expect visibility into supply chain provenance and data handling practices.

For companies with exposure to the companies on the 1260H list, the transition period offers an opportunity to diversify partnerships and de-risk operations. For those without direct exposure, the lesson is equally valuable: supply chain resilience and robust data governance are no longer merely operational considerations.

• Conduct a thorough supply chain review.
  Map your dependencies on the companies on the 1260H list, including indirect relationships through subcontractors and service providers. Many organisations will discover unexpected exposure.
• Review your partnership agreements.
  Consider whether existing arrangements with the companies on the 1260H list can be transitioned and begin exploring alternative providers. The CDMO landscape is competitive, but capacity constraints are real, early movers will have more options.
• Strengthen your data governance
  Ensure robust consent mechanisms are in place for any human multiomic data collection. Document your data handling practices and be prepared to demonstrate compliance to partners and customers conducting their own due diligence.