The BIOSECURE Act Becomes Law in the United States

On December 18, 2025, President Trump signed into law a revised version of the BIOSECURE Act (BIOSECURE or the Act) as Sec. 851 of the FY26 National Defense Authorization Act (NDAA; P.L. 119-60), ushering in a new era of restrictions on the use of certain foreign biotech equipment and service providers.¹ Although amended and clarified in important ways, the Act includes the same basic prohibition as the original legislation: federal agencies must not enter into, extend, or renew any “contract” with an entity that uses “biotechnology equipment or services” from a “biotechnology company of concern” in performance of their federal contract(s).

While the enacted version of BIOSECURE clarified some questions posed by prior versions of the legislation, uncertainty remains, including with respect to the specific Chinese biotechnology equipment and service providers that were targeted by name in prior versions of the legislation. Based on the enacted language, federal contractors can now assess their arrangements with companies that may be at risk of being designated “biotechnology companies of concern” (BCC) under BIOSECURE and consider whether to modify (or decline to extend) those arrangements to protect their contracts with the federal government. Importantly, the Act’s prohibitions do not take immediate effect, meaning biotechnology companies have some time to evaluate their contractual arrangements and, if necessary, transition to new service and equipment providers.

In this Advisory, we provide a brief overview of BIOSECURE and then outline the key revisions since BIOSECURE was introduced as a floor amendment to the Senate’s FY26 NDAA earlier this summer (see our August 2025 Advisory). These revisions resolve technical issues, address potential disruptions to Medicare Part B and Medicaid reimbursement, and now provide a process for BCCs to request removal from the list.

I. Overview of BIOSECURE

The BIOSECURE Act prohibits the federal government from (1) procuring or obtaining any biotechnology equipment or service from a BCC or (2) entering into, extending, or renewing a contract with any entity that uses biotechnology equipment or services from a BCC in performance of such federal contract.

Identifying Biotechnology Companies of Concern

BCCs are defined as any entity that “is to any extent involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or service” as determined by the Director of the Office of Management and Budget (OMB). There are three ways entities can end up on the list of BCCs published by OMB, which must be published no later than December 2026:

• First, the entity can be included on the annual 1260H list of “Chinese military companies operating in the United States,” which is issued by the U.S. Department of War [Defense] in accordance with Section 1260H of the FY 2021 NDAA.

• Only such 1260H entities that are designated by OMB as being involved in manufacturing, distribution, provision, or procurement of biotechnology equipment or services are included on the BCC list.

• Second, the entity can be designated by OMB as a BCC if it:

(1) Is subject to the control or operates on behalf of the government of a foreign adversary (i.e., China, North Korea, Russia, or Iran);

(2) Is to any extent involved in the manufacturing, distribution, provision, or procurement of a biotechnology equipment or service; and

(3) Poses a risk to the national security of the United States based on:

(i) Engaging in joint research with, being supported by, or being affiliated with a foreign adversary’s military, internal security forces, or intelligence agencies

(ii) Providing multiomic data obtained via biotechnology equipment or services to the government of a foreign adversary

(iii) Obtaining human multiomic data via the biotechnology equipment or services without express and informed consent

• Finally, OMB may designate as a BCC any “subsidiary, parent, affiliate, or successor of an entity” described above, provided certain criteria are met.

There are a few narrow exceptions to the Act’s prohibitions, including for the provision of health care services for overseas employees and covered beneficiaries, as well as the procurement of medical countermeasures in response to a public health emergency. The Act also establishes that a federal agency may waive the Act’s prohibitions on a case-by-case basis, for a limited time period.

Companies not on the 1260H list have an opportunity to contest the designation before it is made public. The legislation also includes a safe harbor provision making clear that the Act will not apply to “biotechnology equipment or services” that were previously, but are no longer, produced or provided by BCCs.

Delayed Effective Dates

The prohibitions set forth in the Act do not apply immediately upon enactment — even to entities presently on the 1260H list, or that could be added in the anticipated January 2026 update. Now that the BIOSECURE Act is law, OMB must publish the list of designated BCCs by December 2026 and issue guidance implementing the provisions of the Act. Once these two steps happen, then the Federal Acquisition Regulatory Council must revise the Federal Acquisition Regulation (FAR) within one year. For 1260H entities, the Act’s prohibitions will become effective 60 days after the FAR is revised. For all other entities designated as BCCs, the Act’s prohibitions will become effective after 90 days. As such, the Act’s prohibitions may not take effect until 2027. Companies are nevertheless advised to consider these prohibitions now, particularly if they are considering new contracts.

Grandfathering Period

BIOSECURE includes a grandfathering period for certain contractual arrangements with BCCs. Specifically, contracts entered into before the applicable effective date are grandfathered for five years from the date the FAR is revised with respect to that BCC.

II. Key Enacted Revisions to BIOSECURE

As enacted, BIOSECURE has been revised to address some of the concerns raised, including changes to key definitions and a critical clarification as to the legislation’s potential impact on Medicare Part B and Medicaid reimbursement. We outline those changes below.

Biotechnology Company of Concern

The definition of “biotechnology company of concern” has been revised such that entities identified in the annual 1260H list and entities not on this list are subject to the same threshold criteria concerning involvement in manufacturing, distribution, provision, or procurement of biotechnology equipment or services. Previously, all entities in the 1260H list were deemed BCCs for purposes of BIOSECURE. Now, all entities on the 1260H list are a BCC only if the entity is on the 1260H list and “is to any extent involved in the manufacturing, distribution, provision, or procurement of any biotechnology equipment or service, as determined by the process established in paragraph (1).”² The enacted bill also clarifies that subsidiary, parent, affiliate, or successor entities are identified based on the OMB process, which was previously unclear.³

Unlike earlier drafts of BIOSECURE, the enacted legislation does not name specific entities as BCCs (i.e., BGI, MGI, Complete Genomics, WuXi AppTec, and WuXi Biologics). With the BIOSECURE Act now law, we suggest closely monitoring for updates to the 1260H list, which is published annually by the Department of Defense (last updated January 7, 2025).⁴ Of particular interest across the biotechnology industry is whether WuXi AppTec, a contract research services company, will be added to the 1260H list or otherwise designated by OMB pursuant to the process set forth in the BIOSECURE Act.

Effective Dates

For entities added via the non-1260H OMB process, the Act’s prohibitions now take effect 90 days after the FAR is revised (the pre-October 2025 draft bill established an effective date of 180 days from revision of the FAR).⁵ The enacted bill also clarifies that an entity identified as a subsidiary, parent, affiliate, or successor of a biotechnology company of concern is subject to the same 90-day timeline. For entities added via updates to the 1260H list (which now requires OMB designation as a BCC, rather than being included by default), the timeline remains 60 days after the FAR is revised.

Definition of Contract

The term “contract” has been expanded to also include transactions entered into under 10 U.S.C. § 4021, relating to the Secretary of Defense’s “Other Transaction” authority for research projects. Thus, BIOSECURE’s prohibitions apply to (1) contracts subject to the FAR and (2) certain transactions entered into under 10 U.S.C. § 4021.

Removal Requests

Entities on the list of BCCs can now request to be removed if the entity does not think it meets the definition of a BCC.⁶ The Director of OMB considers such removal requests within a 90-day timeframe.

Exception for Health Care Services Overseas

The definition of employees of the U.S. and uniformed services to which the prohibitions do not apply now includes dependents of such employees, covered beneficiaries of such persons, and any other beneficiary if the overseas health care service’s acquisition or provision is carried out or administered by the head of a U.S. government department or agency.⁷

Medicare Part B, Medicaid, and Veterans Affairs Participation

A new subsection (l) has been added to address concerns that prior drafts of BIOSECURE could have unintentionally barred payment of a manufacturer’s drugs under Medicaid and Medicare Part B if the manufacturer was unable to participate in the Federal Supply Schedule as a result of BIOSECURE.

As background, under the Medicaid drug rebate statute, in order for payment to be available under Medicare Part B and Medicaid for a manufacturer’s covered outpatient drugs, the manufacturer must comply with 38 U.S.C. § 8126.⁸ In turn, the requirements under 38 U.S.C. § 8126 include that a manufacturer enters into a Master Agreement with the Secretary of Veterans Affairs, under which the manufacturer agrees to “make available for procurement on the Federal Supply Schedule” each covered drug of the manufacturer. The Federal Supply Schedule contract is subject to the FAR and thus is a “contract” subject to the prohibitions in BIOSECURE.

Under prior drafts of BIOSECURE, there was a concern that if the Act prohibited a manufacturer from entering into a Federal Supply Schedule contract, that manufacturer could be deemed to have failed to comply with the provisions of 38 U.S.C. 8126, and as a result, the manufacturer’s drugs would not be payable under Medicare Part B or Medicaid.

To make clear that BIOSECURE will not impact payment for drugs under Medicaid and Medicare Part B, the enacted bill includes the following provision: “(l) Compliance with limitation on drug prices.—For the purposes of section 1927(a)(1) of the Social Security Act (42 U.S.C. 1396r-8(a)(1)), a manufacturer is deemed to meet the requirements of section 8126 of title 38, United States Code, including the requirement of entering into a master agreement with the Secretary of Veterans Affairs under such section, if the Secretary of Veterans Affairs determines that the manufacturer would comply (and has offered to comply) with the provisions of section 8126 of title 38, United States Code, and would have entered into a master agreement under such section, but for the prohibitions under subsections (a) and (b) of this section.”⁹

III. Looking Ahead

Key items to watch include:

• Subsequent updates to the 1260H list and implementation of the Act, including the release of the BCC list by OMB, guidance, and revisions to the FAR
• Oversight from Members of Congress who may wish to expand the legislation or criticize entities that continue to partner with BCCs — or potential BCCs — even as permitted by the legislation
• Related legislation and executive actions from the administration that may seek to limit clinical trial activities, investments, data transfers, licensing arrangements, and other partnerships

We stand ready to advise our clients on the potential impacts of BIOSECURE and its implementation. If you have any questions about the content discussed in this Advisory or would like more information, please reach out to one of the authors or your existing Arnold & Porter contact.

© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.