US House passes FY 2026 NDAA that includes BIOSECURE

The basic structure of BIOSECURE remains the same from the version included in the Senate-passed NDAA: executive agencies will be barred from procuring biotechnology equipment or services from “biotechnology companies of concern” and from entering into contracts performed using such equipment or services. Related prohibitions will apply to certain grants, loans, and cooperative agreements.

The term “biotechnology companies of concern” continues to include 1) companies on a list to be published by the Office of Management and Budget (“OMB”), as well as 2) companies included on Department of Defense/War (“DoD”)’s Section 1260H list of Chinese military companies. OMB remains responsible for establishing and managing an interagency process to identify biotechnology companies of concern, maintaining and updating a public list, and coordinating with the Federal Acquisition Regulation (“FAR”) Council on necessary changes to procurement regulations.

Passage and enactment are virtually certain. Once the NDAA is signed, OMB will need to establish the designation process, consult with national security and health agencies on criteria and specific entities, and coordinate with the FAR Council on regulatory execution.

Some noteworthy changes in the final bill:

• First, the conference text narrows the automatic capture of entities on DoD’s Section 1260H list of Chinese military companies. Under the Senate version, 1260H status alone effectively made a firm a biotechnology company of concern, even if the firm in question had no connection with biotechnology. The final bill now requires a biotechnology nexus: a 1260H-listed entity must also be involved to some extent in manufacturing, distributing, providing, or procuring biotechnology equipment or services. Recent news reports indicate that a Pentagon roster of companies to be added to the 1260H list in the next update includes WuXi Apptec.
• Second, affiliates of companies of concern are no longer “automatically” covered by BIOSECURE by virtue of their relationship to a covered company. The earlier Senate text had pulled in any subsidiary, parent, affiliate, or successor of a covered entity as a “biotechnology company of concern,” so long as it met only the “foreign adversary governance/control” criterion. The final bill drops the term “affiliate” entirely and only captures affiliates that are parents, subsidiaries, or successors. And these entities must meet the full set of criteria that apply to directly designated entities, including both the foreign adversary nexus and the specific biotechnology and national security risk factors.
• Third, the scienter standard for contractors is narrowed to require actual “knowledge.” The Senate-passed and earlier versions of the BIOSECURE bill broadly covered contractors that would “know or have reason to believe” that performance of a federal contract would require the use of prohibited biotechnology equipment or services. The final bill pares the restriction back to contracts that the contractor “knows” will require such use, a change that is no doubt welcome to contractors who may not have full visibility of relevant supply chains.
• Fourth, the final bill addresses potential Federal health program impact. We had flagged in our October 25, 2025 alert that although BIOSECURE applies only to federal procurement contracts, and not to reimbursement/payer contracts such as those supporting federal health programs, the bill could have “collateral” federal health program impact on pharma/biotechnology manufacturers supplying BIOSECURE-restricted product. The final text attempts to protect manufacturers from this impact by providing that a company will be deemed to be in compliance with its statutory requirement to make product available for procurement on Federal Supply Schedule contracts, and thus not blocked from Medicare Part B and Medicaid, if the Secretary of VA determines that the company “would comply” with the statutory requirement but for the prohibitions of BIOSECURE.
• Fifth, the final bill clarifies a politically sensitive topic: overseas health care for U.S. government personnel and their families. The earlier Senate-passed bill excepted U.S. employees and uniformed service members whose official duty stations are overseas, as well as certain contractor employees supporting them. The final bill expands that carve-out to explicitly include dependents, TRICARE-covered beneficiaries, and other categories of beneficiaries for whom care is provided by a U.S. department or agency, while maintaining the contractor-employee component.

A January 7, 2025, Federal Register Notice (“90 FR 1105) regarding additions to the 1260H List also published the Reconsideration Process. Entities on the 1260H List seeking reconsideration must submit the following information to DoD:

1. Entity Information:

1. The listed entity’s name and mailing address (including email address).
2. An authorized representative’s name and mailing address (including email address).

2. Statement of Reconsideration:

1. A statement indicating the entity’s intent to request reconsideration of the Department’s determination.
2. A detailed description, supported by evidence, explaining why the entity should be removed from the 1260H List.

3. Additional Information:

1. Arguments and evidence that demonstrate either 1) an insufficient basis for the listing, or 2) that the circumstances leading to the listing no longer apply.

We note, as a final point, that the timing profile is adjusted at the margins. BIOSECURE prohibitions still do not take effect until after OMB has acted and the FAR Council has amended the regulations. However, in the earlier Senate-passed version, the non-1260H entities added through the OMB process did not become subject to the procurement ban until 180 days after the FAR revisions. The final bill shortens that period to 90 days. For 1260H companies, the FAR implementation period of 60 days has not been revised.

Next steps

If you have questions or would like to discuss, please reach out to our BIOSECURE team: Joy Sturm, Allison Pugsley, Timothy Bergreen, Mike Druckman, Ajay Kuntamukkala, Ari Fridman, Cybil Roehrenbeck, Ashley Roberts, and Ashley Ruhe.