On December 18, 2025, as part of the Fiscal Year 2026 National Defense Authorization Act (NDAA), President Trump signed into law the BIOSECURE Act (the Act), which limits US government procurement from and grants to “biotechnology companies of concern” (BCCs). Under the Act, US government agencies cannot (1) buy or obtain biotechnology equipment or services provided by a BCC; (2) enter into, extend, or renew a contract with any entity using biotechnology equipment or services provided by a BCC to perform a government contract; or (3) expend loan or grant funds for biotechnology equipment or services provided by a BCC,§ 851(a)-(b). whether directly or through a loan or grant recipient.
Under the law, “biotechnology equipment or service” means any equipment, instrument, apparatus, machine, or device used in the research, development, production, analysis, detection, or provision of information relating to biological material — including components, accessories, software, firmware, digital components, data storage, transmission, advising, consulting, disease detection, and more.§ 851(k)(2)(A)-(C).
The Act does not name specific companies as BCCs but treats any company on the Department of Defense (Department of Warhttps://www.whitehouse.gov/presidential-actions/2025/09/restoring-the-united-states-department-of-war/.) 1260H list of “Chinese military companies”The Department of Defense's 1260H list identifies Chinese military companies operating, directly or indirectly, in the US, aiming to expose and counter China's military modernization efforts. The 1260H list is published annually in the Federal Register. DOD Releases List of Chinese Military Companies in Accordance with Section 1260H of the National Defense Authorization Act for Fiscal Year 2021, U.S. Department of War, January 7, 2025. as a BCC — including BGI, FGI, and MGI.§ 851(f)(2)(a). By December 18, 2026, the Director of the Office of Management and Budget (OMB) will publish a full list of BCCs based on recommendations from key federal Secretaries and Directors, including Defense, Justice, Health and Human Services, Commerce, National Intelligence, Homeland Security, State, and National Cyber.§ 851(f)(1)-(4). The Director of OMB will thereafter review and update that list at least annually, based on recommendations from those key federal Secretaries and Directors.§ 851(f)(4).
To be designated a BCC, a company must:
Subsidiaries, parents, affiliates, and successors of named BCCs are also considered BCCs if they are directed or controlled by, or act on behalf of, the government of a foreign adversary.§ 851(f)(2)(C).
Currently, prominent global pharmaceutical contract research, development, and manufacturing organizations WuXi AppTec, WuXi Biologics, and WuXi XDC are not designated as BCCs under the Act, either via the 1260H or OMB lists. However, press reports have indicated that WuXi AppTec is proposed for inclusion on the next update of the 1260H list, which would make it a BCC. In addition to those press reports, on December 18, 2025, the Chairs of multiple Senate and House committees, including the House Select Committee on China, sent a letter to the Department of Defense recommending that WuXi AppTec, WuXi Biologics, and WuXi XDC be added to the 1260H list, which would make all of those entities BCCs.
The 1260H list was updated by the Department of Defense in January 2024 and January 2025, and we expect the 1260H list will be updated in January 2026.
The Act provides a five-year safe harbor for existing contracts with companies later designated as BCCs under the 1260H or OMB lists.§ 851(c)(3)(A). The five-year window begins when the Federal Acquisition Regulation (FAR) is updated to implement the Act’s requirements, allowing entities five years to fulfill current contracts, transition to alternative suppliers, and wind down business with BCCs.§ 851(c)(3)(A). This safe harbor is unavailable for existing contracts with companies named on the 1260H list as of December 18, 2025.
Further, “biotechnology equipment or services” excludes items previously, but no longer, produced by BCCs.§ 851(c)(3)(B). Therefore, an entity may retain and continue to use equipment or technology that was formerly, but is no longer, produced or provided by a BCC.
The Act also excepts from its restrictions certain intelligence activities, acquisition or provision of overseas healthcare services, acquisition of publicly or commercially available multiomic data, and declared public heath emergencies.§ 851(e).
Under certain circumstances, entities designated by the OMB — but not those listed on the 1260H list — might be able to successfully shed their designation as a BCC through a process outlined in the Act.Companies designated on the 1260H list have brought actions against the US government to be removed from that list; however, there is no specific process included in the Act for the 1260H list.
First, the US government’s notice to the designated company might include mitigation steps the company can take to improve its status. If the company takes those steps, the government may rescind the designation.§ 851(f)(5)(A)(v). However, the inclusion of mitigation steps in the notice and the rescission of the designation are subject to the government’s discretion.
Second, the US government’s notice must explain why the company has been designated as a BCC, including the criteria and information relied upon.§ 851(f)(5). However, some details may be withheld if they are classified.§ 851(5)(A)(ii).
BCCs may challenge their designation within 90 days of receiving the notice.§ 851(f)(5)(A)(iii). If a company does so, the Director of the OMB — along with relevant agencies — must issue a final decision to the company before publicly disclosing the designation.§ 851(f)(6). However, the Act does not specify a deadline for the OMB’s final decision.
If a company on the BCC list believes it no longer meets the definition of a BCC, it can submit evidence and arguments to request removal.§ 851(f)(7). The Director of the OMB must respond within 90 days and may modify the BCC list to exclude the company.§ 851(f)(4); §851(f)(7).
The Act does not bar a US company from receiving federal contracts or grants simply because it does business with a BCC. The restriction applies only when a federal contract or grant would procure covered biotechnology equipment or services — directly or indirectly — from a designated company.§ 851(a)-(b).
The head of an executive agency may waive the Act’s restrictions for up to 365 days, with approval of the Director of the OMB.§ 851(d). This waiver can be renewed once for an additional 180 days.§ 851(d)(1)(A)(ii).
For companies like BGI, FGI, and MGI, which are already on or added to the 1260H list before the Act takes effect, the ban starts 60 days after the FAR is updated to implement the restrictions.§ 851(c)(1). For companies designated as BCCs by the OMB or added to the 1260H list after enactment, the restrictions take effect 90 days after the FAR update.§ 851(c)(2).
The Act has potentially significant implications for pharmaceutical manufacturers that rely on biotechnology equipment or services from a BCC.§ 851(a)-(b).
The Act’s restrictions reach the Department of Veterans Affairs’ Federal Supply Schedule (VA FSS) contracts because the VA is an executive agency. Significantly, the Veterans Health Care Act of 1992 requires that pharmaceutical companies make “covered drugs” “available for procurement” by the government through the VA FSS. Moreover, a VA FSS agreement is required for a pharmaceutical company to be eligible for reimbursement under Medicaid and Medicare Part B programs. This means manufacturers that use covered equipment or services from a BCC to perform an FSS contract would be ineligible to enter, extend, or renew that contract, absent a waiver or exception.§ 851(a); § 851(c)(3)(A) § 851(d); § 851(e).
At the same time, Congress included a specific “deeming” provision to avoid collateral consequences for reimbursement under Medicaid and Medicare Part B when the Act’s restrictions are the only barrier to a VA master agreement.§ 851(l). Specifically, for purposes of Medicaid and Medicare Part B, a manufacturer is deemed to satisfy the Veterans Health Care Act, 38 U.S.C. § 8126 — including the requirement for a VA FSS contract — if the Secretary of Veterans Affairs determines the manufacturer would comply and has offered to comply with section 8126, and would have entered into required agreements with the government, but for the Act’s prohibitions.§ 851(l).
In practice, this provision preserves Medicaid and Medicare Part B reimbursement eligibility even if the manufacturer cannot enter into or maintain a VA FSS contract solely because of the Act’s contracting bar, provided the VA makes the requisite determination.§ 851(l). However, this “deemed” compliance does not result in a VA contract but merely preserves Medicaid and Medicare eligibility. We have not yet seen how the VA intends to implement this anticipated review process to apply this “deeming” provision.