Senate Adopts Updated Version of BIOSECURE Act in NDAA

On Oct. 9, the Senate, by a voice vote, adopted an amendment to the National Defense Authorization Act (NDAA) from Sens. Bill Hagerty (R-TN) and Gary Peters (D-MI), which adds an updated version of the BIOSECURE Act to the annual defense legislation. While the House of Representatives did not include the BIOSECURE Act in the NDAA legislation it passed in September, it did previously pass a similar, earlier version of the legislation during the 118th Congress, which almost found its way onto the December 2024 Continuing Resolution (CR). Accordingly, there is an increased likelihood that the current version of BIOSECURE may be included in the NDAA conference report before the end of 2025 as the House and Senate negotiate the contours of a final bill.

Background

The BIOSECURE Act, first introduced in the Senate in late 2023 and House in early 2024, seeks to restrict the federal government from procuring or obtaining biotechnology equipment or services produced or provided by biotechnology companies of concern (BCOC), entering into contracts with companies that use such biotechnology equipment or services, or entering into contracts with entities who know or have reason to believe such contract will require the use of such biotechnology equipment or services. Likewise, the legislation also prohibits federal agencies from obligating or expending loan or grant funds to entities for these purposes.

Updates to Legislation

The amendment adopted by the Senate generally maintains these restrictions but makes important changes to the definition of “biotechnology company of concern,” effective dates and how the legislation treats existing contracts. These updates also alter the likely implementation timeline for the legislation.

Definition of “Biotechnology Company of Concern.”

The first iterations of the BIOSECURE Act explicitly named BGI, MGI, Complete Genomics, WuXi AppTec and WuXi Biologics as biotechnology companies of concern. This raised objections from Sen. Rand Paul (R-KY), then a senior member and now the chairman of the Senate Committee on Homeland Security and Government Affairs, where the legislation was referred. In the House, a notable number of Democrats, led by Rules Committee Ranking Member Jim McGovern (D-MA), also expressed similar concerns. In the updated text, no specific companies are named as BCOCs. Rather, the legislation ties designations of BCOCs to entities included on the existing “1260H List” of Chinese military companies operating in the United States, determined by the secretary of defense and published in the Federal Register, as well as qualifying subsidiaries, parents, affiliates and successors to these companies. Notably, BGI and MGI are listed on the 1260H List; however, WuXi AppTec and WuXi Biologics are not included on the list. While some have suggested that Complete Genomics is an affiliate of MGI and BGI and should therefore be considered a BCOC as defined by the bill, it also is not specifically included on the 1260H list.

Like the 2024 bill, the amendment adopted by the Senate establishes an administrative process through the Office of Management and Budget for publishing a list of additional BCOCs, which must be published not later than one year after enactment. Pursuant to the Fiscal Year 2021 NDAA, the 1260H list must also be updated at least annually by the secretary of defense, which means there are multiple avenues where additional BCOCs may be identified.

Effective Dates, Grandfathering, and Potential Implementation Timeline

Should the Senate amendment be signed into law as part of the final NDAA before the legislation can take effect, the director of OMB, in coordination with other agency heads, must, within 180 days of publishing the list of additional biotechnology companies of concern, establish guidance for carrying out the law. After this guidance is issued, the Federal Acquisition Regulatory Council must revise the Federal Acquisition Regulation (FAR) within one year to implement the requirements of the legislation. The prohibitions in the law then go into effect for new contracts, grants and loans issued 60 days after the FAR is updated for entities drawn from the 1260H list, and within 180 days after the FAR is updated for entities not included on the 1260H list.

Both the 2023/2024 version of the BIOSECURE Act and the Senate amendment include a rule of construction stating that, for a limited time period, the prohibitions on contracting with BCOCs will not apply to existing contracts entered into prior to the effective date. While the earlier versions of the BIOSECURE Act delayed implementation of those prohibitions on existing contracts until Jan. 1, 2032, the updated Senate amendment altered this, delaying the prohibitions until the date that is five years after the FAR is updated to reflect the identification of a biotechnology company of concern.

Practically speaking, were this legislation to be signed into law before the end of 2025, the BIOSECURE Act would be unlikely to take effect with respect to new contracts, grants or loans until Q3 or Q4 of 2028 for entities on the 1260H list, and until Q1 or Q2 of 2029 for entities named biotechnology companies of concern through the OMB process laid out in the legislation. Further, as shown in the chart below, it is a reasonable estimation that the contracting prohibitions would most likely not affect contracts entered into prior to the effective dates until mid-to-late 2033. The chart below outlines an approximate estimation of the implementation timeline, presuming BIOSECURE is signed into law later this year:

Event	Timing	Possible Date of Action
Congress enacts NDAA with BIOSECURE provisions.	Likely before the end of 2025.	Q4 2025
OMB, in coordination with other agencies, names new entities to list of biotechnology companies of concern.	Not later than one year of enactment.	Q4 2026
OMB, in coordination with other agencies, issues guidance for carrying out BIOSECURE provisions.	Not later than 180 days after naming new entities to the list of biotechnology companies of concern.	Q2‒Q3 2027
FAR updated to reflect naming of biotechnology companies of concern.	Not later than one year after OMB issuing guidance.	Q2‒Q3 2028
BIOSECURE prohibitions go into effect with respect to new contracts, grants and loans for entities on the 1260H list.	Not later than 60 days after FAR is updated to reflect biotechnology companies of concern.	Q3‒Q4 2028
BIOSECURE prohibitions go into effect with respect to new contracts, grants and loans for entities named through the BIOSECURE OMB process.	Not later than 180 days after FAR is updated to reflect biotechnology companies of concern.	Q4 2028‒Q1 2029
BIOSECURE contracting prohibitions go into effect with respect to contracts entered into prior to the effective date.	Five years after FAR is updated to reflect biotechnology companies of concern.	Q2–Q3 2033

Timelines are subject to shifting based on the date the law is enacted and the diligence with which the executive branch carries out the law; timelines may be moved up or slip depending on actions taken by federal agencies.

Next Steps

Despite the updates to the legislation, ambiguities remain, including what it means to use biotechnology equipment or services “in performance of” a federal contract. If the legislation were to be signed into law as written, these ambiguities will likely need to be addressed through guidance or the regulatory process.

 Informal conferencing between the House and Senate is already underway to negotiate a reconciled NDAA over the coming weeks or months, either through a formal conference committee or through an informal conference and subsequent consideration in their respective chambers. The ongoing government shutdown may delay final consideration; however, the NDAA has never missed its expiration date in its 64-year history.

Brownstein will continue to remain closely engaged with key members of Congress and monitor the BIOSECURE Act and the NDAA. To gain more insight on the BIOSECURE Act or potential regulatory processes, please contact a member of the Brownstein team.

---

THIS DOCUMENT IS INTENDED TO PROVIDE YOU WITH GENERAL INFORMATION REGARDING BIOSECURE LEGISLATION INCLUDED IN THE SENATE-PASSED NDAA. THE CONTENTS OF THIS DOCUMENT ARE NOT INTENDED TO PROVIDE SPECIFIC LEGAL ADVICE. IF YOU HAVE ANY QUESTIONS ABOUT THE CONTENTS OF THIS DOCUMENT OR IF YOU NEED LEGAL ADVICE AS TO AN ISSUE, PLEASE CONTACT THE ATTORNEYS LISTED OR YOUR REGULAR BROWNSTEIN HYATT FARBER SCHRECK, LLP ATTORNEY. THIS COMMUNICATION MAY BE CONSIDERED ADVERTISING IN SOME JURISDICTIONS.