BIOSECURE Act: What It Means for Equipment Suppliers to Biopharma (and Who Wins)

The BIOSECURE Act became law on 18 December 2025 as Section 851 of the US National Defense Authorization Act for Fiscal Year 2026 [2]. It bars US federal agencies from buying biotechnology equipment or services from designated "biotechnology companies of concern", and from contracting with, or funding, organisations that use such equipment or services on federal work [1]. For equipment and consumables suppliers, the practical effect arrives before the legal one: CDMOs began supplier gap assessments while the bill was still before Congress [9], law firms expect compliance to run through supplier attestations and flow down clauses [8], and a supplier that can answer an ownership and supply chain questionnaire in days rather than weeks is the one that gets qualified.

This is general information, not legal advice.

Why this matters now

The law does not bite immediately. The Office of Management and Budget (OMB, the US executive agency that sets federal procurement policy) must publish its first list of companies of concern within a year of enactment, so by 18 December 2026, and the procurement prohibitions only take effect after the Federal Acquisition Regulation (FAR, the rulebook for US federal contracts) is revised. If every statutory period runs its full length, law firms estimate that puts the prohibitions somewhere between August and October 2028; if OMB or the FAR Council move faster, the dates come forward [2] [3] [4] [5].

Buyers are not waiting. Cytiva's Global Biopharma Index 2025, a survey of 1,250 biopharma executives in 22 countries, found that 76% expect geopolitical volatility to significantly affect their sourcing strategies, and 56% expect domestic biologics manufacturing to rise sharply within three years [6]. ACHEMA's trend report reads that figure as the BIOSECURE effect on sourcing, and describes the result as a split in the global bioprocessing market [7]. A biologics technology transfer takes 12 to 24 months, so anyone planning to move a programme before the December 2026 list has to start now [3]. That is why suppliers should expect the questionnaires now rather than in 2028.

What the Act actually does

Section 851 has three prohibitions. Federal agencies may not procure biotechnology equipment or services from a company of concern. They may not enter into, extend or renew a contract with an entity that uses such equipment or services, acquired after the prohibitions take effect, in performing the contract. And federal loan or grant funds may not be used to buy or use them [1] [5]. The restriction only reaches contracts covered by the FAR and certain Department of Defense agreements. It is not a ban on all commercial dealings with a listed company [1].

The definition of "biotechnology equipment or service" is wide. It covers equipment, instruments, apparatus, machines or devices, with genetic sequencers named as the example, including their components and accessories, that are designed for the research, development, production or analysis of biological materials, together with any software, firmware or other digital components specifically designed for, and necessary to operate, that equipment. It also covers services for research, development, production, analysis, detection or information relating to biological materials, including data storage, consulting and support services. OMB can add further items in the interest of national security [1]. On a plain reading it could reach bioreactors, single use systems, filtration and chromatography hardware, analytical instruments and the digital components inside them. Whether every one of those categories is treated the same way in practice depends on the OMB guidance and the FAR text, neither of which exists yet.

Who gets named, and how

The enacted text names no company. Earlier versions of the bill named WuXi AppTec, WuXi Biologics, BGI, MGI and Complete Genomics; the final version replaced the names with a list mechanism [1]. There are two routes onto the OMB list. The first is the Department of Defense's Section 1260H list of "Chinese military companies" plus an OMB finding that the entity is involved in biotechnology equipment or services. The second is an OMB determination that an entity is controlled by or acts for a foreign adversary government, is involved in biotechnology equipment or services, and poses a national security risk. Parents, subsidiaries and successors that meet the criteria can be captured too [1] [3].

The 1260H list was updated on 8 June 2026 with roughly 65 additions, taking it to about 200 entities. Three biotechnology companies were among them: WuXi AppTec, Novogene and Complete Genomics. BGI and MGI entities were already on the list [3] [5]. WuXi Biologics is not, and Ropes & Gray's reading is that it is not captured by the 1260H route because it is not a subsidiary, parent or successor of WuXi AppTec [5]. OMB could still consider it, or any of the five companies named in earlier drafts, under the second route [1].

Then came the court. On 7 August 2026 the US District Court for the District of Columbia preliminarily enjoined the Department of Defense from giving effect to WuXi AppTec's 1260H designation, finding that the department had misread its own evidence on state and military affiliation [3]. Two limits matter for suppliers. The order binds the Department of Defense, not OMB, and it expressly permits the department to redesignate the company. OMB can also still reach WuXi AppTec through the second route, which does not depend on the 1260H list at all [3]. Greenberg Traurig also reports that the court's finding of harm rested on evidence that customers and suppliers cancelled contracts and moved programmes to competitors within weeks of the June designation [3]. That is the commercial lesson: a listing moves procurement behaviour long before any statutory deadline.

The timeline

The table below combines the statutory sequence with the dates law firms have calculated from it. The later dates assume each step takes its full allowed period, so they could move earlier.

Three details of the transition deserve care. First, contracts entered before the prohibitions take effect, including pre negotiated options, can continue for five years. The firms do not agree on when the five years start: Akin Gump reads them as running from the FAR revision [2], Hogan Lovells describes them as running from the date the prohibitions take effect and calls the end point unclear for companies listed later [4], and Greenberg Traurig uses both start points in the same alert while putting the calculated end at about June 2033 [3]. The difference is only 60 to 90 days, but it may not be settled until OMB's guidance and the FAR text arrive. Second, Greenberg Traurig notes that this legacy protection may not be available for companies that were already on the 1260H list at enactment, such as BGI and MGI, so genomics customers may move faster than the headline dates suggest [3]. Third, there is a safe harbour for equipment or services that a listed company formerly provided but no longer does, and Greenberg Traurig reads it as not covering ongoing service, software or firmware support [1] [3]. An installed base can become a problem through its service contract rather than its nameplate.

What a customer diligence request will ask

The Act's enforcement runs through representations, certifications, clause flow downs and supplier attestations, with False Claims Act exposure for knowing non compliance [8]. That is why the questionnaires are blunt. Here is what a questionnaire built on the Act's criteria is likely to ask and what to have ready.

Greenberg Traurig's advice to buyers is to identify tier 2 and tier 3 suppliers against the 1260H list before the Section 805 supply chain phase scheduled for 30 June 2027 and to put designation contingent termination and substitution rights into contracts [3]. Expect your customers to pass both of those down to you.

The supplier playbook

Document ownership and the supply chain once, properly. Build an evidence pack: ownership, manufacturing sites, critical component sources, service partners and data hosting. Keep it under version control so every customer gets the same answer.

Prepare an attestation template. A one page signed statement that your company is not a 1260H listed entity or a subsidiary of one, that your products are not produced by a company of concern, and that you will notify the customer of any change. Have legal counsel review it before first use, since this is the document a False Claims Act argument would turn on [8].

Publish country of manufacture and ownership on your profile. McDermott expects demand to shift towards suppliers with transparent ownership, strong audit frameworks and reliable manufacturing [8]. A buyer re sourcing a filter or a bag assembly should not have to ask.

Screen your own lower tier suppliers. McDermott expects scrutiny of subcontractors, software layers, firmware and data infrastructure, so exposure can come through a software library, firmware or a data platform from a lower tier, not only through a finished product [8].

Watch the list. The 1260H list and the OMB list are both updated at least annually [1] [2]. Assign someone to check them each quarter and after any press report, and read OMB's guidance when it arrives.

Who wins, and the catch

Suppliers and CDMOs outside China with clean ownership and documented supply chains are the obvious beneficiaries. In July 2024, while the bill was still before Congress, BioProcess International reported CDMOs running gap assessments, expanding supplier networks and evaluating alternative equipment, and quoted an expectation that lower tier suppliers never used before would be added for redundancy [9]. The same report carried two warnings: as new suppliers ramp up, prices may rise and supply may be constrained, and many automation and process analytical technologies in current plants come from companies that may be affected [9]. That capacity squeeze is why buyers are being advised to act early.

For an equipment supplier, "winning" therefore means being qualified in time. A replacement single use assembly or chromatography resin still needs extractables data, change control and often a regulatory filing before it can be used in a licensed process. See IQ, OQ and PQ explained for what a buyer's qualification will require from you, and supplier prequalification in pharmaceutical procurement for the questionnaire that usually comes with it.

Practical example

An illustrative single use consumables supplier in Germany, with 120 staff, receives a BIOSECURE questionnaire from a US CDMO customer on a Monday with a ten working day deadline. The customer wants a signed attestation, an ownership statement and a supply chain declaration covering films, tubing, connectors, sensors and sterilisation partners. All figures below are illustrative.

Total: about 37 hours across six functions plus external counsel, submitted in one week. The second questionnaire from another customer, using the same evidence pack, takes about six hours: mainly re screening the supplier list and adapting the template.

Two things make the week possible. The supplier already held certificates of origin for each product family, and procurement already had tier 1 suppliers in a spreadsheet with parent company names. A supplier starting from nothing typically needs the ownership chart, the site list and the supplier screen built from scratch, which can turn a one week exercise into three or four, and the customer rarely waits.

Be findable by the buyers who are re sourcing

Buyers moving programmes away from listed suppliers are looking for qualified alternatives they may never have heard of. On ChemCapital, a verified company profile and detailed product listings mean buyers using AI supplier discovery can find and invite you to quote even if they have never heard of you. Use your profile description and supporting documents to state your country of manufacture and ownership, keep your compliance approvals current, and the platform will alert you 30 days before a certification record lapses. See how suppliers benefit and how supplier discovery works.

Ready to be found by the buyers already looking for what you make? List your company on ChemCapital. It is free to start.