The BIOSECURE Act Explained for API and Intermediate Buyers
The BIOSECURE Act became US law on December 18, 2025, and its first big deadline is now about eight weeks away. By roughly December 2026, the US Office of Management and Budget (OMB) is due to publish its initial list of “biotechnology companies of concern.” Most of the commentary so far has been written for biotech and contract research firms. This guide is written for BIOSECURE Act API buyers: procurement, sourcing and regulatory teams who buy active pharmaceutical ingredients and intermediates and want to know what the law actually says, what it leaves open, and what is sensible to do now.
This is a plain-English summary of published law-firm analyses. It is not legal advice. Ask counsel about your specific situation.
What Is the BIOSECURE Act?
The BIOSECURE Act was enacted as Section 851 of the National Defense Authorization Act for Fiscal Year 2026, signed on December 18, 2025. It is titled “Prohibition on contracting with certain biotechnology providers.” In short, it bars US executive agencies from:
- contracting with, or awarding loans or grants to, companies that use biotechnology equipment or services from a “biotechnology company of concern,” and
- directly buying biotechnology equipment or services from such a company.
It is a US federal procurement and funding rule. It does not, on its own, ban private companies from buying from anyone.
Who Counts as a “Biotechnology Company of Concern”?
According to law-firm summaries of the enacted text, a company can be designated in two main ways:
- The 1260H list. This is the Department of Defense’s existing list of Chinese military companies operating in the US. Companies on that list can be covered where they are involved in biotechnology equipment or services.
- An OMB list built for this law. An entity must meet all three criteria: it is controlled by, directed by or operating for the government of a foreign adversary (China, North Korea, Russia or Iran); it is involved in manufacturing, distributing, providing or procuring biotechnology equipment or services; and it poses a national security risk, for example through ties to a foreign adversary’s military or intelligence bodies, or through handling human multiomic data.
Some points worth noting:
- No one is named yet. The enacted text does not name companies of concern, and OMB’s initial list has not been published.
- Due process exists. Designated companies get notice and a review period, and can ask to be removed.
- Affiliates are not automatic. Subsidiaries, parents and successors are covered only under a process still to be set out.
Does It Apply to APIs and Intermediates? Law Firms Differ
This is the central question for buyers, and the honest answer is that it is not fully settled.
- The Act defines “biotechnology equipment” and “biotechnology services” mainly in terms of research, development, production and analysis involving biological materials, including sequencers and related data services.
- Two law-firm summaries we reviewed (Wilson Sonsini and Arnold & Porter) do not address APIs or generic drugs specifically.
- A third (Morrison Foerster) states that using equipment or services from a company of concern, such as outsourcing manufacturing of a drug substance or an API, could make a product ineligible for sale to US executive agencies.
What that suggests in practice: the exposure is likely most direct for products sold to US federal agencies and for organisations with federal grants. For small-molecule chemical APIs and intermediates sold into commercial markets, the direct impact is less clear, and it may turn on how OMB and the FAR Council define the terms. Treat it as a risk to understand, not a rule that definitely applies to you.
What the Law Does Not Do
- It does not impose a general import ban on APIs or intermediates from any country.
- It does not change traditional Medicare and Medicaid procurement. The Act includes provisions so that certain manufacturers are not disqualified from federal rebate agreements solely because of the contracting prohibitions.
- It does not take effect immediately. See the timeline below.
The Timeline
| Step | Timing |
|---|---|
| Law enacted | December 18, 2025 |
| OMB publishes the initial company list | Within one year of enactment, so by about December 2026 |
| OMB issues implementation guidance | Within 180 days after the list |
| FAR (Federal Acquisition Regulation) revised | About one year later |
| Prohibitions take effect | 60 days after the FAR revision for 1260H-listed companies, and 90 days after for other listed companies |
| Existing contracts | Grandfathered for five years from the FAR revision (1260H-listed companies get no such grace period under one firm’s reading) |
Commentators differ on when the prohibitions bite. One firm estimates the second half of 2028 if the full timeline is used, and another notes that enforcement during 2026 is theoretically possible but unlikely. The practical takeaway: there is time to prepare, but the list in December will tell you much more.
Why This Still Matters Now for API and Intermediate Buyers
Even if your products are not directly in scope, three things make this worth acting on:
- Customers will ask. US-facing buyers and partners are already adding BIOSECURE questions to supplier due diligence.
- Supply chains are layered. An API may depend on intermediates, contract testing labs or contract manufacturers several steps back. Law firms advise mapping that exposure now.
- Switching takes time. Changing a manufacturing source can require lengthy timelines and regulatory filings, so it is cheaper to understand your position before a list is published.
A Practical Checklist for API and Intermediate Buyers
- Map your supply chain below the supplier. Identify who makes the API and who supplies key starting materials, intermediates, contract manufacturing and contract analytical testing.
- Check whether any step involves a potential company of concern. Ask suppliers directly, and watch the 1260H list and the OMB list when it is published.
- Ask whether your product is sold to US federal agencies. If it is, or may be, take advice early.
- Add contract language. Ask suppliers to notify you of changes in manufacturing sites, subcontractors or testing providers.
- Document what you know. Keep records of supplier declarations, facility certificates and supply chain maps.
- Qualify a second source before you need one. See our guide to API supply chain fragility.
- Monitor the December list. Set a reminder to review it as soon as OMB publishes it.
Questions to Ask Your API or Intermediate Supplier
- Which manufacturing steps are carried out at your own facility, and which are outsourced?
- Do you use contract manufacturers or contract testing laboratories? Where are they located?
- Where do your key starting materials come from?
- Do you have any commercial relationship with entities on the 1260H list?
- Will you notify us before changing a manufacturing site, subcontractor or testing provider?
Chemox Pharma and Supply Chain Transparency
Chemox Pharma is a WHO-GMP certified manufacturer of APIs and intermediates at our own facility in Dahej, Gujarat, with an in-house R&D centre. We are happy to walk buyers through which manufacturing and testing steps take place at our facility and what supply chain documentation we can provide. This is a developing topic, and we will update this page when the OMB list and guidance are published.
Request a Quote and Supply Chain Documentation
If you are sourcing APIs or intermediates and want to discuss supply chain mapping and documentation, contact Chemox Pharma for a quote and documentation review.
FAQs
Q: What is the BIOSECURE Act?
It is a US law, enacted as Section 851 of the FY2026 National Defense Authorization Act on December 18, 2025. It restricts US executive agencies from contracting with, or funding, companies that use biotechnology equipment or services from designated “biotechnology companies of concern.”
Q: Does the BIOSECURE Act ban APIs or intermediates from China or India?
No. It is a federal procurement and funding rule, not a general import ban. It does not name any companies, and the initial list of companies of concern has not been published.
Q: Does the BIOSECURE Act apply to APIs?
Law-firm analyses differ. Some do not address APIs directly, while one states that outsourcing manufacturing of a drug substance or API to a company of concern could make a product ineligible for sale to US executive agencies. The practical scope will depend on the OMB list, guidance and FAR rules.
Q: When will the BIOSECURE Act take effect?
The OMB’s initial list is due within one year of enactment, around December 2026. The prohibitions take effect only after implementation guidance and revisions to the FAR, which on the full statutory timeline points to around 2028.
Q: What should API buyers do now?
Map your supply chain below the supplier, ask about outsourced manufacturing and testing, review whether your products are sold to US federal agencies, and plan to review the OMB list when it is published.
