On December 18, 2025, the BIOSECURE Act was signed into law as part of the FY 2026 National Defense Authorization Act (NDAA). The law restricts the ability of US federal agencies from contracting with, or providing funding to entities that use equipment or services from designated "biotechnology companies of concern" (BCOCs) — companies the US government considers tied to foreign adversaries in the biotechnology sector.
For pharmaceutical companies that source active pharmaceutical ingredients (APIs), contract development and manufacturing organization (CDMO) services, or drug master file (DMF) holders in China, the BIOSECURE Act is not a future problem. It is a current planning obligation with a compliance clock that has already started.
This article maps what the law requires, how it affects API sourcing and DMF strategy, what the implementation timeline looks like, and what launch teams should do now. It is independent information and not legal advice.
What the BIOSECURE Act does
The BIOSECURE Act establishes a framework governing the use of certain biotechnology equipment and services in connection with US federal procurement and federal funding. Key provisions:
Prohibition on federal contracting. Federal agencies cannot contract with entities that use biotechnology equipment or services from designated BCOCs.
Prohibition on federal funding. Entities that receive federal grants, loans, or other funding cannot use those funds to procure equipment or services from BCOCs.
Designation process. The Office of Management and Budget (OMB) is required to publish an initial list of BCOCs within one year of enactment — by December 18, 2026. After publishing the list, OMB has up to 180 days to issue implementing guidance for federal agencies.
Three categories of BCOCs. The enacted law provides for three categories of "biotechnology companies of concern": entities already named on the DOD's 1260H list (Chinese military companies operating in the US), entities that will be added by OMB to a new BCOC list, and entities designated through future rulemaking. This tiered structure means the initial list could be narrower than anticipated — but also that the list is designed to grow over time.
Grandfathering. The Act includes a five-year grandfathering period for pre-existing contracts and commercial agreements with BCCs executed before the applicable effective date — meaning companies have until approximately mid-2033 to transition away from designated suppliers for grandfathered arrangements. However, the grandfathering period is unavailable for companies already on the DOD 1260H list as of December 18, 2025; those prohibitions take effect 60 days after the FAR is revised. OMB can add companies to the BCC list over time, and the law includes an appeals process for designated entities.
The law reflects a bipartisan consensus that biotechnology has become a strategic national security domain and that reducing US dependency on foreign-adversary-linked suppliers — particularly in genomics, data analytics, and biomanufacturing — is urgent policy.
The API supply chain exposure
China's dominance in API manufacturing is structural, not marginal:
- China oversees more than 5,000 pharmaceutical manufacturing facilities
- The generic API segment globally is valued at approximately $78.69 billion (2024 baseline), with China holding undisputed leadership
- Some analyses suggest US exposure to Chinese APIs may be as high as 80% for certain compounds, according to the Brookings Institution
- Hundreds of FDA-registered API facilities are located in China
- The Drug Master File (DMF) system — the standard mechanism for submitting confidential manufacturing information to the FDA — includes a substantial and growing share of Chinese-held DMFs
Major pharmaceutical companies including Eli Lilly, Pfizer, AbbVie, Merck, Bristol Myers Squibb, Johnson & Johnson, and Vertex Pharmaceuticals have historically relied on Chinese CDMOs and API suppliers. WuXi Biologics, for example, contributed to the development and manufacturing of Eli Lilly's tirzepatide (Mounjaro, Zepbound) and Pfizer's Paxlovid.
The China Drug Master File (cDMF) dimension
China's NMPA operates its own Drug Master File system (cDMF), which allows manufacturers and suppliers to confidentially submit information on APIs, excipients, and packaging materials. For companies sourcing APIs from China, the cDMF system is a critical regulatory interface.
The cDMF has two review pathways:
| Pathway | Use case | Key feature |
|---|---|---|
| Stand-alone review | API registration independent of a specific drug application | Can be referenced across multiple drug applications |
| Binding review | API, excipient, and packaging reviewed as part of a full drug product application | All components evaluated together |
Non-China companies must appoint a China-based regulatory representative to manage cDMF submissions, communication, and updates with the NMPA. This requirement adds a compliance layer for any pharmaceutical company with API supply chain exposure to China.
For teams navigating the full China regulatory landscape — including NMPA drug registration, cDMF filings, and market-entry strategy — ChinaMedGlobal publishes regulatory and market-access guidance for China's pharmaceutical and medical device market.
Implementation timeline: what we know
The BIOSECURE Act establishes a phased implementation:
| Milestone | Deadline | Status |
|---|---|---|
| Law enacted (part of FY 2026 NDAA) | December 18, 2025 | Completed |
| OMB publishes initial BCOC list | December 18, 2026 (1 year after enactment) | Pending |
| OMB issues implementing guidance | Up to 180 days after BCOC list publication | Pending |
| FAR Council amends Federal Acquisition Regulation | Up to 1 year after OMB guidance | Pending |
| Statutory prohibitions take effect | 60 days after FAR revision for 1260H-list companies; 90 days for OMB-designated BCCs | Pending (approximately late 2028) |
| Grandfathering for existing contracts | 5 years from FAR revision date for pre-existing agreements (not available for 1260H-listed companies as of Dec 18, 2025) | Pending |
The long lead time reflects how deeply integrated US pharmaceutical operations are with Chinese suppliers. The five-year grandfathering window for existing contracts — available for OMB-designated BCCs but not for 1260H-listed companies — means that some supply arrangements could continue until approximately mid-2033, while others must transition by late 2028.
What the BIOSECURE Act means for DMF holders and launch teams
If you hold an FDA DMF for an API manufactured in China
Assess BCOC exposure. Determine whether your API manufacturer or any subcontractor in your supply chain is likely to be designated as a BCOC when the OMB list is published.
Evaluate alternate manufacturing sites. Qualifying a new API manufacturing site is not trivial — it requires FDA inspection, process validation, batch comparability studies, and a prior approval supplement (PAS) or DMF amendment. This process can take 18–24 months.
Update quality agreements. Ensure that quality agreements with Chinese API suppliers include change notification provisions that would capture any regulatory actions or designation changes affecting the supplier.
If you reference a Chinese DMF in your NDA, ANDA, or BLA
Map your DMF references. Identify every DMF referenced in your pending or approved applications that is held by a Chinese facility.
Develop contingency DMFs. For critical APIs, identify and qualify alternative DMF holders outside China. File DMF amendments or new DMFs before the compliance deadline.
Monitor the OMB list. When the initial BCOC list is published (expected by December 2026), cross-reference it against every DMF in your regulatory portfolio.
If you use a Chinese CDMO for clinical or commercial manufacturing
Audit current contracts. Review your CDMO agreements for termination clauses, change-of-control provisions, and supply commitments that may be affected by BCOC designation.
Evaluate "China Plus One" options. Many companies are adopting a dual-sourcing strategy — maintaining Chinese capacity while qualifying alternative suppliers in India, Europe, or the US. This is the practical near-term approach, since fully replacing Chinese capacity cannot be done quickly.
Watch for retaliation risk. China has its own evolving regulatory framework. The 2026 implementing regulations of China's Drug Administration Law (effective May 15, 2026) consolidate rules on market exclusivity, supply chain flexibility, and foreign MAH obligations — potentially tightening conditions for foreign companies operating in China.
NMPA regulatory reforms running in parallel
China's NMPA is simultaneously implementing reforms that affect API and drug product regulation:
2026 Implementing Regulations of the Drug Administration Law (effective May 15, 2026): Consolidates previously dispersed rules into a cohesive framework governing the entire drug lifecycle — from R&D and registration to manufacturing, sales, and post-market supervision. Introduces changes to market exclusivity, supply chain flexibility, and accelerated approval pathways.
Foreign MAH obligations: Foreign marketing authorization holders must appoint a China-based responsible entity that bears joint and several liability for drug quality and safety.
API "Domestic Critical Supply" certification: Effective early 2026, all API manufacturers must obtain a certification after on-site inspections, data audits, and quality-control system verification. Foreign companies must source APIs from certified domestic facilities.
Priority review for urgently needed drugs: The NMPA has published lists of approximately 80 urgently needed overseas drugs and is encouraging domestic generic submissions, including trial exemptions for certain products.
These reforms make China's regulatory environment more structured and internationally aligned — but also more complex for foreign pharmaceutical companies navigating simultaneous BIOSECURE Act compliance.
Practical checklist for launch teams
Inventory every DMF and API source. Map your entire supply chain for active ingredients, intermediates, and critical excipients back to the facility level.
Score BCOC risk. For each Chinese supplier, assess the likelihood of BCOC designation based on the company's ownership, government ties, and genomics/data services exposure.
Qualify alternate suppliers now. The compliance clock is running. Qualifying a new API supplier typically takes 18–24 months through FDA. If the prohibition takes effect in late 2028, teams that start in mid-2026 are already cutting it close.
Review federal funding exposure. If your company receives NIH grants, BARDA contracts, DoD funding, or any federal procurement, assess whether any funded programs use Chinese CDMO services.
Engage regulatory counsel. The interplay between the BIOSECURE Act, FDA DMF requirements, NMPA cDMF rules, and standard drug application obligations is complex and company-specific.
Monitor the OMB list process. The December 2026 BCOC list publication will be the next major milestone. Companies should have their supply chain mapping complete before that date so they can respond immediately.
What to monitor next
- OMB BCOC list. Expected by December 18, 2026. This will define the initial scope of restricted entities.
- OMB implementing guidance. Due within 180 days of the list publication. Will clarify how federal agencies interpret "use of equipment or services" from BCOCs.
- FAR Council amendments. Will translate the statutory framework into procurement rules that federal agencies must follow.
- NMPA implementing rules. Post-May 2026, the NMPA is expected to issue additional technical guidelines and implementation rules that further define operational paths for both domestic and multinational pharmaceutical companies.
- China Plus One supply shifts. Monitor whether India, South Korea, and Europe are scaling API manufacturing capacity fast enough to absorb redirected demand.
- Drug shortage risk. If BCOC designations cover major API suppliers, the FDA may need to exercise shortage mitigation authorities.
Sources
- Morrison Foerster. "BIOSECURE Act Update." December 18, 2025. https://www.mofo.com/resources/insights/251218-biosecure-act-update
- K&L Gates. "BIOSECURE Act: What You Need to Know." January 20, 2026. https://www.klgates.com/BIOSECURE-Act-What-You-Need-to-Know-1-20-2026
- Morgan Lewis. "Navigating China's New 2026 Implementing Regulations of the Drug Administration Law." February 2026. https://www.morganlewis.com/pubs/2026/02/navigating-chinas-new-2026-implementing-regulations-of-the-drug-administration-law
- Drug Patent Watch. "China's Irreplaceable Role in the Global Generic Drug API Supply Chain." 2026 Report. https://www.drugpatentwatch.com/blog/the-role-of-china-in-the-global-generic-drug-api-market
- DES Pharma Consulting. "Navigating Pharmaceutical Supply Chain Challenges: 2026 Risk Mitigation Strategies." 2026. https://despharmaconsulting.com/navigating-pharmaceutical-supply-chain-challenges-2026-risk-mitigation-strategies-for-biotech-innovators
- Rx-360. "2026 China Regulations Readiness Checklist." 2026. https://rx-360.org/2026chinaregulationsreadinesschecklist
- Pharma Offer. "How to File a DMF Registration in China: Complete 2026 Compliance Guide." https://pharmaoffer.com/blog/china-drug-master-file-cdmf
- Freyr Solutions. "China's NMPA Policy to Reduce Time from Drug Approval to Market Supply." 2026. https://www.freyrsolutions.com/blog/chinas-nmpa-policy-to-reduce-time-from-drug-approval-to-market-supply-why-it-matters-in-2026
- CSIS. "A Bilateral Approach to Address Vulnerability in the Pharmaceutical Supply Chain." https://www.csis.org/analysis/bilateral-approach-address-vulnerability-pharmaceutical-supply-chain
- FDA. "Safeguarding Pharmaceutical Supply Chains in a Global Economy." Congressional Testimony, October 30, 2019. https://www.fda.gov/news-events/congressional-testimony/safeguarding-pharmaceutical-supply-chains-global-economy-10302019
- Pharmaceutical Commerce. "How the BIOSECURE Act Will Shape Pharma Supply Chains." May 13, 2026. https://www.pharmaceuticalcommerce.com/view/biosecure-and-beyond
- Inside Government Contracts. "BIOSECURE Act Moves Closer to Enactment with Inclusion in FY 2026 NDAA." December 2025. https://www.insidegovernmentcontracts.com/2025/12/biosecure-act-moves-closer-to-enactment-with-inclusion-in-fy-2026-ndaa-text
- Baker McKenzie. "United States: The BIOSECURE Act Becomes Law." January 19, 2026. https://www.bakermckenzie.com/en/insight/publications/2026/01/united-states-the-biosecure-act-becomes-law
- Latham & Watkins. "BIOSECURE Act Becomes Law Limiting Grants with Biotechnology Companies of Concern." January 2026. https://www.lw.com/en/insights/biosecure-act-becomes-law-limiting-grants-with-biotechnology-companies-of-concern
