OMB's BIOSECURE Designation Clock Runs Out in December, With WuXi AppTec Already on the Pentagon's List

The BIOSECURE Act has been law for nine months. The deadline that actually gives it teeth is twelve weeks away.

Signed into law on December 18, 2025, as Section 851 of the Fiscal Year 2026 National Defense Authorization Act, the statute bars U.S. executive agencies from contracting with entities designated as "biotechnology companies of concern" (BCCs). According to a detailed review published by Latham and Watkins, by December 18, 2026, the Director of the Office of Management and Budget must publish a full BCC list, built from recommendations by the Secretaries of Defense, Justice, HHS, Commerce, State, Homeland Security, and the Directors of National Intelligence and the National Cyber Director.

That list doesn't exist yet. Until it does, enforcement against most Chinese contract development and manufacturing organizations, the CDMOs that handle drug synthesis and genomic sequencing for a substantial share of the U.S. biopharma industry, is largely held in suspension.

One company hasn't waited. On June 8, 2026, the Department of Defense added WuXi AppTec to its Section 1260H list of "Chinese military companies" operating in the United States, according to an advisory published by Arnold and Porter. Because the BIOSECURE Act treats any company on the 1260H list as a BCC by default, WuXi AppTec is already formally in scope. The same Arnold and Porter advisory notes the company has filed a legal challenge to that designation. Other firms may follow.

The structural problem here is dual and worth naming plainly. First, the enacted law deliberately removed the company-specific naming that earlier draft versions included. Prior bills called out BGI, MGI Tech, Complete Genomics, and WuXi AppTec by name. The final text, reviewed by K&L Gates and others, instead routes designation through the OMB process and the 1260H list, creating a gap between the law's stated intent and its immediate effect. WuXi Biologics and WuXi XDC, for instance, are not yet designated as BCCs, despite a December 2025 letter from multiple House and Senate committee chairs, including the House Select Committee on China, urging the Pentagon to add all three WuXi entities to the 1260H list, according to Latham and Watkins.

Second, the supply chain exposure is not marginal. A BIO Industry survey cited by Vision Life Sciences found that 79 percent of biopharma companies have at least one contract or product with a China-based or China-owned CDMO, with an estimated 10 to 20 billion dollars in annual contracts at stake. Western alternatives like Catalent, Lonza, and Samsung Biologics are reportedly booking two to three years forward, according to an industry analysis reviewed by BioMed Nexus, meaning that companies waiting on the OMB list to clarify their exposure before switching suppliers may find capacity already gone.

The dual-use dimension here cuts both ways, and it's worth flagging rather than resolving. BGI's genomic sequencing infrastructure and WuXi's drug development platforms are both commercially valuable and potentially intelligence-relevant, particularly given the statute's explicit concern with collection of human multiomic data. Whether any of these firms are actively collecting such data in ways that compromise national security is an assessment question, and open sources don't settle it. What the law does is shift the burden of proof: companies with federal contracts must now audit their supply chains for BCC exposure and document their sourcing, per guidance reviewed by Innovative Biosci, or face audit risk.

The oversight gap in the 120-day replacement policy window for dual-use research, created when the Trump administration's January 2025 executive order rescinded the 2024 DURC/PEPP oversight framework, compounds the picture. A paper published in Frontiers in Bioengineering and Biotechnology, flagged by Global Biodefense, proposed an 11-part national framework to link biosecurity, cybersecurity, and public health oversight in a way that the current patchwork doesn't. That framework remains a proposal.

The OMB list is the near-term watch item. If it lands by December 18 with WuXi Biologics and WuXi XDC included alongside WuXi AppTec, the enforcement picture sharpens materially. If it's incomplete or delayed, the gap between statute and enforcement widens, and the supply-chain risk calculus for federally funded biopharma research stays murky through at least another budget cycle.

Sources cited:
- Latham and Watkins (BIOSECURE Act Becomes Law) (https://www.lw.com/en/insights/biosecure-act-becomes-law-limiting-grants-with-biotechnology-companies-of-concern)
- Arnold and Porter (National Security Controls and the Life Sciences Sector) (https://www.arnoldporter.com/en/perspectives/advisories/2026/06/national-security-controls-and-the-life-sciences-sector)
- K&L Gates (BIOSECURE Act: What You Need to Know) (https://www.klgates.com/BIOSECURE-Act-What-You-Need-to-Know-1-20-2026)
- Global Biodefense (A Blueprint For Managing The World's Most Dangerous Research) (https://globalbiodefense.com/2026/09/01/a-blueprint-for-managing-the-worlds-most-dangerous-research/)
- BioMed Nexus (Biosecure Act: The 2026 Playbook) (https://biomednexus.com/biosecure-act-the-2026-playbook-supply-chain-decoupling-roadmap/)
- Vision Life Sciences (BIOSECURE Act: Pharmaceutical Outsourcing & Supply Chain Impact) (https://visionlifesciences.com/insights/biosecure-act-pharma-impact-2026)
- Innovative Biosci (BIOSECURE Act 2026: Lab Supply Chain Impact) (https://www.innovativebiosci.com/blogs/news/biosecure-act-lab-supply-chain)