NDAA 2026: New biotech restrictions and outbound investment controls

As has been the case in recent years, among the NDAA’s 3,000 pages are provisions that reflect bipartisan priorities to safeguard national security against foreign influence in critical sectors in the US economy. In particular, the NDAA: 

• imposes new restrictions on the federal procurement of biotechnology; 
• authorizes the President to impose sanctions on covered foreign persons engaged in China’s defense or surveillance technology sectors to prevent US persons from investing in such persons; and
• both codifies and expands existing US restrictions on outbound foreign investment – covering a broader range of covered technologies and "countries of concern." 

These new and expanded restrictions present new compliance challenges and may require additional supply chain transparency and security measures for firms engaged in certain categories of cross-border transactions. Thus, US and foreign firms operating in the relevant sectors should check the applicability of the NDAA’s provisions to their specific operations.

I. Federal procurement prohibitions on biotechnology

The NDAA prohibits federal agencies from procuring biotechnology equipment or services from "biotechnology companies of concern," and bars the use of federal grants or loans to facilitate such purchases.

Notably, the "biotechnology equipment or services" covered by this provision is broad in scope:

• Covered equipment includes a wide range of items, including genetic sequencers, or any other instrument, apparatus, machine, or device, including components and accessories thereof, that is designed for use in the research, development, production, or analysis of biological materials as well as any software, firmware, or other digital components that are specifically designed for use in, and necessary for the operation of, such equipment. 
• Covered services include any service for the research, development, production, analysis, detection, or provision of information, including data storage and transmission related to biological materials or for disease detection, genealogical information, and related services. 
• There is a catchall category for "any other service, instrument, apparatus, machine, component, accessory, device, software, or firmware that is designed for use in the research, development, production, or analysis of biological materials" that the Director of the Office of Management and Budget (OMB), in consultation with the heads of executive agencies, determines to be covered "in the interest of national security."

In turn, a "biotechnology company of concern" is any entity involved in biotechnology equipment or services (manufacturing, distribution, provision, or procurement), that is either: 

• an entity listed on the 1260H List maintained by the US Department of War (DOW) (companies identified by DOW as being a Chinese military company); or
• listed and determined by OMB as meeting the following criteria:
• subject to the governance or control of a foreign adversary (currently, North Korea, China, Russia, and Iran);
• involved in biotechnology equipment or services; and 
• posing a risk to US national security. 

Exceptions are available for certain overseas healthcare services and emergency medical supply procurement. 

Within a year after the NDAA’s enactment, OMB is required to create a list of entities that qualify as biotechnology companies of concern and to provide further guidance to assist in implementing these restrictions. And within one year after OMB’s published guidance, the Federal Acquisition Regulatory Council will amend the Federal Acquisition Regulation (FAR) to implement the NDAA’s biotechnology procurement restrictions, which will take effect 60 days after the FAR is updated.

Once effective, the prohibitions will apply to both direct federal procurement, and contractors that use covered biotechnology equipment in performing government contracts. As such, companies in the biotechnology industry should begin reviewing their supply chains now to identify potential exposure to biotechnology companies of concern. 

II. Outbound Investment Restrictions 

This year’s NDAA builds on, codifies, and expands in numerous ways the existing US Department of the Treasury’s (Treasury) Outbound Investment Security Program (OISP) established under Executive Order 14105 and implemented through 31 C.F.R. Part 850. 

Specifically, the NDAA: (1) authorizes specific unilateral executive action under the International Emergency Economic Powers Act (IEEPA) to establish prohibitions on certain equity or debt investments in persons knowingly engaged in China’s defense or surveillance sector; and (2) establishes a comprehensive framework governing "covered national security transactions," as outlined below, which expands the categories of covered technologies, covered foreign countries of concern and affected foreign counterparties, and requires Treasury to take action to align the existing OISP with the new framework (whether through revoking OISP and creating a new set of regulations or amending existing regulations). 

Authorizing Restrictions Under IEEPA. More specifically, the NDAA authorizes the President to impose sanctions under IEEPA to the extent necessary to prohibit US persons from investing in or purchasing significant amounts of equity or debt from a "covered foreign person" who is knowingly engaged in the Chinese defense or surveillance technology sectors. Congress specified that the President may exercise all authorities provided under Section 203 and 205 of IEEPA in imposing such sanctions. 

The NDAA defines "covered foreign persons" as any entity that (1) knowingly engages in China’s (including the Hong Kong and Macau Special Administrative Regions) defense or surveillance technology sectors; and (2) meets one of the following criteria: 

• is incorporated, organized, or has their principal place of business in China;
• is a member of the Central Committee of the Chinese Communist Party, or the political leadership of China;
• constitutes the Chinese government or any of its subdivisions, agencies, or instrumentalities;
• is subject to the direction or control of any entity described above; or
• is owned, directly or indirectly, 50% or more in the aggregate by any entity described above. 

It should be recognized that "knowingly" is defined broadly in the NDAA, including both subjective (actual) knowledge or where a person objectively should have known of the conduct, the circumstance, or the result. 

While the President already has broad authority under IEEPA to impose sanctions that would in effect prohibit US persons from investing in designated entities (i.e., through an SDN List designation), the NDAA underscores the Congressional sentiment that the President should exercise such authority more broadly, including against certain entities engaged in intelligence and defense activities. Lastly, the President must also submit an annual report to Congress over the course of seven years, stating whether any foreign person on the Non-SDN Chinese Military-Industrial Complex Companies List qualifies as a covered foreign person under the NDAA’s definition.

Formalized Outbound Investment Authority. In addition to expanding the scope of the existing OISP, the NDAA amends the Defense Production Act to provide a permanent framework for the prohibition or notification of "covered national security transactions" and directs Treasury to align the existing OISP with this framework by revoking superseding, supplementing, or amending existing Treasury regulations. 

Treasury has 450 days to issue regulations governing notifiable transactions, while no specific timeline applies to regulations implementing prohibitions. Treasury may issue regulations relevant to investments in prohibited technologies, and must issue regulations relevant to investments in notifiable technologies. 

Under the Defense Production Act’s new Title VIII, US persons will be:

• prohibited from engaging in covered national security transactions involving a prohibited technology; and
• required to notify Treasury when engaging in a covered national security transaction involving a notifiable technology.

Expanding the Range of Covered Investment Activities. Title VIII’s definition of a "covered national security transaction" largely tracks the covered transactions in the OISP and continues to apply to a wide range of investment transactions involving US persons. Title VIII also provides that Treasury may identify additional transactions that contribute to the military, intelligence, surveillance, or cyber-enabled capabilities of a country of concern. 

Specifically, a "covered national security transaction" involves a US person’s direct or indirect:

• equity or debt investments in a covered foreign person; 
• loans or debt arrangements to a covered foreign person when the arrangement provides the US person with certain governance rights or profits; 
• entry into joint ventures with persons from a country of concern involving prohibited or notifiable technologies; 
• acquisition of real estate or other assets in a country of concern that establish or benefit a covered foreign person;
• knowingly directing foreign prohibited or notifiable transactions that would otherwise violate Title VIII if done by a US person; 
• acquisition of a limited partner or equivalent interest in a fund where the fund is not a US person and will likely invest in a person of a country of concern; or
• any other transaction identified by Treasury that contributes to the military, intelligence, surveillance, or cyber-enabled capabilities of a country of concern. 

Expanding the Range of Covered Technologies. Prohibited and notifiable technologies are defined to include not only the technologies covered by OISP (i.e., advanced semiconductor technology and microelectronics, AI systems, and quantum information technologies), but also high-performance computing and supercomputing, and hypersonic systems.

Expanding the List of Covered Countries. Finally, Title VIII expands the scope of "countries of concern" to include not only China (including Hong Kong and Macau), which are covered by OISP, but also Cuba, Iran, North Korea, Russia, and Venezuela (under the regime of Nicolas Maduro). These countries are already subject to varying degrees of economic sanctions administered by the Treasury’s Office of Foreign Assets Control. Thus, in practical terms, the inclusion of these countries under the new outbound investment regime may not impose substantial new obligations.

Expanding the List of Covered Foreign Persons. A covered foreign person in turn includes any entity that:

• is incorporated, organized, or has its principal place of business in a country of concern;
• is a member of the Central Committee of the Chinese Communist Party, or the political leadership of a country of concern; 
• is subject to the direction or control of a country of concern or entity described above; or
• is owned, directly or indirectly, 50% or more in the aggregate, by a country of concern or entity described above.

Unlike the OISP, Title VIII does not tie one’s designation as a "covered foreign person" to their engagement in activities in relevant sectors. Rather, an investment counterparty will constitute a covered foreign person, as long as they meet one of the criteria listed above. However, an investment counterparty will only be subject to Title VIII’s prohibited and notifiable technology requirements when the transaction involves a prohibited or notifiable technology, the scope of which will depend on the promulgation of Treasury regulations implemented pursuant to Title VIII. Treasury, in consultation with the Department of Commerce, may also create a non-exhaustive public database of covered foreign persons that are engaged in a prohibited or notifiable technology pursuant to Title VIII. 

Finally, from an enforcement standpoint, in the event that a company violates any order, regulation, notification requirement, or prohibition issued under Title VIII, Treasury may impose penalties consistent with those authorized under IEEPA Section 206(b). In addition, Treasury may require divestment of a covered national security transaction involving a prohibited technology. The President may direct the US Attorney General to seek appropriate relief in district court to implement and enforce Title VIII, including divestment of transactions involving prohibited technologies.
__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.