Articles
Follow our developments and deepen your industry knowledge by following our updates and news.
BIOSECURE Act: How US Biotechs Can De-Risk Their API Supply Chain with a European CDMO
The BIOSECURE Act, signed into law on 18 December 2025, restricts US federal agencies from buying from designated biotechnology companies of concern (BCCs) — and from contracting with companies that rely on them. For US biotechs that source APIs, intermediates or development services through China-linked supply chains, diversification is no longer optional: it is a countdown. This article summarises what the Act covers, when its restrictions take effect, and how to move to a compliant European CDMO without stalling your pipeline.
What does the BIOSECURE Act restrict?
The Act targets biotechnology companies of concern — entities designated either through the US Department of Defense 1260H list (where they have a biotechnology nexus) or through a separate process led by the Office of Management and Budget (OMB). Once an entity is designated, three restrictions apply:
- federal agencies may not procure biotechnology equipment or services from a BCC;
- agencies may not enter into, extend or renew contracts with companies that use BCC equipment or services in performing federal contracts;
- parallel restrictions apply to federal grants and loans.
The definition of biotechnology equipment and services is broad. It covers any tool or service used in the research, development, production, analysis, detection, storage or transmission of biological materials — from instruments, software and digital components to consulting and support services, and explicitly contract research and manufacturing.
The Act does not ban working with non-designated Chinese suppliers. But proving that a partner has no exposure to a BCC requires extensive due diligence — and that is where much of the real cost lies.
How exposed are US biotech supply chains?
Exposure is often indirect. In India, about three-quarters of the intermediates used to make APIs are sourced from China.1 An alternative supplier outside China can therefore still be BCC-adjacent — and excluded for that reason.
Designation can reach the largest players: in June 2026, the Department of Defense's updated 1260H list named WuXi AppTec among 28 new entities.3
Key BIOSECURE Act dates
The BIOSECURE implementation timeline
- 18 Dec 2025Act signed into lawSection 851, FY2026 NDAA
- By 18 Dec 2026OMB list of BCCsinitial list published
- +180 daysOMB guidancefor federal agencies
- +1 yearFAR amendedFederal Acquisition Regulation
- +60 daysProhibitions liveexpected 2027–2028
- +5 yearsGrandfathering endsfor pre-existing contracts
The hidden cost of switching suppliers
Changing an API or intermediate supplier is never a purchasing decision alone. Permitting, process design and production cycles in pharma are long, and moving a process to a new site can trigger FDA qualification and validation requirements that extend timelines and add cost. The earlier the transition starts, the more of it can run in parallel with existing supply.
The BIOSECURE Act readiness checklist: 7 steps
Map exposure and conduct due diligence
List all biotechnology equipment and services used across R&D, clinical operations, manufacturing, quality control and data management. Identify direct and indirect links to potential BCCs — CROs, CDMOs, labs, data processors and instrument vendors.
Introduce dual sourcing where possible
Build redundancy early. Qualify an alternative CDMO for regulated or federally exposed programmes while existing relationships continue to serve other programmes.
Develop a phased transition plan
Relocate critical activities gradually and stress-test timelines against the Act's effective dates to avoid abrupt shifts. Account for termination fees, liquidated damages and royalty arrangements.
Secure your contracting position
Update CRO, CDMO and supplier contracts with clauses covering regulatory change, termination rights, technology transfer, data controls and audits. Make sure downstream providers are bound by the same standards.
Ensure tech and knowledge transfer readiness
Keep processes, analytical methods and documentation complete and transferable. Digital tools improve traceability and reduce reliance on tacit knowledge; strong cybersecurity protects intellectual property and sensitive data.
Align internal teams early
Form a cross-functional team — regulatory, quality, procurement and technical experts — to monitor designations and coordinate the company-wide response.
Plan the finances
Estimate the total cost of vendor transitions, infrastructure adjustments and compliance. Look for government incentives such as tax credits, and anticipate possible countermeasures, including restrictions on biotechnology materials.
What to look for in a replacement CDMO
Beyond cost, capacity and technical capability, a CDMO now has to demonstrate that its operations are free of restricted entities and aligned with evolving regulatory requirements. Five markers matter:
- Full data traceability
- Transparent supply chains
- Digitalized operations
- A proven, auditable compliance history
- An integrated relationship — one accountable team from development to commercial supply
Why European CDMOs are a lower-risk alternative
The European Union is well placed to absorb demand shifting away from China, for three reasons:
- Regulatory know-how. EU GMP frameworks are closely aligned with FDA requirements, and under the EU–US Mutual Recognition Agreement the FDA can rely on GMP inspections carried out by EU authorities. That reduces friction in approvals, inspections and process transfers.
- Robust operations. Europe's CDMO ecosystem is mature and diversified, with deep expertise in small-molecule and complex API manufacturing, robust quality systems and thorough documentation practices.
- Geopolitical stability. A predictable business environment, strong transatlantic ties and a regulatory culture built on data integrity, transparency and patient safety.
European CDMOs: key facts & market signals
How Polpharma API CDMO supports the transition
Polpharma API CDMO is the contract development and manufacturing arm of Polpharma API — the largest Polish manufacturer of active pharmaceutical ingredients, with 75 years of experience. All CDMO operations sit on one integrated site in Starogard Gdański, Poland: R&D, kilo labs including high-potency units, a pilot plant and commercial production. One site and one team from start to finish removes the fragmentation many biotechs face when managing several CDMO relationships.
- Regulatory track record. An FDA-inspected site with successful FDA inspections in 2004, 2009, 2012, 2015 and 2018. The site is also inspected by EMA/PIC/S member authorities, Japan's PMDA, Brazil's ANVISA and Korea's KFDA, and its GMP certificates are registered in EudraGMP.
- Capabilities. Cryogenic chemistry down to −90 °C; high-potency APIs for OEB 5–6 compounds, with an OEL down to 10 ng/m³; GMP oligonucleotides; ADC payload-linkers; analytical and solid-state expertise; milling, micronization and crystallization; impurity profiling for genotoxins, nitrosamines and unknowns; phase-appropriate method validation and full CMC support.
- Scale and transfer. Risk-managed, industrial-scale technology transfer and flexible scaling from kilograms to multi-ton batches.
- Vetted supply network. Materials sourced from trusted, GMP-compliant suppliers.
- 70+Products
- 65Patents
- 70Markets
- ~500Employees
- 35Annual audits
EcoVadis Silver — top 15% of rated companies (October 2025).
Author
Head of Global Regulatory Affairs and Customer Technical Service
Polpharma API
Frequently Asked Questions (FAQ)
Does the BIOSECURE Act ban all Chinese suppliers?
No. It applies to designated biotechnology companies of concern and to companies that use their equipment or services in federal contracts, grants and loans. Working with non-designated Chinese suppliers remains legal, but proving they have no exposure to a BCC requires extensive due diligence.
When do the BIOSECURE Act restrictions take effect?
OMB must publish its list of BCCs by 18 December 2026. Implementing guidance and FAR amendments follow, and the prohibitions take effect 60 days after the FAR revision — widely expected in 2027–2028. Contracts signed before the effective date are grandfathered for five years from the FAR revision.
Who is affected by the BIOSECURE Act?
Federal contractors and subcontractors, recipients of federal grants and loans, and life sciences companies that sell into federal channels or rely on CRO and CDMO partners. Companies outside federal contracting may still feel the effect through customers and partners who are covered.
Why work with a CDMO in Poland?
A Polish CDMO manufactures under EU GMP, and the EU–US Mutual Recognition Agreement lets the FDA rely on inspections by the Polish authority. Polpharma API CDMO's site in Starogard Gdański has passed five FDA inspections since 2004 and keeps development and commercial manufacturing on one site.
Sources
- Health-ISAC (2024). Impacts of the BIOSECURE Act on the Global BioTech Industry.
- Chemical Pharmaceutical Generic Association (CPA) (2021). The Evolving APIs World – Crunches in the Global APIs Supply Chain.
- Goodwin (9 June 2026). BIOSECURE Update: 1260H List Released.
- Grand View Horizon. Europe Pharmaceutical CDMO Market Size & Outlook, 2025–2033.
- Market Data Forecast (2025). Europe Pharmaceutical Contract Manufacturing Market Report.
- Precedence Research (2025). Europe Pharmaceutical CDMO Market Size, Share and Trends 2025 to 2034.
- Research and Markets (2025). Europe Active Pharmaceutical Ingredients (API) Market Trends Analysis Report 2025–2033.
Timeline: FY2026 National Defense Authorization Act, Section 851; K&L Gates, BIOSECURE Act: What You Need to Know (20 January 2026); Goodwin (9 June 2026).
.webp)
.webp)
%20(1).webp)
