BIOSECURE Act and Federal Procurement

Section 889 of the National Defense Authorization Act for Fiscal Year 2019 established a two-part prohibition on the use of covered telecommunications equipment and services in federal procurement. Part A, effective August 2019, prohibits federal agencies from procuring or obtaining equipment, systems, or services that use covered telecommunications equipment or services as a substantial or essential component. Part B, effective August 2020, prohibits federal agencies from entering into contracts with entities that use covered telecommunications equipment or services.

The covered entities are Huawei Technologies, ZTE Corporation, Hytera Communications, Hangzhou Hikvision Digital Technology, and Dahua Technology — along with their subsidiaries and affiliates. The prohibition covers telecommunications equipment, video surveillance equipment, and any equipment or system that uses such equipment as a substantial or essential component or critical technology.

Part B of §889 is the more operationally significant provision. It requires federal contractors to represent, as a condition of contract award, that they do not use covered telecommunications equipment or services anywhere in their operations — not just in the performance of the federal contract. This representation requirement extends the prohibition deep into contractor supply chains, requiring companies to audit their own networks, facilities, and subsidiaries for covered equipment.

The implementation of §889 Part B has been complicated by the pervasiveness of covered equipment in commercial networks and facilities. Hikvision and Dahua cameras are widely deployed in commercial buildings, parking structures, and retail facilities. Huawei and ZTE equipment is embedded in the networks of rural telecommunications carriers that serve areas where federal contractors operate. Hytera radios are used by security personnel at facilities that have no direct connection to federal contracts.

The Federal Acquisition Regulation Council issued implementing regulations that allow agencies to grant waivers to the Part B prohibition in limited circumstances — where the waiver is necessary in the interest of national security, where the equipment or service is not reasonably available, or where the head of the agency determines that the waiver is in the public interest. Waivers are time-limited and subject to reporting requirements.

The waiver process has been used primarily to address the rural carrier problem — allowing contractors in areas served only by carriers using Huawei or ZTE equipment to continue operating while the FCC's rip-and-replace program removes covered equipment from rural networks. The rip-and-replace program, funded at $1.9 billion, has faced significant delays due to funding shortfalls and supply chain constraints, leaving many rural carriers still operating covered equipment years after the §889 prohibition took effect.

The BIOSECURE Act, enacted as part of the National Defense Authorization Act for Fiscal Year 2025, prohibits federal agencies from contracting with five Chinese biotechnology companies: BGI Genomics, MGI Tech, Complete Genomics, WuXi AppTec, and WuXi Biologics. The prohibition also bars federal contractors from using the services of these companies, with a transition period extending to 2032 for existing contracts.

The legislative findings underlying the BIOSECURE Act reflect congressional concern about Chinese government access to American genomic data and the security implications of U.S. pharmaceutical dependence on Chinese contract research organizations. BGI Genomics, through its U.S. subsidiary Complete Genomics, has provided genomic sequencing services to U.S. research institutions and healthcare providers. The FCC added BGI to its Covered List in 2023, citing national security concerns about the company's ties to the Chinese military and intelligence apparatus.

WuXi AppTec and WuXi Biologics are among the world's largest contract research and manufacturing organizations for pharmaceutical and biotechnology companies. WuXi AppTec's U.S. operations include chemistry, biology, and testing services used by a significant fraction of the global pharmaceutical industry's drug development pipeline. The BIOSECURE Act's 2032 transition deadline reflects congressional recognition that immediate termination of WuXi contracts would disrupt drug development programs affecting patient care.

The BIOSECURE Act's impact on the pharmaceutical industry extends well beyond the five named companies. WuXi AppTec and WuXi Biologics together handle an estimated 10 percent of global pharmaceutical R&D outsourcing, with relationships spanning hundreds of drug development programs at major pharmaceutical companies, biotechnology startups, and academic research institutions. The 2032 deadline was designed to give the industry time to transition to alternative contract research organizations, but the capacity constraints in non-Chinese CRO markets are significant.

The pharmaceutical industry's response to the BIOSECURE Act has been to accelerate diversification of contract research relationships — increasing use of Indian, European, and U.S.-based CROs — while lobbying for clarification of the prohibition's scope and the conditions under which existing contracts can continue through the 2032 transition period. Several major pharmaceutical companies have publicly disclosed their WuXi relationships and announced plans to transition to alternative providers.

The BIOSECURE Act also raises questions about the broader pharmaceutical supply chain that are not addressed by the procurement prohibition. Chinese manufacturers supply an estimated 80 percent of the active pharmaceutical ingredients used in U.S. generic drugs, and Chinese companies are significant producers of the chemical precursors used in branded drug manufacturing. The API dependency is addressed separately through executive orders on pharmaceutical supply chains and the Defense Production Act, but the BIOSECURE Act's procurement prohibition does not extend to API sourcing.

The Federal Communications Commission maintains its own Covered List of telecommunications and video surveillance equipment that poses an unacceptable risk to U.S. national security. The Covered List was established under the Secure and Trusted Communications Networks Act of 2019 and currently includes equipment from Huawei, ZTE, Hytera, Hikvision, Dahua, and Pacific Network Corp. The Secure Equipment Act of 2021 prohibits the FCC from reviewing or approving equipment authorization applications for devices on the Covered List.

The equipment authorization prohibition means that new Huawei and ZTE devices cannot be legally sold in the United States — a significant constraint on the companies' ability to re-enter the U.S. market even if their Entity List designations were modified. The FCC has also revoked the operating licenses of China Telecom Americas, China Unicom Americas, and Pacific Networks, finding that their Chinese government ownership posed national security risks that could not be adequately mitigated.

The FCC's national security actions have been coordinated with the broader interagency framework through the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector, known as Team Telecom. Team Telecom reviews applications by foreign-owned companies for FCC licenses and recommends conditions or denials based on national security assessments. The committee has become increasingly active in reviewing Chinese-owned or Chinese-affiliated telecommunications service providers.

The procurement prohibitions in §889 and the BIOSECURE Act create significant compliance obligations for federal contractors and their subcontractors. Contractors must represent their compliance with covered equipment and services prohibitions as a condition of contract award, and must flow down these requirements to subcontractors at all tiers. The compliance burden is particularly significant for large defense contractors with complex, multi-tier supply chains that may include thousands of subcontractors and suppliers.

The Defense Contract Audit Agency and agency inspectors general have identified §889 compliance as a priority audit area, and several contractors have faced contract terminations, debarment proceedings, and False Claims Act liability for misrepresenting their compliance with covered equipment prohibitions. The False Claims Act's qui tam provisions allow private parties to bring suits on behalf of the government, creating additional compliance pressure beyond government audit activity.

The compliance ecosystem has responded with a range of tools and services — supply chain mapping software, covered equipment databases, and compliance certification programs — designed to help contractors identify and remediate covered equipment in their operations. The Defense Department has also issued guidance on acceptable methods for identifying covered equipment, including physical inspection, network scanning, and supplier certification requirements.