On December 18, 2025, President Trump signed into law the National Defense Authorization Act (“NDAA”) for Fiscal Year 2026 (P.L. 119-60). A must-pass piece of legislation that funds Department of Defense (“DoD”) operations on an annual basis, the NDAA is a frequent vehicle for trade-related provisions and legislative changes affecting DoD acquisition policies with direct implications for government contractors. The NDAA includes a number of provisions relating to US sanctions, investment security, and supply chain issues, including China-focused measures related to the biotechnology supply and defense sectors, an expansion of current outbound investment restrictions, and a repeal of longstanding statutory Syria sanctions. The NDAA also incorporates the BUST Fentanyl Act, the Western Balkans Democracy and Prosperity Act, and the Countering Wrongful Detention Act of 2025.
Below we discuss the key highlights of the newly enacted legislation.
Defense Industrial Base Supply Chain Restrictions
- BIOSECURE Act
Section 851 will prohibit federal agencies from procuring biotechnology equipment or services from “biotechnology companies of concern,” and will bar the use of federal grants or loans to facilitate such purchases.
“Biotechnology equipment or service” is defined as follows:
- Covered equipment includes a wide range of items, including genetic sequencers, or any other instrument, apparatus, machine, or device, including components and accessories thereof, that is designed for use in the research, development, production, or analysis of biological materials as well as any software, firmware, or other digital components that are specifically designed for use in, and necessary for the operation of, such equipment.
- Covered service includes any service for the research, development, production, analysis, detection, or provision of information, including data storage and transmission related to biological materials or for disease detection, genealogical information, and related services.
- A catchall category includes “any other service, instrument, apparatus, machine, component, accessory, device, software, or firmware that is designed for use in the research, development, production, or analysis of biological materials” that the Director of the Office of Management and Budget (“OMB”), in consultation with the heads of executive agencies, determines to be covered “in the interest of national security.”
“Biotechnology company of concern” is defined to include any entity involved in biotechnology equipment or services (manufacturing, distribution, provision, or procurement), that is either:
- an entity listed on the 1260H List maintained by DoD (companies identified by DoD as being a Chinese military company); or
- listed and determined by OMB as meeting the following criteria: (i) subject to the governance or control of a foreign adversary (currently, North Korea, China, Russia, and Iran); (ii) involved in biotechnology equipment or services; and (iii) posing a risk to US national security.
Exceptions will be available for certain overseas healthcare services and emergency medical supply procurement.
Within one year after the NDAA’s enactment, OMB is required to create a list of entities that qualify as biotechnology companies of concern and to provide further guidance to assist in implementing these restrictions. Within one year after OMB’s published guidance, the Federal Acquisition Regulatory Council will amend the Federal Acquisition Regulation (“FAR”) to implement the NDAA’s biotechnology procurement restrictions, which will take effect 60 days after the FAR is updated. Once effective, the prohibitions will apply to both direct federal procurement, and contractors that use covered biotechnology equipment in performing government contracts.
- Prohibition on Advanced Batteries
Section 842 will limit DoD procurement of batteries from foreign entities of concern (“FEOC”), i.e., companies located in, or subject to the control of, China, Russia, Iran, or North Korea. It will permit exemptions that keep some FEOCs in the supply chain, and will extend the implementation timeline to (i) January 1, 2028, for new contracts; (ii) January 1, 2029, for standard batteries; and (iii) January 30, 2031, for existing acquisition programs.
- Prohibition on Photovoltaic Modules and Inverters
Section 847 will bar DoD from using funds authorized by this NDAA for photovoltaic modules and inverters from FEOCs, but explicitly excludes contracts involving third-party financing agreements.
- Prohibition on Certain Additive Manufacturing Machines
Section 849 will bar DoD from purchasing advanced manufacturing machinery from entities on the Consolidated Screening List, effective one year after the date of enactment.
- Phase-Out of Certain Computer and Printer Acquisitions
Section 850 addresses DoD acquisition of computers or printers manufactured by a “Covered Chinese Entity,” requiring that at least 10% of computers or printers acquired in FY2026 are not from such entities, increasing to 100% of computers or printers acquired from other than “Covered Chinese Entities” by FY2029. A “Covered Chinese Entity” is defined as an entity on the 1260H List or the Non-SDN Chinese Military Industrial Complex List; or an entity that is both (i) domiciled in or controlled by China, and (ii) on the Entity, Denied Persons, or Military End User Lists.
Foreign Investment Provisions
- Comprehensive Outbound Investment National Security Act or COINS Act
Sections 8501-8531 will expand the scope of the Outbound Investment Security Program (“OISP”) to include additional foreign countries and companies, transactions, and sectors. While some parts will take effect immediately upon enactment, others will be subject to implementing regulations to be issued by the Treasury Department within 450 days from the legislation’s effective date. Until those regulations are issued, the existing OISP, originally created pursuant to Executive Order 14105 will remain in effect. Modifications to key operational aspects of the OISP will include the following:
- Countries of Concern: The list of countries of concern will be expanded to include (in addition to China, Hong Kong, and Macao) Cuba, Iran, North Korea, Russia, and Venezuela under the Nicolás Maduro presidential regime. The expansion of outbound investment restrictions on these countries complements already widespread US sanctions and export controls on these countries.
- Covered Industry Sectors: The NDAA proposes to add high-performance computing and supercomputing and hypersonic systems to the existing covered sectors of semiconductor technology and microelectronics, artificial intelligence systems, and quantum information technologies. The list of covered technologies is subject to change in the future pursuant to Treasury rulemaking.
- Covered Foreign Persons: The current definition of “covered foreign person” includes persons of a country of concern that engage in a covered activity, as well as any person that, directly or indirectly, (i) holds a board seat, voting or equity interests, or the power to direct the management of a covered foreign person, or (ii) derives more than 50% of certain financial metrics (e.g., revenue, income, and expenses) from a covered foreign person. The NDAA will alter this definition, subject to Treasury rulemaking, to include (i) members of the Chinese Communist Party or political leadership of a country of concern, (ii) persons “subject to the direction or control” of a country of concern, and (iii) entities owned in the aggregate, directly or indirectly, 50% or more, by a country of concern.
- Publication of a Database of Covered Foreign Persons: The Treasury and Commerce departments are authorized to create a publicly accessible non-exhaustive database that identifies covered foreign persons. The database will also allow for covered foreign persons to petition for removal, and for public stakeholders to submit evidence on a confidential basis as to whether a foreign person is a covered foreign person.
- Additional Excepted Transactions: The NDAA will expand excepted transactions to include “a transaction secondary to a covered national security transaction.” Secondary transactions include, among other things, contractual arrangements, bank lending, the processing by a bank, underwriting services, debt rating services, prime brokerage, global custody, equity research or analysis, or other ordinary or administrative business transactions. The NDAA does not replace the existing OISP excepted transactions.
- Formalization of Non-Notified Transactions Outreach: The NDAA will also provide the Treasury authority to formalize certain existing operations under the OISP. For example, the regulations call on the Treasury Department to establish a “non-notified” process to identify covered national security transactions that were not notified to it and conduct outreach to the US entities party to such transactions. Interagency participation in this “non-notified” process, similar to processes in the Committee on Foreign Investment in the United States (“CFIUS”), may be expected.
- Authorizing Restrictions Under IEEPA: The NDAA will also authorize the President to impose sanctions under the International Emergency Economic Powers Act (“IEEPA”) to the extent necessary to prohibit US persons from investing in or purchasing significant amounts of equity or debt from a “covered foreign person” who is knowingly engaged in the Chinese defense or surveillance technology sectors.
- Review of Foreign Real Estate Transactions
Section 8102 will expand CFIUS’ process for identifying covered US real estate that may trigger CFIUS jurisdiction for review if involved in transactions by foreign persons. It will authorize CFIUS to publish a broader list of “national security-sensitive sites,” which may include not only US military installations but also US intelligence and energy installations (such as the national laboratories).
It will also require each CFIUS member agency to review and update its sensitive site designations on an annual basis. Based on such updates, CFIUS may adjust the distance thresholds that determine what constitutes “proximity” for jurisdictional purposes. Each recommendation must be documented with a justification and risk assessment, and the resulting list will be reported to Congress.
Sanctions-Related Provisions
- Break Up Suspicious Transactions of Fentanyl or BUST Fentanyl Act
Sections 8311-8320 will expand sanctions authorities to allow the United States to target Chinese government owned or controlled entities, including financial institutions, being used to finance foreign opioid trafficking and broaden the list of methamphetamine precursor chemicals tracked in the annual International Narcotics Control Strategy Report.
It will also require annual reporting to Congress on Haitian criminal gangs and their ties to Haitian political and economic elites, and will impose a combination of mandatory property-blocking and visa sanctions and discretionary financial prohibitions on persons identified in the reports.
- Western Balkans Democracy and Prosperity Act
Sections 8331-8341 will codify, and make mandatory, existing sanctions criteria in Executive Order 14033, as amended by Executive Order 14140. In addition to providing that the President shall impose property-blocking and visa-related sanctions on persons determined to meet the relevant criteria, which include undertaking activities that threaten the peace, security, stability, or territorial integrity of the Western Balkans, it will restrict the President’s authority to terminate such sanctions, requiring a congressional certification similar to that contained in Section 222(b) of the Countering America’s Adversaries through Sanctions Act.
- Countering Wrongful Detention Act of 2025
Sections 8351-8354 will amend the Robert Levinson Hostage Recovery and Hostage-Taking Accountability Act to allow for the designation of countries as “State Sponsors of Unlawful or Wrongful Detention,” and will require a review of authorities, including IEEPA-based sanctions, visa restrictions, and export controls, to respond to and deter unlawful or wrongful detention of US nationals.
- Repeal of Caesar Syria Civilian Protection Act of 2019
Section 8369 will repeal the Caesar Syria Civilian Protection Act of 2019 (“Caesar Act”), which authorized the imposition of secondary sanctions on non‑US persons who engaged in certain transactions that supported the al‑Assad regime. Elements of the Caesar Act had been waived since May 2025, when the United States began to relax sanctions on Syria. It will also require the President to provide a report to Congress 90 days after enactment and every 180 days thereafter, for a period of four years, certifying whether the Government of Syria is making concrete and tangible efforts to uphold international security commitments. The Export Administration Regulations continue to impose embargo and anti-terrorism controls on Syria, barring the export of many items to that county without prior authorization from the Commerce Department.
Export Control and Other Trade Provisions
- AUKUS Improvement Act of 2025
Section 1085 will make improvements to the AUKUS partnership, a trilateral security partnership for the Indo-Pacific region between Australia, the United Kingdom, and the United States that builds on longstanding and ongoing bilateral ties to strengthen the ability of each government to support security and defense interests. Specifically, it will exempt State Department-vetted entities that have been approved as AUKUS authorized users from the requirement to obtain third party transfer approvals under Foreign Military Sales, and it will exempt Australia and the United Kingdom from the need for congressional notification for overseas manufacturing.
- Defending International Security by Restricting Unacceptable Partnerships and Tactics Act or DISRUPT Act
Section 1273 will require the executive branch to develop a whole-of-government strategy to disrupt growing cooperation between China, Russia, Iran, and North Korea, and mitigate the risks posed to the United States, including by using threats of sanctions and export controls and by exposing cooperation between and among the countries where it occurs. It will also require the executive branch to prepare for the potential of the United States confronting simultaneous conflicts with one or more of the countries by bolstering deterrence across all priority theaters.
