Back to Insights
    CDMOCROBIOSECURE ActFDACMCManufacturingClinical Operations
    Share on LinkedIn

    Your CDMO Just Became a Regulatory Risk: BIOSECURE and FDA PreCheck Explained

    September 3, 20268 min readUpdated
    Neta Kela, PhDWritten byNeta Kela, PhDFounder & Managing Partner

    The rules for building a US manufacturing and clinical supply chain just changed twice in the space of six months. On December 18, 2025, the BIOSECURE Act became law as part of the FY2026 National Defense Authorization Act. On June 29, 2026, the FDA named the first seven participants in its new PreCheck pilot program for domestic drug manufacturing. Neither event was aimed specifically at European biotech companies, but both reshape how any sponsor headed toward an FDA submission should think about its contract development and manufacturing organization (CDMO) and contract research organization (CRO) relationships.

    For EU biotechs planning a US IND, a BLA, or a licensing deal with a US partner, CDMO and CRO selection is no longer a procurement decision made late in the process. It is a regulatory and geopolitical decision that belongs in the earliest stages of program planning.

    BIOSECURE changes the due diligence baseline

    The BIOSECURE Act restricts federal agencies from contracting with, or procuring products or services connected to, designated "biotechnology companies of concern." The law does not name specific companies in its text. Instead, it builds on the Department of Defense's Section 1260H list of Chinese military-linked companies and creates a process for the Office of Management and Budget to designate additional companies within a year of enactment.

    The practical timeline matters for planning purposes: OMB has up to a year from enactment to publish its initial list, implementing guidance follows roughly 180 days after that, and the FAR Council then has a year to revise federal acquisition regulations. Restrictions tied to the DoD's 1260H list move faster, on a roughly two-year-and-eight-month path to full effect, and existing contracts and grants generally get a five-year transition window (60 days for 1260H-listed entities).

    That runway sounds generous, but two things make it urgent now rather than later. First, switching a CDMO mid-program is one of the slowest, most expensive moves a biotech can make: it typically requires new comparability data, updated CMC sections, and in many cases fresh FDA review of manufacturing changes. Waiting until a designation list forces the issue removes any ability to plan the transition on your own timeline. Second, larger biopharma companies already have legal and regulatory teams updating M&A, licensing, and investment due diligence questionnaires to include BIOSECURE risk. A smaller EU biotech that cannot answer those questions cleanly becomes harder to partner with or acquire, independent of the science.

    FDA PreCheck signals where new US capacity is coming from

    Separately, the FDA's PreCheck Pilot Program responds to a structural problem: as of 2025, only about 11% of active pharmaceutical ingredient manufacturers are US-based, compared with 22% in China and 44% in India, even though most drugs sold in the US pass through American review. PreCheck, created under Executive Order 14293, lets sponsors of new domestic facilities get FDA feedback on facility readiness and Drug Master File content before the site is even operational, in two phases: pre-operational facility review, then expedited review of the manufacturing information in an eventual application.

    The FDA received more than 80 applications in its first window and selected seven participants for the initial cohort, including Amneal Pharmaceuticals, Cellares, Eli Lilly, FUJIFILM Biotechnologies, Kriya Therapeutics, Kyowa Kirin, and Regeneron, spanning sterile liquids, cell and gene therapy, and biologics drug substance. Participants commit to filing an NDA, ANDA, or BLA during the program and manufacturing at the site for at least three years post-approval.

    For an EU biotech evaluating CDMO partners, PreCheck is a useful signal, not a shortcut. A CDMO that has been through this kind of structured FDA engagement, or one building new US capacity with it in mind, has effectively pressure-tested its facility and documentation earlier than a normal buildout would allow. That can translate into fewer surprises during your own pre-approval inspection, but selection in the pilot does not guarantee expedited approval or a clean inspection outcome, and sponsors still need to verify a facility's actual state independently.

    CRO oversight is getting more explicit, not less

    On the clinical side, FDA finalized its guidance adopting ICH E6(R3) Good Clinical Practice in September 2025, replacing the 2016-era E6(R2) standard. The revision leans into risk-based, quality-by-design thinking: sponsors are expected to identify the "critical to quality" factors in a trial, things that actually affect participant safety and data reliability, and build oversight around those rather than checking every process uniformly.

    The point that gets missed most often: delegating trial conduct to a CRO does not delegate accountability. Under GCP, the sponsor remains responsible for the oversight framework, and a risk-based approach still needs the sponsor to know enough about the CRO's systems, site management, and data handling to actually exercise that oversight, not just receive status reports.

    What this means for CDMO and CRO selection right now

    A few practical steps for EU biotechs building or re-evaluating their US-facing supply and clinical chain in 2026:

    • Screen ownership and supply chain exposure at the raw material and equipment level, not just at the contracting entity, since BIOSECURE risk can sit several tiers down.
    • Build a comparability and technology transfer contingency plan for critical CDMO relationships before you need one, not after a designation forces a switch.
    • Ask prospective CDMOs directly about PreCheck participation or comparable proactive FDA engagement, and verify facility status yourself rather than taking a marketing claim at face value.
    • Update CRO oversight plans to reflect ICH E6(R3)'s risk-based framework, with a documented rationale for what your team actually monitors and why.

    None of this is optional groundwork. For a European biotech aiming at a US IND or BLA, the CDMO and CRO file is now part of the regulatory strategy, reviewed by FDA, examined by potential US partners, and increasingly shaped by legislation with no biotech-specific carve-outs.

    This is exactly where PXM's regulatory and CMC advisory work sits. With more than 30 years of combined experience across the team, including former FDA reviewers, PXM helps European biotech and pharma companies build the CMC packages, oversight frameworks, and vendor due diligence that a US filing and a US partner will both expect to see, before either one asks the hard question.

    Related reading: BIOSECURE Act and FDA PreCheck advisory and CDMO selection criteria for biotech.

    Get in touch with PXM to talk through your CDMO or CRO strategy for a US filing.

    *Found this useful? We'll be sharing this article on LinkedIn, follow along and share it with your network.*

    How PXM Helps With This

    Related

    Part of FDA & CMC Readiness. Start from the pillar: Operate practice, FDA Regulatory Readiness, CMC & Manufacturing, FDA Expedited Pathways, EU Regulatory Pathways

    Get notified when we publish new funding and regulatory guides

    Practical guidance on FDA and EMA strategy, CMC readiness, and non-dilutive funding — sent only when there is something worth reading.