Overview
Recent regulatory developments have highlighted the need for the
U.S. biomedical research community to reassess and strengthen their
biosecurity measures, particularly in research involving synthetic
biology and potentially dangerous pathogens. U.S. research
facilities, whether at academic research institutions or at life
sciences companies, as well as organizations that are otherwise
involved in the delivery of healthcare products and services, may
be largely unprepared for the potential risks associated with
malicious or even negligent genetic sequencing of bioengineered
materials using "mail-order" synthetic nucleic acid
sequences that can potentially evolve into a biosecurity threat.
This threat is heightened when the research itself is innately
higher-risk in nature (e.g., research involving Pathogens with
Enhanced Pandemic Potential or PEPP, etc.) or when artificial
intelligence (AI) is used to exploit or amplify the threat.
The Biden administration's October 2023 Executive Order on the Safe, Secure, and
Trustworthy Development and Use of Artificial Intelligence (EO)
addressed a number of concerns at the intersection of AI and
biotechnology, and laid out a number of new approaches to better
understand and reduce the potential for AI to enable biological
risks. The EO is discussed in a recent Arnold & Porter Advisory
entitled, "Addressing CBRN Threats and Promoting Responsible
AI in Healthcare: Insights From President Biden's AI Executive
Order." In the months since the EO was signed, various
government agencies and responsible entities have been working
through the first round of action items, which were due 180 days
after the signing of the EO.
The EO is of particular importance to any organizations that
receive or plan to request government funds for life sciences
research involving the procurement of any type of synthetic nucleic
acids and to organizations that manufacture or distribute any type
of synthetic nucleic acids, or benchtop equipment for synthesizing
nucleic acids, for federal government-funded research. In
particular, the EO provides that by October 26, 2024, all federal
agencies that fund life sciences research must, as appropriate and
consistent with applicable law, establish that, as a requirement of
funding, synthetic nucleic acid procurement for federally funded
research must be conducted through synthetic nucleic acid and
synthetic nucleic acid benchtop equipment manufacturers and
distributors that adhere to the "Framework for Nucleic Acid Synthesis
Screening" (Screening Framework), which was issued by the
White House Office of Science and Technology Policy (OSTP) in April
2024. In turn, the Screening Framework requires, for those who must
comply with the Screening Framework, compliance with the "Screening Framework Guidance for Providers and
Users of Synthetic Nucleic Acids" issued by HHS in October
2023. And importantly, the National Institute of Health (NIH),
which is a prolific funder of life science research, has already
established binding guidelines pursuant to the Screening
Framework.
Additionally, under a new Policy for Oversight of Dual Use Research of
Concern and Pathogens with Enhanced Pandemic Potential (PEPP
Policy), effective May 6, 2025, federal agencies that fund certain
types of life sciences research on biological agents and toxins
with dual use potential will need to ensure the recipients of the
funding have certain measures in place and follow certain
practices.
This Advisory synthesizes key points from recent guidance
documents and frameworks to help the U.S. biomedical research
community navigate the complex landscape of biosecurity compliance
and risk management.
Key Regulatory Developments
May 6, 2024 PEPP Policy
As noted above, on May 6, 2024, OSTP released an expanded and
unified PEPP Policy. This new U.S. government-wide policy combines
the current "dual use research" of concern (i.e.,
research that has the potential to be both beneficial and harmful)
and enhanced potential pandemic pathogen oversight frameworks.
Further, the PEPP Policy expands the scope of research requiring
additional scrutiny (among other things, by expanding the list of
pathogens and viewing risks from a broader perspective); requires
government agencies funding such research to ensure the recipient
institutions have enhanced risk identification, management, and
mitigation plans; and encourages institutions engaged in biomedical
research to engage in robust collaborations with relevant
government agencies. To assist such institutions, the OSTP has
issued an extensive guidance document developed to
assist with implementation of the PEPP Policy (Implementation
Guidance), and the NIH intends to work closely with the biomedical
research community to help them prepare for the May 6, 2025
effective date of the PEPP Policy.
Certain key provisions of the PEPP Policy are highlighted
below:
- The PEPP Policy applies to all U.S. federal departments and agencies that fund or sponsor research, whether in the U.S. or internationally, that fits the criteria of enhanced oversight per the policy — Categories 1 and 2.1
- Federal departments or agencies can condition the provision of funding to an institution on the institution attesting to the federal government that it will implement stricter oversight of non-federally funded Category 1 and Category 2 research in accordance with the research oversight framework under the PEPP Policy.2
- For research critical to address a national emergency, or where the risks outweigh the benefits, the secretary of the applicable federal agency may issue a temporary waiver from the oversight requirements of the PEPP Policy.3
- Enforcement would be the responsibility of the applicable federal departments or agencies, and noncompliance by institutions or researchers may result in the loss of current and future funding or sponsorship.4
- Institutions that do not receive federal funding, or that conduct research that involves biosafety or biosecurity risks but do not rise to the level of Categories 1 and 2, are strongly encouraged to take voluntary safety and security measures.5
Overall, the PEPP Policy signifies an important step towards better pandemic preparedness by enhancing regulations around research involving PEPP.
April 29, 2024 Screening Framework
As noted above, the OSTP also established a Screening Framework as required by the EO, and
the National Institute of Standards and Technology is currently
working with the Engineering Biology Research Consortium to engage
experts, industry, and other stakeholders to develop technical
screening standards and best practices in keeping with the EO and
the Screening Framework. The Screening Framework aims to prevent
acquisition of dangerous genetic materials by unauthorized
parties.
Synthesized nucleic acids — DNA or RNA molecules with a
specific customer-provided sequence — are commonly used for a
range of research purposes, which in the wrong hands could be
misused, including via the use of AI to enhance the sequencing
process to create potentially harmful bioengineered materials. One
possible way to mitigate such possible misuse is to screen the
customers who are allowed to order synthesized nucleic acids, the
sequences of nucleic acids themselves, or both. Previous screening
measures, such as the October 2023 Screening Framework Guidance for Providers and
Users of Synthetic Nucleic Acids (Screening Guidance) from the
U.S. Department of Health and Human Services were voluntary and
nonbinding. The Screening Guidance, among other things, outlines
best practices to address biosecurity concerns associated with the
potential misuse of synthetic nucleic acids in order to bypass
existing regulatory controls and commit unlawful acts. Importantly,
the Screening Guidance and Screening Framework not only apply to
procurement of synthetic nucleic acids, but also to whole organism
genomes (viruses, bacteria) containing any synthetic organic
chemicals.
Reflecting several years of effort from a broad community of
researchers, biosecurity experts, and synthesis providers, the
Screening Framework implements a federal screening requirement for
the first time: establishing that any research projects receiving
federal research funding (e.g., at academic research institutions)
will be required to procure synthesized nucleic acids, and
synthetic nucleic acid benchtop equipment, only from organizations
that follow certain screening guidelines. In particular, the
Screening Framework provides that "within 180 days of the
release of this framework [on April 29, 2024], federal research
funding agencies will require recipients of federal R&D funds
to procure synthetic nucleic acids only from providers that
implement these best practices." Thus, this deadline for
federal agencies to establish such mandatory requirements is
October 26, 2024. And importantly, the National Institutes of
Health, which is the largest public funder of biomedical research in
the world, has already established mandatory guidelines for research involving
synthetic nucleic acid molecules, pursuant to the Screening
Framework.
While the Screening Framework represents an important step to
ameliorate biosecurity threats, potential implementation challenges
could involve: (1) updating from time to time decisions regarding
which nucleic acid sequences to screen for; (2) establishing and
updating processes and infrastructure to develop and adapt
screening measures given rapid technological advances; and (3)
deciding which users present a "legitimate use" for a
specified sequence. It is, as yet, unclear how such decisions
should be made.
Current Biosecurity Controls
In addition to the new requirements, the U.S. biomedical research community must continue to implement current controls on pathogens and toxins including through the Federal Select Agent Program (FSAP) and export controls. The FSAP regulates the possession, use, and transfer of biological select agents and toxins that have the potential to pose a severe threat to public, animal, or plant health, or to animal or plant products. A broader set of controls applies to exports of specified pathogens and toxins controlled under the Export Administration Regulations and for certain defense-related elements and organisms under the International Traffic in Arms Regulations. Export controls can apply to specified biological materials that contain genetic elements and genetically modified organisms with DNA associated with the pathogenicity of controlled materials. Biomedical researchers should review especially carefully their work on sensitive pathogens and toxins to assess controls.
Actions to Consider
In addition to the specific requirements of the recent guidance
documents and frameworks summarized above, institutions operating
in the biomedical research space may wish to consider some or all
of the following actions.
Review and Update Protocols and Policies:
- Reassess current biosecurity measures, including protocols and policies against new guidance, and develop best practices.
- Implement enhanced screening procedures for nucleic acid providers.
Assess Whether Research Falls Under the Select Agent Program or U.S. Export Controls:
- Inventory research on pathogens and toxins to determine potential restrictions.
Strengthen Oversight:
- Establish or reinforce committees overseeing high-risk research.
- Implement rigorous approval processes for PEPP-related studies.
- Enhance screening and background checks on individuals with access to PEPP-related studies.
- Ensure that, for those organizations importing or exporting these products, the products are correctly declared for import or export (as applicable) and documentation of compliance with the Screening Framework and other applicable requirements can be made available, if and as needed.
Enhance Training:
- Provide comprehensive biosecurity training for researchers and staff.
- Ensure awareness of and training related to new regulatory requirements.
Improve Facility Security:
- Upgrade physical and cybersecurity measures in research facilities.
- Implement stricter access controls to sensitive areas and materials.
Develop Incident Response Plans:
- Create comprehensive plans for potential biosecurity breaches.
- Conduct regular drills and simulations.
Ensure Compliance Documentation:
- Maintain detailed records of compliance efforts.
- Prepare for potential audits or inspections.
Conclusion
The groundbreaking EO will form a foundation for future policies governing AI and biological risk that will shape the biosecurity, national security, AI, and biomedical research communities for decades to come. Currently, this rapidly evolving regulatory landscape surrounding higher-risk biological research presents significant challenges for these communities. Proactive measures to address these new regulatory guidelines and frameworks are crucial to mitigate legal, reputational, and security risks, both at a micro or institutional level and at a macro or national level. Institutions and companies engaging in potentially applicable research should seek legal counsel to ensure full compliance and to develop robust risk management strategies.
Footnotes
1. See PEPP Policy at section 1.2.
2. See PEPP Policy at section 5.4.
3. See PEPP Policy at section 5.5.
4. See PEPP Policy at section 5.6.
5. See PEPP Policy at section 6.2.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
