The NDAA is Congress’s annual statute authorizing DoD programs and funding. While its core function is to set the defense budget and policy priorities, the NDAA frequently serves as a vehicle for broader measures affecting trade, technology, and investment policies for other U.S. government agencies. The FY 2026 NDAA continues this longstanding pattern, enacting hundreds of provisions with implications far beyond traditional military operations ranging from supply chain security and export control changes to foreign investment reviews, procurement reforms, sanctions policy shifts, and compliance frameworks. Many of these provisions will require subsequent regulatory implementation, underscoring the importance of early engagement and monitoring by companies operating in sectors that intersect with U.S. defense and national security priorities.
Section 851 of the NDAA for FY 2026 codifies the BIOSECURE Act, which imposes federal procurement, contracting, and funding restrictions on a government‑wide basis on certain types of dealings with “biotechnology companies of concern” (BCOCs). BCOCs will include any entity currently on or added to the DoD list of “Chinese military companies,” known as the 1260H List, and entities that are identified through a review process, which must find that the entity:
The BIOSECURE Act will prohibit federal agencies from procuring biotechnology equipment or services produced or provided by BCOCs; entering into or renewing contracts with entities using biotechnology equipment or services to perform a contract; or entering into or renewing contracts where there is reason to know that the contract would require such equipment or services. Loan or grant funds also cannot be used by federal agencies or recipients to procure or use biotechnology equipment or services or to enter into agreements with entities using such equipment or services. The Federal Acquisition Regulation Council has one year to revise the Federal Acquisition Regulation (FAR) to implement the BIOSECURE Act’s provisions. There is a five‑year wind‑down period after the FAR is updated for preexisting dealings with BCOCs. The restrictions for 1260H entities will take effect 60 days after the FAR is updated, and the restrictions for entities designated through the review process will take effect 180 days after the FAR implementation.
Section 8102 of the NDAA for FY 2026 amends the Defense Production Act to expand (and formalize) CFIUS’ process for identifying covered U.S. real estate that may trigger CFIUS jurisdiction for review if involved in transactions by foreign persons. Under the current process, covered U.S. real estate is identified based on proximity (i.e., within a 100‑mile radius) to listed U.S. military installations. The new provision authorizes CFIUS to publish a broader list of “national security-sensitive sites,” which may include not only U.S. military installations but also U.S. intelligence and energy installations (such as the national laboratories).
Section 8102 also requires each CFIUS member agency to review and update its sensitive site designations on an annual basis. Based on such updates, CFIUS may adjust the distance thresholds that determine what constitutes “proximity” for jurisdictional purposes. Each recommendation must be documented with a justification and risk assessment, and the resulting list will be reported to Congress (with a provision for classified briefings upon request).
Parties engaging in U.S. real estate, facility, or infrastructure transactions that involve foreign acquirers or investors will now need to contend with a more dynamic and regularly updated list of sensitive installations, potentially with broader proximity ranges. Such changes will increase the importance of early‑stage location screening and regulatory monitoring when structuring such transactions.
Title LXXXV of the NDAA for FY 2026 contains notable expansions of the existing U.S. outbound investment regulations, including:
Title LXXXV appropriates $150 million per year for the next two years to Treasury to administer and enforce the restrictions (out of which funds may be transferred to the Commerce Department for industry outreach purposes) and authorizes the hiring of up to 15 personnel. As part of the Treasury statutory mandates, Treasury will establish a process to identify non‑notified or prohibited transactions. Violations of the regulations may result in civil penalties as well as forced divestment where the covered foreign person is engaged in prohibited activity.
Title LXXXV also directs Treasury to provide resources for industry to navigate the regulations, including a public database of covered foreign persons engaged in prohibited or notifiable activity, as well as a process for industry to request nonbinding feedback (including on an anonymous basis) from Treasury as to whether a transaction is prohibited under the regulations.
Section 1823 of the NDAA for FY 2026 amends U.S. federal acquisition regulations to broaden the DoD’s CSO authority. Specifically, Section 1823 expands the use of CSO to allow the DoD to procure any commercial items and non‑developmental products or services, rather than only “innovative” new technologies that were not yet widely available in the commercial marketplace. Section 1823 also creates explicit authority to enter into follow‑on production agreements (including sole‑source awards) based on successful initial CSO acquisitions, subject to applicable approval requirements.
These changes will increase the utility of CSOs as a vehicle for bringing off‑the‑shelf commercial technology into U.S. defense procurement, potentially accelerating opportunities for both emerging and established technology companies to transition prototypes or commercially available solutions into full‑scale production for U.S. procurement purposes.
The NDAA contains provisions to facilitate the participation of commercial and nontraditional contractors in DoD’s Defense Acquisition Process. Section 1822 requires Government Contracting Officers to purchase unique development products and/or services only if they determine there are no suitable commercially available alternatives. Section 1804 increases the prime contract threshold for requiring cost or pricing data from the current $2.5 million threshold to $10 million for contracts entered into after June 30, 2026. Section 1806 raises the contract threshold for full Cost Accounting Standards (CAS) compliance from $50 million to $100 million.
By raising key thresholds for cost and pricing data requirements and CAS compliance, and by prioritizing commercially available solutions over unique development, the above changes will serve to make U.S. government contracts more accessible to new and smaller players in the market who have previously faced a high barrier to entry than traditional government contractors.
Section 8369 of the NDAA for FY 2026 repeals the Caesar Syria Civilian Protection Act of 2019 (Caesar Act), which authorized the imposition of secondary sanctions on non‑U.S. persons who engaged in certain transactions that supported the al‑Assad regime. Elements of the Caesar Act had been waived since May 2025, when the United States began to relax sanctions on Syria.
Section 8369 requires the President to provide a report to Congress 90 days after the enactment of the NDAA and every 180 days thereafter, for a period of four years, certifying whether the Government of Syria is making concrete and tangible efforts to uphold international security commitments.
The Export Administration Regulations (EAR) continue to impose embargo and anti-terrorism controls on Syria, barring the export of many items to that county without prior authorization from the Commerce Department.
Section 5603 of the NDAA for FY 2026 directs the Secretary of State to evaluate the feasibility and potential impacts of instituting a processing fee for license applications for exports of defense articles subject to the ITAR. The Secretary of State must also submit a report to Congress within 90 days regarding whether such a fee system could partially or fully offset the State Department’s licensing costs, and whether it would be preferable to the current model that relies solely on annual ITAR registration fees.
The review will consider the viability of a tiered fee structure, which could potentially be based on application volume and could include discounted rates for small businesses.
The FY 2026 NDAA reflects an increasingly expansive approach to national security regulation, with implications well beyond traditional defense contracting. With provisions including emerging restrictions on biotechnology supply chains, expanded CFIUS jurisdiction, and broader outbound investment controls, the NDAA’s updates signal heightened scrutiny of cross‑border transactions, procurement supply chains, and technology transfers.
Companies, particularly those operating at the intersection of defense, advanced technology, and global markets, should be prepared for changing compliance obligations and consider engaging counsel early to develop strategies to mitigate risk and take advantage of new opportunities.
Law Clerk Channing Jones contributed to this alert.