NIH Wants to Retire the Rulebook Biology Has Used Since 1976. The Draft Biosafety Policy Expands Oversight to Every Biohazard — and Comments Close October 19.

The document that has governed American laboratory biosafety for half a century was written to answer a question nobody asks anymore.

In 1976, in the aftermath of Asilomar, NIH published the Guidelines for Research Involving Recombinant DNA Molecules. The animating worry was specific and novel: scientists had just learned to splice genes between organisms, and no one knew what would happen if an engineered construct escaped. The Guidelines answered that worry with a durable piece of institutional machinery — the Institutional Biosafety Committee — and a jurisdictional rule that made sense in 1976 and has quietly stopped making sense since.

The rule is that the molecule triggers oversight, not the hazard.

A laboratory culturing a wild-type Risk Group 2 pathogen with no recombinant work anywhere in the protocol falls outside the NIH Guidelines entirely. A laboratory expressing a harmless fluorescent protein from a plasmid falls inside them. Institutions have papered over this for decades by voluntarily extending IBC review to biohazards the Guidelines never covered — a practice so universal that most researchers assume it is federal law. It is not. It is local policy.

On August 19, 2026, NIH proposed to close that gap. NOT-OD-26-112 released the Draft NIH Biosafety Policy for Research Involving Biohazards for public comment, along with a draft Incident Reporting Template and a draft Meeting Minutes Template. When finalized, the Policy replaces the NIH Guidelines outright.

Comments are due October 19, 2026. That is seven weeks from today.

What the scope expansion actually does

The draft moves the trigger from recombinant or synthetic nucleic acid molecules to biohazards — a category that, as NIH has described the modernization effort, reaches wild-type biological agents, genetically modified organisms, toxins, prions, and infectious microorganisms.

For most institutions this is less a new obligation than a federalization of an existing one. If your IBC already reviews wild-type select agent work, BSL-3 protocols on unmodified pathogens, and toxin work, the substance of your review portfolio does not change much. What changes is that those reviews stop being discretionary local practice and become conditions of NIH funding, subject to federal expectations about documentation, membership, reporting, and inspection.

That distinction matters more than it sounds. Discretionary review can be run informally: a standing agenda item, an abbreviated record, an experienced chair making a judgment call. Federally required review cannot. Everything in scope now has to produce a record that survives an audit conducted by someone who was not in the room.

There is a genuine deregulatory half to the proposal, and institutions should not miss it. NIH has signaled that historically low-risk recombinant work — Risk Group 1 agents, certain transgenic organisms, particular expression plasmids — moves to streamlined handling. NIH has also proposed pruning jurisdiction at the edges, deferring clinical research to FDA, agricultural work to USDA, and certain environmental microbial research to EPA. The likely net effect at a large research university is a portfolio that gets broader and shallower: more protocols in scope, fewer of them consuming full committee time.

The three-tier structure, and the narrow slice NIH keeps for itself

The draft sorts oversight across federal, institutional, and investigator levels. The federal tier is deliberately small.

NIH review is required before initiation for higher-risk research involving emerging, novel, or zoonotic agents whose Risk Group classification or minimum containment recommendation is not available in the CDC/NIH Biosafety in Microbiological and Biomedical Laboratories manual — the BMBL. It is also required for initial requests to lower containment: below the established level for wild-type or genetically modified RG3 or RG4 agents, and below BSL-2 for genetically modified organisms.

Everything else sits with the IBC, which retains the authority to stipulate higher containment or additional precautions than NIH or the BMBL would require. Research may proceed once both approvals — where both are required — are in hand.

Read that structure carefully, because it defines where the friction will be. NIH has reserved for itself exactly two things: agents nobody has classified yet, and requests to reduce containment. The first is a small, genuinely hard category. The second is a category that will grow, because containment reduction is where investigators have the strongest incentive to push and where institutional review boards have historically been least consistent. An institution that has been quietly running certain GMO work at BSL-1 on the strength of a local risk assessment should expect that judgment to be reviewable by NIH.

The operational change that will actually cost money: 24 hours

Under the current NIH Guidelines, institutions report significant problems, violations, and significant research-related accidents and illnesses within 30 days, with expedited reporting for certain high-containment exposures.

The draft compresses that. The Biosafety Officer must report incidents posing significant risk to human health immediately — within 24 hours of the institution becoming aware — using the required template, with a full report due no later than 30 days after.

This is the single largest operational delta in the document, and it is the one most likely to produce noncompliance at otherwise well-run institutions. A 30-day clock tolerates the ordinary path an incident takes through a research organization: the lab tells the PI, the PI tells the safety office at the weekly meeting, the safety office consults the chair, and somebody drafts a report. A 24-hour clock does not. It requires a defined intake channel that is staffed on weekends, a designated person authorized to decide "this qualifies" without convening anybody, and a pre-drafted submission path.

The reporting trigger is also drafted around a judgment — "significant risk to human health" — that has to be made under time pressure by whoever is on call. Institutions that do not write down, in advance, what qualifies will make that call inconsistently, and inconsistency is what shows up in a compliance review.

The Biosafety Officer becomes a federal job description

The draft gives the BSO a defined set of duties rather than leaving the role to institutional discretion. Among them: reporting qualifying incidents to NIH on the template and timeline above; conducting periodic inspections to verify that containment facilities and equipment function properly, that biosafety standards are followed, and that IBC approval conditions are actually being met in the lab; reporting significant problems, Policy violations, and research-related incidents to the IBC and the institution; investigating incidents; and providing technical advice to the IBC and research personnel.

If an institution does not designate a BSO, it must assign another official to carry those duties. There is no version of the draft in which nobody owns them.

The inspection duty deserves attention because it converts the BSO from an advisor into a verifier. "Are the IBC's approval conditions being followed?" is a question with an answer, and someone is now formally obligated to go find it — which means findings will exist, in writing, that did not exist before.

Why this reaches beyond NIH-funded labs

The reach of the current Guidelines is institution-wide, not award-specific: an institution that receives NIH funding for recombinant or synthetic nucleic acid research must apply the Guidelines to all such research conducted at or sponsored by the institution, regardless of who funds it. If that architecture carries into the new Policy — and the draft is framed as compliance being a condition of NIH funding for the institution — then expanding the scope from engineered molecules to all biohazards expands the unfunded compliance footprint at the same time.

The concrete case: a privately funded laboratory working with wild-type pathogens at an NIH-funded university, currently outside the Guidelines because it does no recombinant work, plausibly lands inside the new Policy. Its costs are borne by the institution and reimbursed by nobody. Institutions with large industry-sponsored or foundation-funded microbiology portfolios should be sizing that exposure now, and should say so in a comment.

The policy weather this arrived in

The modernization initiative launched September 9, 2025, and ran six regional listening sessions through February 2026 before producing this draft. It did not arrive in a vacuum.

The May 5, 2025 Executive Order on Improving the Safety and Security of Biological Research paused dangerous gain-of-function research, directed OSTP to replace the May 2024 DURC/PEPP framework, and required NIH awardees to review their portfolios for covered work. NIH subsequently rescinded its DURC/PEPP implementation notice and stopped accepting applications for dangerous gain-of-function research. The 2026 U.S. Government Policy for Stopping High-Risk Life Sciences Research added International Research of Concern as a second prohibited category.

Those actions were about stopping a narrow band of research. This draft is about routinizing oversight of everything else — and that difference is why it deserves a different kind of attention from research offices. Gain-of-function restrictions affect a handful of laboratories at a handful of institutions. A rewritten biosafety policy affects every wet lab in the country.

What to do before October 19

Map your delta, not the policy. The useful internal document is not a summary of the draft. It is a two-column list: protocols your IBC reviews today, and protocols that would be in scope under the new definition. The gap is your cost estimate, and it is the number your comment should cite.

Time the 24-hour path against a real weekend. Pick a Saturday afternoon exposure scenario and walk it: who receives the call, who decides it qualifies, who has template access, who submits. If any step in that chain routes through a person who works Monday to Friday, you have found the finding.

Get your BSO to write the inspection protocol now. Periodic inspection verifying that IBC approval conditions are met in practice is a materially different activity from a facilities walkthrough. It requires reading the approved protocol before entering the lab. Staffing that at scale is a budget request, and budget requests submitted after a final rule are late.

Comment on the transition, not just the substance. The draft is a replacement, not an amendment, which means every currently approved protocol was approved under a superseded framework. Whether existing approvals carry forward, get grandfathered, or require re-registration is the difference between a manageable transition and a year of committee backlog. If the final policy is silent on this, institutions will each invent an answer — and some of those answers will be wrong.

Say what the deregulatory half is worth. NIH has proposed real burden reduction for low-risk recombinant work and real jurisdictional pruning. Comments that acknowledge and quantify that are more useful, and more persuasive, than comments that only itemize new costs. If streamlined RG1 handling frees 40 percent of your committee's agenda, that is evidence NIH can use to defend the change.

Comments go through the NIH Office of Science Policy portal and close October 19, 2026. NIH has published a summary table of proposed changes alongside the draft; read it before the full document, because it identifies where NIH itself believes the deltas are — which is where the agency is most receptive to being told it is wrong.

This is the last comment window before the framework that governs your IBC for the next twenty years is set. NIH ran six listening sessions to get here. The institutions that showed up to those are the ones whose concerns are already reflected in the draft. The same logic applies to the seven weeks that remain.

For related 2026 NIH policy shifts landing on research offices, see our analysis of NOT-OD-26-097 and cross-institution investigation sharing and the Department of War research security audits.