Every Institution With Federal Life Sciences Funding Must Stand Up a New Five-Expert Review Committee by January 2027. The Entity-of-Concern Lists Do Not Publish Until November.

The compliance officers who read the U.S. Government Policy for Stopping High-Risk Life Sciences Research carefully in the first week reached the same conclusion in roughly the same order. First: this is a gain-of-function policy, we do not do gain-of-function research, this is not about us. Second, some pages later: this is not a gain-of-function policy.

Released July 28, 2026 pursuant to Executive Order 14292, "Improving the Safety and Security of Biological Research," and carried into NIH's extramural rules through NOT-OD-26-101, the policy does three things at once. Only the first is what the title advertises.

It prohibits a defined category of dangerous gain-of-function research from receiving federal funds. It gates a much larger adjacent category behind a new government-wide independent review. And it creates an entirely separate regime — International Research of Concern — that has nothing to do with pathogen enhancement and everything to do with where your collaborators are.

The third one is the one that will touch the most institutions, and almost nobody is reading it.

From mitigation to prohibition

The prior framework — the 2024 unified policy covering Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential — was a risk-mitigation regime. Identify the research, assess it, apply a risk-management plan, proceed under conditions. The presumption was that the work would go forward with controls.

The new policy inverts that presumption for its top tier. Dangerous gain-of-function research is defined as research with a biological agent that seeks, achieves, or has a substantial risk of achieving specified harmful outcomes: enhancing pathogen lethality, disrupting host immunity, conferring resistance to interventions, increasing transmissibility, altering host range, or reconstructing eradicated agents. Federal funding for it is prohibited. Not conditioned. Prohibited.

Below that sits potential DGOF — research that could produce a listed outcome without clearly meeting the DGOF definition. Potential DGOF remains fundable, but only after an independent, government-wide review affirms it does not cross the line. That review is conducted by a new Independent Third-Party Review Body (ITPRB) standing up at roughly the 90-day mark.

The structural change worth internalizing: "seeks, achieves, or has a substantial risk of achieving" is an intent-and-risk standard, not an outcome standard. It reaches proposals, not just results. A study that never produces an enhanced pathogen can still be DGOF if the design carried substantial risk of doing so. Institutional review therefore has to happen at the proposal stage, by people competent to assess a risk that has not materialized — which is a materially harder judgment than checking whether an agent appears on a select agent list.

International Research of Concern is the sleeper

IROC covers research conducted in a country of concern, or conducted outside the United States by institutions or individuals of concern. Federal agencies may not fund research involving designated entities of concern, drawn from lists to be published by the Director of National Intelligence, the State Department, USDA, and HHS. Other foreign research does not become prohibited but requires risk-based assessment of the collaborator's biosafety compliance and institutional oversight capacity.

Notice what just happened. A biosafety policy now contains a research-security screen keyed to geography and named entities — the same architecture as foreign-influence disclosure rules and the Section 117 reporting regime, applied to life sciences funding, with funding prohibition as the enforcement mechanism.

The scope problem is immediate. IROC does not require dangerous pathogens. A field epidemiology study, a nutrition cohort, a plant genomics collaboration, a vector surveillance project — all are life sciences research, and all are subject to IROC screening if any part is conducted abroad or with a foreign partner. An institution with zero BSL-3 space and no gain-of-function portfolio can still have substantial IROC exposure through ordinary global health and agricultural collaborations.

And the sequencing is genuinely awkward: the entity-of-concern lists are not due until roughly the 120-day mark, in mid-to-late November, while institutions must have their review machinery operating by the 180-day mark in mid-to-late January 2027. You are required to build a screening process against a list that does not exist yet, then run your entire foreign portfolio through it in about eight weeks.

The only sane response is to build the process now against collaborator geography and institutional affiliation as the screening variables, so that when the lists publish you are running a query rather than starting a project.

The clock

The implementation timeline runs on day-counts from release:

Roughly 90 days — the Independent Third-Party Review Body is established.

Roughly 120 days (mid-to-late November 2026) — agencies issue implementation guidance and the entity-of-concern lists publish.

Roughly 180 days (mid-to-late January 2027) — institutions must have designated an Institutional Contact for Dangerous Gain-of-Function Research (ICDGOF) and stood up an Institutional Review Entity (IRE) with at least five life-sciences experts.

Agency-specific guidance will pin the exact dates; NIH's implementation notice is the authority for NIH recipients. But the institutional deadline is the one to plan against, and it is the hardest, because it is a standing-committee requirement.

The five-expert committee is the real cost

Institutions receiving federal life sciences funding must:

• Designate an ICDGOF as the institutional point of contact
• Establish an IRE with at least five life-sciences experts
• Evaluate all proposed and ongoing research for DGOF, potential DGOF, and IROC risk
• Certify in proposals that the classification is accurate
• Monitor and annually report potential-DGOF and DGOF research including work that is not federally funded
• Deliver annual researcher training
• Document every compliance determination

Two of those items are where the money goes.

"At least five life-sciences experts" is a hard floor, and your IBC does not satisfy it. Institutional Biosafety Committees exist under the NIH Guidelines for recombinant and synthetic nucleic acid research, with a specific composition including community members, and a specific charge. The IRE has a different mandate — classifying research against DGOF, potential-DGOF, and IROC definitions — and requires five people with life-sciences expertise. Overlapping membership is sensible and probably unavoidable. Treating the IBC as the IRE is not. If your institution has one biosafety officer and a committee that meets quarterly, standing up a second body with five qualified experts, a charter, a meeting cadence, and documented determinations is a real organizational build with a real budget line, and January is closer than it reads.

The non-federally-funded reporting obligation is the scope trap. Institutions must monitor and annually report potential-DGOF and DGOF research regardless of funding source. Foundation-funded work, industry-sponsored studies, internal startup packages, unfunded pilot work by a new faculty member — all in scope. Most institutions have no mechanism that reliably sees non-federally-funded research at the protocol level. Sponsored programs offices track awards; they do not track unfunded experiments. Building visibility into that portfolio is a genuinely new capability for most research administrations.

The penalties are why certification is a signature question

Consequences for noncompliance include immediate revocation of ongoing federal funding, suspension or termination of support, up to five years of ineligibility for federal life sciences funding, and — because the policy operates through certification — False Claims Act exposure where a certification proves materially false.

Five-year ineligibility for federal life sciences funding is an institutional extinction event for a research university's biomedical portfolio. And FCA exposure changes the character of the certification entirely. A certification that a proposal has been correctly classified is a representation to the government about a technical judgment made by a committee, signed by an official who did not make it.

That has one clear governance implication: decide now who signs, and make sure the signature rests on a documented determination rather than a form field. The institutions that get hurt here will not be the ones doing risky science. They will be the ones where an authorized organizational representative certified 400 proposals as a matter of routine because the box was in the workflow.

What to do before January

Inventory first, structure second. Pull every project involving biological agents, and separately, every project with a foreign site, foreign collaborator, or foreign subaward. Most institutions will find the second list is several times longer than the first and includes principal investigators who have never spoken to the biosafety office.

Do not wait for the entity lists. Build the IROC screen on geography and institutional affiliation now. When the lists publish in November, you want to run a query against an existing dataset, not build the dataset.

Charter the IRE as a distinct body. Overlap the membership with the IBC where it makes sense; do not merge the charge. Write the charter, name the five experts, and set the meeting cadence before the deadline rather than after.

Fix subawards and consortium agreements. The obligations flow down. Existing consortium agreements almost certainly lack DGOF and IROC terms, and amending them across an active portfolio takes months and requires the other party's cooperation. Start with your foreign subrecipients.

Build an interim screening protocol immediately. Proposals are going out now that will be certified under the new regime. A lightweight interim screen — two questions on the routing form about biological agents and foreign performance sites — costs almost nothing and creates the record you will want later.

Separate the certification from the determination. The person who signs should be signing to a documented IRE finding. Design that handoff before the first certification, not after the first problem.

The debate about whether this policy draws its lines in the right places is a real one, and it is being had loudly by people with strong views on both sides of the gain-of-function question. But that debate is orthogonal to the administrative reality facing a research institution this fall. The policy is issued, the clock is running from July, and the deliverable in January is a standing committee with five qualified experts, a documented process, and visibility into research your sponsored programs office has never seen.

For related compliance changes hitting research institutions this year, see our analyses of NIH's draft biosafety policy replacing the NIH Guidelines and the Section 117 foreign gift disclosure certification stack.