The Perfect Storm of AI-Assisted Biotech Research and Bioengineered Materials: Biosecurity Compliance and Risk Management

Overview

Recent regulatory developments have highlighted the need for the U.S. biomedical research community to reassess and strengthen their biosecurity measures, particularly in research involving synthetic biology and potentially dangerous pathogens. U.S. research facilities, whether at academic research institutions or at life sciences companies, as well as organizations that are otherwise involved in the delivery of healthcare products and services, may be largely unprepared for the potential risks associated with malicious or even negligent genetic sequencing of bioengineered materials using “mail-order” synthetic nucleic acid sequences that can potentially evolve into a biosecurity threat. This threat is heightened when the research itself is innately higher-risk in nature (e.g., research involving Pathogens with Enhanced Pandemic Potential or PEPP, etc.) or when artificial intelligence (AI) is used to exploit or amplify the threat.

The Biden administration’s October 2023 Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (EO) addressed a number of concerns at the intersection of AI and biotechnology, and laid out a number of new approaches to better understand and reduce the potential for AI to enable biological risks. The EO is discussed in a recent Arnold & Porter Advisory entitled, “Addressing CBRN Threats and Promoting Responsible AI in Healthcare: Insights From President Biden’s AI Executive Order.” In the months since the EO was signed, various government agencies and responsible entities have been working through the first round of action items, which were due 180 days after the signing of the EO.

The EO is of particular importance to any organizations that receive or plan to request government funds for life sciences research involving the procurement of any type of synthetic nucleic acids and to organizations that manufacture or distribute any type of synthetic nucleic acids, or benchtop equipment for synthesizing nucleic acids, for federal government-funded research. In particular, the EO provides that by October 26, 2024, all federal agencies that fund life sciences research must, as appropriate and consistent with applicable law, establish that, as a requirement of funding, synthetic nucleic acid procurement for federally funded research must be conducted through synthetic nucleic acid and synthetic nucleic acid benchtop equipment manufacturers and distributors that adhere to the “Framework for Nucleic Acid Synthesis Screening” (Screening Framework), which was issued by the White House Office of Science and Technology Policy (OSTP) in April 2024. In turn, the Screening Framework requires, for those who must comply with the Screening Framework, compliance with the “Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids” issued by HHS in October 2023. And importantly, the National Institute of Health (NIH), which is a prolific funder of life science research, has already established binding guidelines pursuant to the Screening Framework.

Additionally, under a new Policy for Oversight of Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential (PEPP Policy), effective May 6, 2025, federal agencies that fund certain types of life sciences research on biological agents and toxins with dual use potential will need to ensure the recipients of the funding have certain measures in place and follow certain practices.

This Advisory synthesizes key points from recent guidance documents and frameworks to help the U.S. biomedical research community navigate the complex landscape of biosecurity compliance and risk management.

Key Regulatory Developments

May 6, 2024 PEPP Policy

As noted above, on May 6, 2024, OSTP released an expanded and unified PEPP Policy. This new U.S. government-wide policy combines the current “dual use research” of concern (i.e., research that has the potential to be both beneficial and harmful) and enhanced potential pandemic pathogen oversight frameworks. Further, the PEPP Policy expands the scope of research requiring additional scrutiny (among other things, by expanding the list of pathogens and viewing risks from a broader perspective); requires government agencies funding such research to ensure the recipient institutions have enhanced risk identification, management, and mitigation plans; and encourages institutions engaged in biomedical research to engage in robust collaborations with relevant government agencies. To assist such institutions, the OSTP has issued an extensive guidance document developed to assist with implementation of the PEPP Policy (Implementation Guidance), and the NIH intends to work closely with the biomedical research community to help them prepare for the May 6, 2025 effective date of the PEPP Policy.

Certain key provisions of the PEPP Policy are highlighted below:

• The PEPP Policy applies to all U.S. federal departments and agencies that fund or sponsor research, whether in the U.S. or internationally, that fits the criteria of enhanced oversight per the policy — Categories 1 and 2.¹
• Federal departments or agencies can condition the provision of funding to an institution on the institution attesting to the federal government that it will implement stricter oversight of non-federally funded Category 1 and Category 2 research in accordance with the research oversight framework under the PEPP Policy.²
• For research critical to address a national emergency, or where the risks outweigh the benefits, the secretary of the applicable federal agency may issue a temporary waiver from the oversight requirements of the PEPP Policy.³
• Enforcement would be the responsibility of the applicable federal departments or agencies, and noncompliance by institutions or researchers may result in the loss of current and future funding or sponsorship.⁴
• Institutions that do not receive federal funding, or that conduct research that involves biosafety or biosecurity risks but do not rise to the level of Categories 1 and 2, are strongly encouraged to take voluntary safety and security measures.⁵

Overall, the PEPP Policy signifies an important step towards better pandemic preparedness by enhancing regulations around research involving PEPP.

April 29, 2024 Screening Framework

As noted above, the OSTP also established a Screening Framework as required by the EO, and the National Institute of Standards and Technology is currently working with the Engineering Biology Research Consortium to engage experts, industry, and other stakeholders to develop technical screening standards and best practices in keeping with the EO and the Screening Framework. The Screening Framework aims to prevent acquisition of dangerous genetic materials by unauthorized parties.

Synthesized nucleic acids — DNA or RNA molecules with a specific customer-provided sequence — are commonly used for a range of research purposes, which in the wrong hands could be misused, including via the use of AI to enhance the sequencing process to create potentially harmful bioengineered materials. One possible way to mitigate such possible misuse is to screen the customers who are allowed to order synthesized nucleic acids, the sequences of nucleic acids themselves, or both. Previous screening measures, such as the October 2023 Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids (Screening Guidance) from the U.S. Department of Health and Human Services were voluntary and nonbinding. The Screening Guidance, among other things, outlines best practices to address biosecurity concerns associated with the potential misuse of synthetic nucleic acids in order to bypass existing regulatory controls and commit unlawful acts. Importantly, the Screening Guidance and Screening Framework not only apply to procurement of synthetic nucleic acids, but also to whole organism genomes (viruses, bacteria) containing any synthetic organic chemicals.

Reflecting several years of effort from a broad community of researchers, biosecurity experts, and synthesis providers, the Screening Framework implements a federal screening requirement for the first time: establishing that any research projects receiving federal research funding (e.g., at academic research institutions) will be required to procure synthesized nucleic acids, and synthetic nucleic acid benchtop equipment, only from organizations that follow certain screening guidelines. In particular, the Screening Framework provides that “within 180 days of the release of this framework [on April 29, 2024], federal research funding agencies will require recipients of federal R&D funds to procure synthetic nucleic acids only from providers that implement these best practices.” Thus, this deadline for federal agencies to establish such mandatory requirements is October 26, 2024. And importantly, the National Institutes of Health, which is the largest public funder of biomedical research in the world, has already established mandatory guidelines for research involving synthetic nucleic acid molecules, pursuant to the Screening Framework.

While the Screening Framework represents an important step to ameliorate biosecurity threats, potential implementation challenges could involve: (1) updating from time to time decisions regarding which nucleic acid sequences to screen for; (2) establishing and updating processes and infrastructure to develop and adapt screening measures given rapid technological advances; and (3) deciding which users present a “legitimate use” for a specified sequence. It is, as yet, unclear how such decisions should be made.

Current Biosecurity Controls

In addition to the new requirements, the U.S. biomedical research community must continue to implement current controls on pathogens and toxins including through the Federal Select Agent Program (FSAP) and export controls. The FSAP regulates the possession, use, and transfer of biological select agents and toxins that have the potential to pose a severe threat to public, animal, or plant health, or to animal or plant products. A broader set of controls applies to exports of specified pathogens and toxins controlled under the Export Administration Regulations and for certain defense-related elements and organisms under the International Traffic in Arms Regulations. Export controls can apply to specified biological materials that contain genetic elements and genetically modified organisms with DNA associated with the pathogenicity of controlled materials. Biomedical researchers should review especially carefully their work on sensitive pathogens and toxins to assess controls.

Actions to Consider

In addition to the specific requirements of the recent guidance documents and frameworks summarized above, institutions operating in the biomedical research space may wish to consider some or all of the following actions.

Review and Update Protocols and Policies:

• Reassess current biosecurity measures, including protocols and policies against new guidance, and develop best practices.
• Implement enhanced screening procedures for nucleic acid providers.

Assess Whether Research Falls Under the Select Agent Program or U.S. Export Controls:

• Inventory research on pathogens and toxins to determine potential restrictions.

Strengthen Oversight:

• Establish or reinforce committees overseeing high-risk research.
• Implement rigorous approval processes for PEPP-related studies.
• Enhance screening and background checks on individuals with access to PEPP-related studies.
• Ensure that, for those organizations importing or exporting these products, the products are correctly declared for import or export (as applicable) and documentation of compliance with the Screening Framework and other applicable requirements can be made available, if and as needed.

Enhance Training:

• Provide comprehensive biosecurity training for researchers and staff.
• Ensure awareness of and training related to new regulatory requirements.

Improve Facility Security:

• Upgrade physical and cybersecurity measures in research facilities.
• Implement stricter access controls to sensitive areas and materials.

Develop Incident Response Plans:

• Create comprehensive plans for potential biosecurity breaches.
• Conduct regular drills and simulations.

Ensure Compliance Documentation:

• Maintain detailed records of compliance efforts.
• Prepare for potential audits or inspections.

Conclusion

The groundbreaking EO will form a foundation for future policies governing AI and biological risk that will shape the biosecurity, national security, AI, and biomedical research communities for decades to come. Currently, this rapidly evolving regulatory landscape surrounding higher-risk biological research presents significant challenges for these communities. Proactive measures to address these new regulatory guidelines and frameworks are crucial to mitigate legal, reputational, and security risks, both at a micro or institutional level and at a macro or national level. Institutions and companies engaging in potentially applicable research should seek legal counsel to ensure full compliance and to develop robust risk management strategies.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.