On July 28, 2026, NIH published Guide Notice NOT-OD-26-101, announcing the new United States Government Policy for Stopping High-Risk Life Sciences Research. The Policy was issued under Section 4 of Executive Order 14292. It bans federal support for dangerous gain-of-function (DGOF) research, restricts certain international work, and sets up a risk-based oversight framework that applies to all federally funded life sciences research, not only the small set of projects that used to fall under dual use research of concern (DURC) rules.

If you’re a biosafety officer, IBC chair, compliance director, or research security officer, the clock is already running. Federal agencies are expected to publish implementation guidance in mid-to-late November 2026. After that, institutions get a short window to stand up new review structures. The offices that do the groundwork now will have a much easier winter.

This post covers what the Policy says, what is paused, and a checklist your team can start on this week.

In This Article

1. What the Policy Actually Says
2. Timeline: What’s Paused and What’s Coming
3. A Practical Checklist for IBCs, Biosafety, and Sponsored Programs
4. How Digital IBC Workflows Like Fibi IBC Help You Prepare
5. The Bottom Line: Key Takeaways and Next Steps

What the Policy Actually Says

Two categories of highest-risk research

The Policy names two broad categories of life sciences research that pose the highest risk:

1. Dangerous gain-of-function (DGOF) research. This is research with a biological agent that seeks, achieves, or has a substantial risk of achieving one or more of seven outcomes and that could result in significant negative societal consequences. The outcomes are:

1. Enhancing the harmful consequences of the agent (this includes creating mirror organisms)
2. Disrupting beneficial immunological response or the effectiveness of an immunization
3. Conferring resistance to clinically or agriculturally useful prophylactic or therapeutic interventions, or helping the agent evade detection
4. Increasing stability, transmissibility, or ability to disseminate
5. Altering host range or tropism
6. Enhancing the susceptibility of a human, animal, or plant host population
7. Generating or reconstituting an eradicated or extinct agent

Federal funding status: prohibited.

The Policy also defines potential DGOF research: research that could potentially result in one of those outcomes. Potential DGOF work is permissible only after review and recommendation by a new Independent Third-Party Review Body (ITPRB) confirming that it does not meet the DGOF definition.

2. International research of concern (IROC). This covers research involving countries or entities of concern, meaning research conducted in a country of concern or conducted abroad by an institution or individual of concern. Federal funding for it is prohibited. “Other risky international research” carried out in countries whose oversight may not meet U.S. standards is allowed only after a risk-based assessment of the institution’s ability to provide adequate oversight.

A shift from lists to risk

The Policy describes itself as “a shift from the previous list-based approach to a risk-based approach.” It replaces the 2024 USG Policy for Oversight of DURC and Pathogens with Enhanced Pandemic Potential (along with the 2012, 2014, and 2017 frameworks it consolidated). It does not supersede the Federal Select Agent Program or export control regulations (EAR and ITAR).

Its scope is broad. “Life sciences research” covers all biological disciplines, and the Policy states that it includes funding for research infrastructure such as building or renovating BSL-3 or BSL-4 space. Purely computational (in silico) work is not prohibited unless it involves an entity of concern. Research that designs and then creates or modifies an agent meeting the DGOF or potential DGOF definition is covered.

The Policy also says plainly that it does not prohibit the development of medical countermeasures or international collaboration.

New roles and requirements for institutions

Several requirements will land directly on research offices:

• PI attestation: Before submitting a proposal for federal funding, PIs must decide whether the work meets the DGOF or potential DGOF definition and confirm that decision in writing. Research must be “continuously evaluated” for DGOF and IROC.
• Institutional Review Entity (IRE): Institutions that propose or support federally funded research with DGOF potential must establish an IRE of at least five members with relevant scientific expertise. The Policy encourages including IBC members and members of the local community, and it requires conflict-of-interest protections. The IRE works with the PI on an initial risk-benefit analysis, a full risk-benefit assessment and risk mitigation plan when needed, and at least annual review of funded projects. It must keep the records needed to demonstrate compliance.
• Institutional Contact for DGOF (ICDGOF): This is a designated official who certifies that applications are accurate and truthful and who serves as the liaison with funding agencies.
• 24-hour reporting: If research may meet the DGOF definition at any point, the PI must halt it and notify the ICDGOF, the IRE, and the funding agency within 24 hours.
• Non-federally funded work: Institutions receiving federal life sciences funds must have mechanisms to identify non-federally funded potential DGOF and DGOF research and must report it to their primary federal funding agency each year.
• Annual training: Institutions must provide annual DGOF training for researchers and keep a record of everyone who accepts and complies with the Policy.
• Key personnel and foreign collaborators: Proposals must list key personnel and their institutional affiliations, including proposed foreign collaborators. PIs must update the agency if personnel or aims change.

Enforcement with real teeth

Compliance will be written into award terms and treated as material to payment decisions under the False Claims Act (31 U.S.C. 3729(b)(4)). Violations, including deliberately false negative attestations, can lead to revocation of funding and up to five years of ineligibility for federal life sciences funds. The ITPRB may also randomly audit up to 25% of negative attestations each year.

Timeline: What’s Paused and What’s Coming

What is paused right now. According to NOT-OD-26-101, all research activities identified as potential DGOF under the earlier notices NOT-OD-25-112 (May 2025) and NOT-OD-25-127 (June 2025) remain paused until NIH-specific implementation requirements are established. The suspension under Section 3(b) of EO 14292 will be lifted only after agencies issue implementation guidance and the Policy’s review mechanisms are in place.

Key Policy milestones (counted from the Policy’s issuance; the document is dated July 20, 2026 and was publicly released July 28):

Window	Who	What
~90 days (mid-to-late Oct 2026)	Federal agencies	Establish a single ITPRB with charter, procedures, and review criteria
~120 days (mid-to-late Nov 2026)	Federal agencies; DNI, State, USDA, HHS	Issue DGOF and IROC implementation guidance; establish and publish the list of entities of concern
~180 days (mid-to-late Jan 2027)	Research institutions	Establish an IRE, designate an ICDGOF, launch annual training, adopt institutional policies for identifying DGOF and potential DGOF research
~180 days	Federal agencies	Build verification, compliance, and enforcement terms into life sciences awards

One detail matters for planning: institutional policies and procedures must be in place before any proposal categorized as potential DGOF can proceed to the funding agency. If your institution has projects waiting in the paused queue, the speed of your own setup will affect when they can move.

A Practical Checklist for IBCs, Biosafety, and Sponsored Programs

Agency guidance will fill in details, but nothing below depends on it. All of it is groundwork you’ll need whatever the final guidance says.

1. Inventory your potentially high-risk work

• Pull every active IBC registration involving recombinant or synthetic nucleic acids, select agents, and BSL-3 work.
• Screen protocols against the seven DGOF outcomes. Flag anything that looks like potential DGOF.
• Bring in projects already identified under NOT-OD-25-112 and NOT-OD-25-127 so you have one consolidated list.
• Include non-federally funded work. The Policy expects institutions to identify it and report it annually.

2. Map protocols to awards and proposals

• Link each flagged IBC protocol to its funding source(s), sponsor, award number, and PI.
• Find where proposals in development may need a DGOF or potential DGOF attestation.
• Note BSL-3 and BSL-4 construction or renovation funding, since the Policy counts it as life sciences research.

3. Plan your IRE and ICDGOF now

• Decide whether the IRE will be a new body, a subcommittee, or will draw on existing IBC membership. The Policy encourages IBC participation but doesn’t require it.
• Line up at least five members with the right expertise, a conflict-of-interest process, and NDAs or other access controls for sensitive information.
• Pick a likely ICDGOF candidate and work out how that role will relate to your Institutional Official, Biosafety Officer, and Responsible Official under the Select Agent Program.

4. Update SOPs and forms, but stay flexible

• Draft SOP language for initial risk-benefit analysis, escalation, the 24-hour halt-and-notify requirement, and annual IRE review.
• Add DGOF and IROC screening questions to IBC registration and proposal intake forms.
• Mark these as interim until agency guidance is published. Expect revisions.

5. Coordinate with research security and export control

• IROC review relies on key personnel, affiliations, foreign collaborators, and other support information that your research security and sponsored programs teams already collect.
• Keep an eye out for the published list of entities of concern, and decide who will screen against it.
• Remember that export control and Select Agent rules still apply alongside the new Policy.

6. Prepare training and records

• Scope an annual DGOF training module and a way to record who has completed it and accepted the Policy.
• Make sure you can produce an audit trail. The IRE must keep records demonstrating compliance, and negative attestations may be audited.

7. Watch for agency guidance

• Subscribe to NIH Guide notices and keep an eye on the NIH Office of Science Policy. NIH directs questions to SciencePolicy@od.nih.gov.
• If you hold awards from other agencies, expect agency-specific guidance from them too. The Policy requires each agency to issue guidance “specific to each department and agency’s mission and authorities.”

How Digital IBC Workflows Like Fibi IBC Help You Prepare

Most of the checklist above comes down to having connected, current, searchable data: which protocols involve which agents, who is on them, where the work happens, what funds it, and what the committee decided and when. Offices that still track registrations in email threads and spreadsheets will have a hard time producing that picture quickly, and a much harder time keeping it current once annual IRE reviews and attestation audits start.

A digital IBC protocol lifecycle can help in a few concrete ways:

• Structured agent and procedure data: Capturing biological agents, host organisms, containment levels, and procedures as structured fields makes it far easier to screen a portfolio than reading free-text PDFs.
• Configurable forms: When agency guidance arrives, you can add DGOF and IROC screening questions to registration forms without waiting on a full system rebuild.
• Review, agenda, and minutes management: Full-committee, designated-reviewer, and administrative reviews, along with generated agendas and minutes, create a documented decision trail.
• Expirations, renewals, and reminders: Automated notifications for renewals, training expirations, and continuing reviews fit naturally with the Policy’s annual review and training requirements.
• Connection to awards: When IBC records live in the same suite as grants and agreements, mapping protocols to funding sources is a query instead of a data-reconciliation project.

Fibi IBC, part of the Fibi research administration suite from Polus Solutions, was built around this kind of lifecycle: protocol creation, agent and host tracking, multiple review types, amendments and renewals, committee management, adverse event reporting, and compliance reporting. It connects with Fibi Grants, Agreements, IRB, IACUC, COI, and Export Control. Software won’t decide whether a project is DGOF. That takes expert human judgment, and the rules are still being finalized. What a connected system can do is give your biosafety and compliance teams a clear, auditable view of the portfolio so they’re ready to act as soon as guidance is published.

Want to see how a connected IBC workflow could support your office’s preparation? Explore Fibi IBC or request a demo to talk with our team.

The Bottom Line: Key Takeaways and Next Steps

The Policy for Stopping High-Risk Life Sciences Research is the biggest change to federal life sciences oversight in more than a decade. Its key provisions are a DGOF funding ban, ITPRB review for potential DGOF work, new institutional roles (the IRE and ICDGOF), PI attestations, and enforcement backed by the False Claims Act. Agency implementation guidance is due in mid-to-late November 2026, institutional structures are due about 60 days after that, and flagged projects stay paused until the system is in place.

Key Takeaways for IBCs and Compliance Offices

• DGOF research is no longer fundable: Federal support is prohibited for DGOF research, and potential DGOF work can proceed only after review and recommendation by the ITPRB.
• The scope is broad: The Policy applies to all federally funded life sciences research, not only the projects that used to fall under DURC rules, and it includes funding for BSL-3 or BSL-4 construction or renovation.
• New institutional roles are coming: Institutions with DGOF-potential research will need an IRE of at least five members and a designated ICDGOF, plus PI attestations, 24-hour halt-and-notify reporting, and annual DGOF training.
• Enforcement is serious: Compliance is material under the False Claims Act, violations can bring up to five years of ineligibility, and up to 25% of negative attestations may be audited each year.
• Watch the calendar: Agency implementation guidance is expected in mid-to-late November 2026, institutional structures are due around mid-to-late January 2027, and previously identified projects remain paused until the system is in place.

You don’t need to wait for the guidance to start. Inventory your portfolio, map protocols to awards, sketch out your IRE, and get your data in order.