The Grandfathering Fallacy

On 8 June 2026 the US Department of Defense added WuXi AppTec to its Section 1260H list of Chinese military companies. WuXi filed suit three days later, calling the designation erroneous. The sector read the headline, noted that nothing is actually banned yet, saw a grace period stretching most of a decade, and went back to work.

That reading is the mistake this piece is about.

There are two clocks running on the WuXi question, and they run at completely different speeds. One is legal, and it is slow. The other is physical, and it is slower than almost anyone with a WuXi line in their bill of materials has modelled. The danger is not the ban. The danger is the space between the two clocks, and the false comfort the slow one gives you about the fast one.

The legal clock is slower than it looks, and that is the trap

Start with what is actually true, because the careless version is everywhere.

The BIOSECURE Act became law on 18 December 2025, as a provision of the FY2026 National Defense Authorization Act. This matters: it is law, not a pending bill. But the enacted text names no companies. Unlike the 2024 draft that listed WuXi AppTec, WuXi Biologics, BGI and others by name, the version that passed designates nobody directly. Designation now runs through a separate machinery: an Office of Management and Budget determination process, and the 1260H list.

So the 8 June listing is not the ban. It is the ignition. A 1260H listing is one of the qualifying criteria that lets OMB designate a company a “biotechnology company of concern,” and once it does, BIOSECURE bars federal agencies, contractors and grant recipients from using that company's services on federally funded work. The prohibition itself is indirect. It is not “you may not use WuXi.” It is “you may not touch federal money if you do.”

Now the dates, drawn from the law-firm analyses tracking the rulemaking. OMB must publish its list of concern by around December 2026. Implementing guidance follows roughly 180 days later. The Federal Acquisition Regulation is then revised about a year after that, around mid-2028, and the prohibition takes effect roughly sixty days beyond it. Call it a 2028 event. Then the part everyone fixates on: existing contracts in place before the effective date are grandfathered for five years, which runs the protection out to around 2033.

Read that sequence the way a board under quarterly pressure reads it, and the conclusion writes itself: we have until 2033, so this is a 2030 problem, so it is not this year's problem. That is the Grandfathering Fallacy, and it is wrong on two counts.

First, the grandfather protects the contract, not the relationship. It lets you keep running the specific work already in place. It does not let you renew it, expand it, move a new programme onto that line, or re-source cleanly once the door has shut. A biologic whose commercial supply sits on a grandfathered WuXi line is not protected the day it needs a second source, a scale-up, or a label expansion. The protection is frozen around exactly what you have already committed, at exactly the moment your pipeline is trying to grow past it.

Second, the dates are soft, and they are soft in the direction that hurts. There is no statutory deadline forcing the FAR revision, so the back half of the timeline can slip. It can also compress if agencies move sooner, and several already are: the standalone DoD procurement track that accompanies a 1260H listing bars the Pentagon from contracting with a listed entity from 30 June 2026 and from procuring goods it produces from 30 June 2027, well ahead of the BIOSECURE machinery. A plan that assumes 2033 has no margin for a timeline that moves left.

One nuance that cuts against the panic version, and belongs in an honest read: WuXi Biologics, the large-molecule arm, was not on the 8 June list. WuXi AppTec was. “WuXi” is not a single exposure, and a diligence process that treats it as one will both overstate and misplace the risk. Know which entity, which site, and which modality actually sits in your chain.

The people who understood all of this did not wait for legal certainty. WuXi began repositioning assets well before enactment: WuXi AppTec sold its US and UK cell-and-gene business to Altaris Capital in December 2024, and WuXi Biologics sold its Dundalk vaccine plant in Ireland to Merck for around 500 million euros in early 2025, a deal openly framed against the BIOSECURE backdrop. The smart money started de-risking twelve to eighteen months before the statute existed. The laggard is the customer still waiting for the rule to be certain before acting on it.

Admissibility is not capability

Suppose you accept all of that and decide to move. Now the second clock starts, and it is the one that actually governs whether your product keeps reaching patients. A supplier that is legally clear is not the same as a supplier that can make and release your drug. Admissibility is not capability, and the gap between them is measured in years.

Begin with concentration, because it sets the queue you are joining. Roughly 70% of bioconjugate development work was outsourced as of recent industry data, against about 34% for other biologics: the ADC field leans on contract manufacturing far harder than the rest of the industry does. And that outsourced demand rests on very few shoulders. WuXi's bioconjugate arm, WuXi XDC, has taken its share of the global ADC contract-manufacturing market from under 10% in 2022, when it sat second to Lonza, to around 22% across 2024 and the first half of 2025, drawing level with Lonza at the very top of the market. The set of firms that can build an antibody-drug conjugate end to end, antibody through payload and linker to fill-finish under one quality system, is, in the words of one industry veteran, countable on one hand. Removing one of the two largest players from that set, for a large slice of the customer base, is not a rounding error. It is a structural tightening of an already narrow node, and it sits directly on top of the single-source payload and linker chemistry the whole modality already depends on.

Then the physics of switching. Qualifying a new manufacturing source is not a purchase order. Standing up a new sterile or aseptic facility runs three to five years from concept to operational, and an aseptic filling line alone carries an eighteen-to-twenty-four-month lead time before it is installed and commissioned. Transferring an established biologic or ADC process to a new site runs nine to eighteen months to a first released GMP batch, and often longer for an ADC, with analytical method transfer, not the hardware, usually sitting on the critical path. On top of that, adding a manufacturing site to an approved product requires a Prior Approval Supplement, whose FDA review can run from around four months to the better part of a year, before you can ship a single commercial unit from it. One biotech chief executive put the per-vendor cost of proving a new source at 500,000 to a million dollars and another nine to twelve months. None of that is optional, and none of it moves at the speed of a contract signature.

And here is the part that should unsettle anyone treating “find a Western site” as the answer: a legally clean Western site is not automatically a site that can pass inspection. In the seven months to May 2026, the FDA issued warning letters to four established fill-finish plants across the US, Canada, Germany and Greece, every one of them for aseptic or contamination failures, every one of them legally admissible the whole time. Jubilant HollisterStier in Kirkland, Quebec, cited in May 2026 for operators disrupting airflow over open vials and eighty-three colony-forming units, including mould, recovered from an operator with no investigation opened. Simtra in Halle, Germany, cited in March 2026 for forty-seven microbial recoveries over two years, fourteen above limit, including gram-negative organisms in its cleanest zone. The former Catalent site in Bloomington, now Novo Nordisk, cited in November 2025 over contamination that reached a customer's product. Pharmathen in Greece, hit with an import alert and an indefinite suspension of US supply. Four plants, none of them Chinese, none of them illegal, all of them taken partly or wholly offline by release integrity, not by capacity or by law.

That is the whole argument in one data set. The constraint that decides whether a drug ships is not the address on the building or its standing under BIOSECURE. It is whether the site can hold a quality system through an inspection, and that is earned over years by the people who run it, not conferred by a supplier switch.

Admissibility is not capability. Capacity is built. Release is earned. And the people who earn it are the scarcest thing in this supply chain.

The dependence is deepening while the clock runs

The uncomfortable backdrop to all of this is that the industry's reliance on China is not shrinking as the deadline approaches. It is growing.

Around 79% of the US biopharma companies in a 2024 industry survey held at least one contract with a China-based manufacturer. WuXi AppTec's own framing is that it touches roughly a quarter of all drugs used in the United States; treat that as the company's claim rather than an audited figure, but even discounted it describes a dependence that cannot be unwound in a planning cycle. And the direction of travel is the wrong way for anyone counting on a clean exit: WuXi AppTec's US revenue rose roughly 32% in the first nine months of 2025, with the US now its largest market. The decoupling is legislated. It is not, yet, happening in the order book.

The same pull shows up upstream, in where the molecules themselves originate. China now accounts for somewhere between a quarter and a third of all innovative molecules in global pipelines, up from a low single-digit share a decade ago, and by some measures close to 70% of global ADC development. When Pfizer committed up to 10.5 billion dollars to an Innovent-originated portfolio of ADCs and multispecifics in May 2026, and Bristol Myers Squibb up to 15.2 billion dollars to a Hengrui portfolio the same month, they were buying Western commercial rights to assets whose science, and often whose earliest manufacturing, sits inside the exact corridor BIOSECURE is designed to close. The pipeline is being re-shored on paper faster than the supply chain under it can be, and the same displacement is playing out one level down, where reshoring commitments outrun the shared sterile capacity the exempt modalities actually run on.

Where this lands

Put the two clocks back together and the shape is clear. The legal clock says 2028, or 2033 if you lean on the grandfather. The physical clock, the one that governs whether your product actually keeps reaching patients, says a clean second source is a three-to-five-year build, a nine-to-eighteen-month transfer, a four-to-six-month regulatory review, and an inspection you can only pass if you already have the people who can carry a quality system through it. Those two clocks do not overlap. Start the physical one on the legal one's schedule and you arrive late.

So the real question BIOSECURE puts to a board is not “are we legally exposed to WuXi.” It is “have we started the work that a clean exit actually requires, or are we pricing a five-year grandfather as five years of doing nothing.” The grandfather is not a reprieve. It is the length of rope the timeline gives you to hang the transition on, and most of it is consumed by qualification and inspection readiness, not by the calendar. It is also why so much announced Western capacity is not commercially schedulable the moment you actually need a slot.

The part capital cannot pour is, once again, the constraint. You can sign a new Western CDMO in a quarter. You cannot conjure the qualified people who release out of that site, or the inspection history that lets it run, on the same clock, and there are only a handful of sites that can do this work at all. The firms that come through the decoupling intact will be the ones that treated it as a manufacturing, quality and talent problem starting in 2026, not a legal problem starting in 2032.

Admissibility is not capability. Capacity is built. Release is earned. And the people who earn it are the scarcest thing in this supply chain. The same crowd-out is already visible in sterile fill-finish, where a higher-volume product class got to the slot first. BIOSECURE simply adds a second queue to the same narrow throat.

Sources and notes

This analysis draws on public filings, company disclosures and the law-firm rulemaking trackers current at the time of writing. All post-2026 regulatory dates are analyst projections, not statutory deadlines, and may change.

• BIOSECURE Act enacted 18 December 2025 (FY2026 NDAA); enacted text names no companies; designation via OMB process and 1260H list. Ropes & Gray, “BIOSECURE Act Enacted,” January 2026; Arnold & Porter, December 2025.
• WuXi AppTec added to DoD Section 1260H list, 8 June 2026 (65 entities added, 10 removed); WuXi Biologics not added. WilmerHale, 11 June 2026; Ropes & Gray, June 2026; Holland & Knight, June 2026.
• 1260H is distinct from BIOSECURE; DoD procurement bars from 30 June 2026 (contracting) and 30 June 2027 (goods); the listing does not itself restrict commercial transactions but is a trigger for OMB designation. Holland & Knight, June 2026; FDA Law Blog, June 2026.
• Rulemaking timeline: OMB list by ~December 2026; guidance ~mid-2027; FAR revision ~mid-2028; prohibition effective ~August 2028; five-year grandfather from FAR revision, running to ~2033. FDA Law Blog; Ropes & Gray; Holland & Knight.
• WuXi litigation filed 11 June 2026, US District Court for the District of Columbia. WuXi AppTec statement, June 2026.
• Divestitures: WuXi AppTec Advanced Therapies (ATU) sold to Altaris Capital, December 2024; WuXi Biologics Dundalk (Ireland) vaccine plant sold to Merck for ~€500m, announced January 2025. Fierce Pharma.
• ~70% of bioconjugate development outsourced vs ~34% of other biologics; WuXi XDC global bioconjugate CDMO share ~9.9% (2022) rising to ~22% (2024-1H25), level with Lonza. Frost & Sullivan, via CMBI research and the WuXi XDC IPO prospectus. Fully integrated end-to-end ADC CDMOs “countable on one hand.” BioProcess Online.
• Facility and transfer timelines: new sterile/aseptic facility 3-5 years; aseptic filling line 18-24 month lead time (IPS). Biologic/ADC tech transfer 9-18 months to first released batch; analytical method transfer often the critical path (ICH Q5E/PDA). Prior Approval Supplement 4-6 month FDA review. Per-vendor qualification ~$0.5-1m and 9-12 months (Sound Pharmaceuticals, via BioPharma Dive).
• FDA warning letters: Jubilant HollisterStier, Kirkland QC, 28 May 2026; Simtra BioPharma Solutions, Halle DE, 3 March 2026; Catalent/Novo Nordisk, Bloomington IN, 20 November 2025; Pharmathen, Sapes GR, 27 May 2026 (Import Alert 66-40, 23 April 2026). All verified on FDA.gov.
• ~79% of US biopharma hold at least one Chinese-CDMO contract. BIO survey, 2024, via BioPharma Dive. “Touches ~1 in 4 US drugs,” WuXi's own claim. WuXi AppTec US revenue ~+32% in first nine months of 2025. STAT, November 2025.
• China a quarter to a third of innovative molecules in global pipelines (Goldman Sachs, 2025; ING Asia Pharmaceuticals Report 2026, up from ~4% in 2014); ~70% of global ADC development Chinese-originated. Pfizer-Innovent up to $10.5bn (28-29 May 2026); BMS-Hengrui up to $15.2bn (12 May 2026). Company releases; CNBC.

This article is independent market intelligence and not investment, legal or regulatory advice. Figures are drawn from public sources and company disclosures believed reliable at the time of writing; forward-looking regulatory dates are analyst projections and may change. Company names and trademarks are the property of their respective owners. © 2026 ProGen Search Limited.