Defense Funding and Policies Set for Next Year as FY2026 NDAA Becomes Law

The scope of the FY2026 National Defense Authorization Act, now passed by the House and Senate and signed by the president on December 18, signals a deliberate push to accelerate capability delivery, strengthen supply chains, modernize acquisition, and foster innovation.

The National Defense Authorization Act for Fiscal Year 2026 (the 2026 NDAA or Act) is a comprehensive annual defense policy measure spanning multiple divisions that authorizes and guides activities across the US Department of Defense (DoD), Department of State, Intelligence Community, Coast Guard, and other national security stakeholders.

Businesses operating in the defense sector look to the NDAA to understand the defense community’s priorities that will directly shape opportunities and compliance obligations for the upcoming year. House and Senate leadership released conference text (S. 1071) earlier this month following bicameral, bipartisan negotiations. That legislation was passed by the House on December 10 by a 312-112 vote. The Senate passed S. 1071 on December 17 (77-20), sending the 2026 NDAA to the president to be signed into law. The president signed the NDAA (S. 1071) into law on December 18.

ACQUISITION REFORM

As previewed by the Secretary of Defense’s advocacy over the last year, the Act advances significant federal acquisition reforms that, if passed, would help the defense community engage in more efficient and extended procurements. It contains a dedicated Acquisition Reform title that aims to align the defense acquisition system with end user needs, establishes portfolio acquisition executives with direct program authority, and stands up “Project Spectrum” to support small and medium businesses’ cybersecurity and acquisition readiness by providing them an online platform of digital resources, training, and services.

A highly anticipated step is the emphasis on multiyear contracting authority, which creates more long-term planning opportunities for contractors. Further, starting in fiscal year 2027 to 2031, an annual report from the Secretary of Defense must be provided that includes all canceled contracts above the simplified acquisition threshold (currently $350,000 (effective October 1, 2025)) from the preceding year. The first report in fiscal year 2027 will include contracts from fiscal year 2025. The Act also codifies the prohibition on diversity, equity, and inclusion programs and practices within the DoD.

The Act also focuses on updating commercial procurement pathways by refining rules for commercial products and services and codifying definitions in an attempt to accelerate contracting and pricing processes. It also benefits nontraditional defense contractors by expanding the definition and exempting them from several sections of DoD supplements such as having significant independent research and development, which helps alleviate the burden for new DoD market entrants.

These exemptions do require approval by a senior contracting official. Other updates include establishing alternative test and evaluation pathways for each branch of the military that align developmental testing and operational testing to a single set of test objectives to more effectively support capability delivery.

Notably, the 2026 NDAA omitted a bipartisan-supported provision on so-called “right to repair.” The contemplated right to repair would have required companies to provide the necessary technical data to make it possible for military personnel to repair equipment on their own. Proponents argued that this provision would save costs and increase flexibility while opponents claimed it would disincentivize innovation and could compromise ownership of trade secrets.

In place of the contemplated provision, Section 805 of the Act requires the Secretary of Defense to develop and implement a digital system to track, manage, and enable the assessment of “covered data” and verify whether contractors and subcontractors comply with contract requirements related to “covered data.” While narrower than the original provisions in the House and Senate versions, both the insertion of a compromise provision and the public bipartisan support suggest that IP licensing considerations may be revisited as part of current or future legislative negotiations.

Bid Protests

Various policymakers have argued for some time that the mechanism for protesting contract awards is ripe for abuse and causes unnecessary delay and expense. While some policymakers have proposed instituting a “loser-pays” model in the past, the Government Accountability Office (GAO) submitted a letter to Congress (as required by the 2025 NDAA) addressing the loser-pays model and advocating against its institution.

By statute, an agency generally must stay performance of a protested contract while the GAO considers the protest. A side effect of the stay is that an agency may extend the performance of the incumbent’s contract or award a short-term bridge contract to ensure continued performance until the stay is lifted. This arrangement could be viewed by some as incentivizing an incumbent who loses a bid for a follow-on contract to lodge a protest if for no other reason than to hopefully secure ongoing business until the protest is resolved.

To curb this perceived incentive to file frivolous protests, and frivolous protests in general, policymakers have advocated for requiring a losing party to pay the costs of a protest. These efforts to include so-called loser-pays provisions were largely unsuccessful, until now.

Emphasizing again the theme of speed, the NDAA contains a provision allowing the DoD to disincentivize incumbent contractors from filing frivolous protests.

Specifically, Section 875 provides that, should an incumbent protest the loss of a follow-on contract and the DoD extend the incumbent’s contract or award it a bridge contract to cover performance during the stay, Defense can withhold up to 5% of the payment due under the extension or bridge contract. This withheld amount is forfeited by the incumbent if the GAO dismisses the incumbent’s protest for “lack of any reasonable legal or factual basis.”

So, while the NDAA creates a loser-pays rule for the first time, it is cabined in important aspects. Namely, only incumbents who protest the loss of a follow-on contract risk penalties and, even then, the penalty is triggered only if the GAO dismisses the protest for being frivolous and limited to up to 5% of the payments due under an extension or bridge contract.

COST ACCOUNTING STANDARDS

The NDAA also aims to streamline performance and encourage companies to bid for more and larger contracts by raising the threshold for when Cost Accounting Standards (CAS) apply to an award. CAS requirements can impose a substantial compliance burden on contractors, and many companies limit the government contracts they pursue to prevent triggering CAS requirements. The NDAA eases this compliance burden in two major ways.

First, the NDAA raises the CAS coverage exemption threshold from any contract under $2.5 million to $35 million. Note that, in practice, this change eliminates the “trigger” contract mechanism whereby a single contract valued at $7.5 million triggered CAS requirements not only for that contract and contracts greater in value but also for contracts between $2.5 million and $7.5 million.

Second, the NDAA raises all thresholds for full CAS coverage to $100 million (from $50 million). So, awards between $35 million and $100 million will be subject only to modified CAS coverage unless the relevant business unit received in the past accounting period $100 million or more in CAS-covered awards, in aggregate or from a single award.

The NDAA also exempts nontraditional defense contractors—entities that have not performed under a DoD contract or subcontract requiring full CAS coverage for one year prior to the solicitation—from several CAS requirements.

BIOTECHNOLOGY AND LIFE SCIENCES

The NDAA establishes a Biotechnology Management Office within the DoD to centralize and execute DoD’s biotechnology strategy, update acquisition policies for biotech, coordinate across industry stakeholders, streamline regulatory processes, and identify workforce gaps, with briefings and a sunset in 2030.

The DoD may launch a bioindustrial commercialization program to expand domestic bioindustrial manufacturing via competitive awards emphasizing supply chain resilience, defense requirements, and geographic distribution, with reporting and a 10 year sunset subject to possible extension. A biotechnology supply chain resiliency program authorizes military laboratories to establish mechanisms that advance applied research, prototyping, infrastructure upgrades, public-private partnerships, and workforce development to mitigate vulnerabilities and strengthen transition to the defense supply chain.

The Act directs policies for storing “qualified biological data resources” from fully DoD funded research to facilitate AI use, reflecting a convergence of biotechnology and AI priorities. The DoD must issue an overarching Biotechnology Strategy (due June 1, 2026), guidance for ethical and responsible biotech development and deployment, and biobased product merit guidance to enable private entities to demonstrate compliance with military requirements.

Lastly, aspects of the heavily debated BIOSECURE Act appear in the 2026 NDAA, with particular reference to a prohibition on executive agencies procuring biotechnology from “biotechnology companies of concern.” A biotechnology company of concern is defined in the Act as a biotechnology entity identified on the DoD’s Section 1260H list or determined by criteria applied by a new interagency process led by the Office of Management and Budget.

DEFENSE INDUSTRIAL BASE

Supply chain and domestic sourcing provisions in the Act aim to enhance supply chain resilience through secondary source qualification. This qualification would expedite the approval process for products and services that otherwise may require additional evaluation by the DoD; for instance, the Act specifies the establishment of a uniform evaluation and acceptance methodology to which aeronautical spares or repairs with civil aviation authority approval are automatically qualified for use on equivalent military aircraft without additional certification.

The 2026 NDAA also seeks to incentivize contractors who discover noncompliant items (items subject to national security controls) and promptly disclose that discovery by making them eligible for a waiver of the item subject to an assessment of its safety risks. In the same vein, the Act aims to eliminate DoD sourcing from foreign adversary nations, particularly for optical glass by 2040 and computer displays by 2030. The Act also creates a voluntary compliance repository for operators to register their covered products without having to completely remove them from operation.

Industrial base measures aim to harmonize cybersecurity requirements and internal policies across the DoD and provide a report on those harmonization efforts. The NDAA modifies the defense industrial base fund to support production of kinetic capabilities, microelectronics, machine tools, critical minerals, unmanned vehicles, and defense space systems, among other capabilities. The NDAA also establishes a pilot program that could treat financing costs as allowable and allocable for DoD contracts to support matching government and private investments.

Additional provisions create a Civil Reserve Manufacturing Network to broaden domestic manufacturing by expediting qualifications of commercial manufacturing facilities to that of DoD manufacturing facilities. Lastly, the NDAA calls on the DoD to submit a report to Congress detailing regulations and policies that discourage or prevent contractors in the defense industrial base from maintaining or investing in surge capacity.

DEFENSE PRODUCTION ACT

The 2026 NDAA has also extended the Defense Production Act (DPA) until September 2026. Originally enacted in September 1950, the DPA provides the president expansive powers to direct domestic production through executive order. Under Title III of the DPA, the president can offer loans, grants, and purchase guarantees to private companies to bolster the defense industrial base using monies appropriated to the DPA fund by Congress.

Both the Trump and Biden administrations invoked the powers during their tenures for purposes ranging from increasing the supply of medical equipment during COVID to shoring up infant formula shortages. Most recently, and following the issuance of Executive Order 14241 (which inextricably linked national and economic security with domestic mineral production), the DPA has been utilized to increase domestic capacity for critical mineral mining.

The DPA has also been amended by the NDAA to support, as part of the SkyFoundry Program, the United States’ domestic industrial base capacity for small, unmanned aircraft systems and associated energetics and autonomous systems, presenting an opportunity for new and existing companies in the small drone space.

CYBERSECURITY AND AI

Title XV directs the DoD to implement a departmentwide artificial intelligence and machine learning security policy within 180 days that addresses model tampering, prompt injection, lifecycle security, governance, testing standards, and workforce training. It also mandates a procurement security framework that draws on NIST SP 800 series and Cybersecurity Maturity Model Certification, with DFARS updates to require covered entities to implement tailored best practices.

The Act also creates criteria to accelerate Authorization to Operate timelines for cloud hosted systems by creating expedited pathways and appeals. It calls on the DoD to issue guidance and prohibitions on certain “covered artificial intelligence,” establishes AI model assessment and oversight via a cross functional team, and requires DoD to create a task force on digital sandbox environments to accelerate responsible AI adoption.

As noted above, the cybersecurity harmonization efforts seek to reduce duplicative and contract unique requirements and centralize unpublished requirements with governance and reporting through 2029, aiming to streamline vendor compliance at scale.

OUTBOUND INVESTMENT AND EXPORT CONTROLS

As expected, the Act expands the Department of the Treasury’s outbound investment regime that was implemented earlier this year in several respects. It expands the covered technology areas beyond the preexisting semiconductor, AI, and quantum computing to include hypersonic missiles.

It expands the “countries of concern” beyond China (including Hong Kong) and Macau to also include Cuba, Iran, North Korea, Russia, and Venezuela. It expands “covered parties” to include expressly members of the Chinese Communist Party, political leadership from a country of concern, and those “subject to the direction or control of” a country of concern. Finally, borrowing language from the COINS Act, it expands “covered national security transactions” to include contingent equity interests, loans or debts to covered persons, joint ventures, and the leasing of land or property.

The Act also advances AUKUS related export streamlining by exempting specified congressional notifications and permitting certain reexports/retransfers among the United States, Australia, and the United Kingdom under certain ITAR provisions, while requiring periodic review of the Excluded Technology List to calibrate the scope.

The Act further directs the creation of a technology transfer and foreign disclosure framework to rebalance protection and sharing, with recommendations to update the National Disclosure Policy for technologies including AI and cybersecurity and engaging nontraditional defense contractors. Separately, the Act tightens measures to prevent circumvention by Chinese military companies, broadening definitions of covered entities and requiring the DoD to consider other US lists when revising its Section 1260H list.

NEXT STEPS

The 2026 NDAA aims to accelerate commercial integration, reduce procedural barriers for nontraditional contractors, modernize testing and data practices, and scale industrial base capacity—all while elevating biotech, AI security, and supply chain resilience as core pillars for future readiness.

For businesses, near term opportunities include consumption based solutions, commercial solutions openings with follow on production, Defense Innovation Unit–linked fielding pathways, advanced manufacturing capability, and bioindustrial commercialization incentives; challenges will center on meeting new AI security frameworks, sourcing prohibitions, data ownership and access expectations, and enforceable cybersecurity baselines.

Companies that align roadmaps to these mandates—investing in compliant architectures, resilient supply chains, secure AI lifecycle practices, and advanced manufacturing readiness—will be best positioned to capture the 2026 NDAA–driven demand signal across US and allied defense markets.

STAY INFORMED

Visit our US Administration Policies and Priorities resource center and subscribe to our mailing list for the latest on programming, guidance, and current legal and business developments.

Associate Steven Liang contributed to this LawFlash.