An official website of the United States government
How Do I Address Potential Foreign Risks in My Small Business Program Application?
The Small Business Innovation and Economic Security Act strengthens the government’s ability to prevent adversarial nations from exploiting federally funded technologies. Enacted in April 2026, the new legislation provides clarity to small businesses on the required areas of foreign risk assessment and the types of security risks that necessitate the denial of an award. NIH has a comprehensive Disclosure and Risk Management webpage that serves as your one-stop shop for guidance on how to avoid foreign risk when applying to our small business programs, which represent the largest source of financing for early-stage life science product development. In addition to describing the assessment areas and criteria, the website lists the new set of security risks that require a mandatory denial.
Here we offer a practical guide to help small businesses avoid security risks from foreign countries of concern when applying (currently defined as the People’s Republic of China, the Democratic People's Republic of Korea, the Russian Federation, and the Islamic Republic of Iran). Following these steps will help you protect your innovative research and development from adversarial nations and open the door for you to compete for this critical source of non-dilutive funding.
The first step is to identify which people and entities in your application will undergo evaluation. In addition to your small business, its owners, and your project’s key personnel, any person (or entity) who contributes in a substantive, meaningful way to the scientific development or execution of the project also comes under evaluation. That includes any consultants, contractors, service companies, and partners and their organizations.
The second step is to understand the elements of the foreign risk assessment and the mandatory denial criteria and review your company and collaborators against them. This is where reviewing the website, particularly the case studies, can really help.
Start with your own company, its ownership, and your internal covered personnel. Then apply the same scrutiny to external collaborators, while recognizing that the questions you need to ask may differ depending on whether you are evaluating your own organization and personnel or an outside individual or company.
Consider the following:
- Ownership, investment, and corporate structure. For your own company, identify its ownership and financial structure, including any parent companies and subsidiaries, and determine whether any owners or investors are located in a foreign country of concern. For an external company (such as a contractor, service provider, or partner) review its ownership, parent companies, subsidiaries, investors, and locations. Also determine whether the company or any related entity appears on a foreign risk entity list that requires automatic denial.
- Professional, institutional, and commercial affiliations. For owners and internal covered personnel, consider whether they have recent affiliations with an entity or research institution in a foreign country of concern, or any active technology licensing agreement or joint venture with an individual or entity in such a country. For external collaborators, ask about relevant current and recent affiliations and relationships.
- Active business relationships. Determine whether owners, internal covered personnel, external consultants, or other covered collaborators have active business relationships with an individual or entity in a foreign country of concern.
- Patents and patent applications. For internal covered personnel and external consultants, determine whether they have patent applications or patents filed within the last five years in a foreign country of concern before they were filed in the United States, or filed on behalf of an entity connected to a foreign country of concern.
- Malign foreign talent recruitment programs. Determine whether any owners, internal covered personnel, consultants, or other covered individuals have participated in a malign foreign talent recruitment program.
- Cybersecurity. Review your own company’s cybersecurity practices and whether they adequately protect the proposed research, technology, and other sensitive information.
External collaborators deserve particular attention. Since foreign risk assessment began in 2023, more than half of HHS’s denials have been due to foreign risks involving consultants or contractors. Not sure whether a consultant or contract research organization will create a foreign risk? Ask about their ownership, relationships, affiliations, and other relevant activities, and conduct your own research as well. If a prospective collaborator creates a foreign risk that would prevent an award, replace them before you apply.
What to do with this information before applying…
After gathering this information from your company, key personnel, and collaborators, consider whether any relationships with foreign countries of concern could pose a security risk. Before submitting your application, make any necessary changes to ensure your project is free of foreign security risks.
Then, if your application receives a favorable peer review outcome, NIH institute or center staff will ask you to submit additional information via the Just-In-Time (JIT) process.
During this process, you will be required to submit the Foreign Disclosure Form. This is when you will submit ONE completed Foreign Disclosure Form that covers all covered individuals and entities on your project, using the information you collected in step 2. For each question on the form, provide detailed information that reflects the answer for all covered individuals – from your company, consultants, and contract research organizations.
After you submit your Just-in-Time documents, HHS will conduct due diligence to determine whether your application meets the foreign risk requirements for funding clearance. If a risk is identified, your notification will specify the applicable risk category to help you identify and address the issue. You will need to remove the risk and reapply for a future receipt date. Learn more about the HHS review process in NOT-OD-26-074.
By taking these steps to identify and address foreign risk before you apply, you help safeguard U.S. investment in biomedical research and small business innovation from undue foreign influence.
Resources to help determine if a foreign relationship will create a risk…