The European Union (EU) has resumed work to finalize legislation aimed at regulating access to synthetic genetic material, including DNA and RNA, that could be used to produce biological weapons.
If it is adopted, the European Biotech Act could significantly strengthen EU member states’ ability to implement their obligations under the 1972 Biological and Toxin Weapons Convention (BTWC), argues SIPRI’s Dr Miranda Smith, and the fact that it comes in response to market pressure speaks volumes about the state of multilateral arms control today.
In this Q&A, Smith talks about why the European Biotech Act is significant, the new biosecurity risks emerging in the era of rapidly developing artificial intelligence (AI), and what the Act can and cannot do.
Q: What is the European Biotech Act, and where are we in the process?
MS: The Biotech Act is primarily framed as an instrument to keep the EU competitive in the biotech realm, where EU companies have had difficulty converting biotech research into commercially viable products and risk falling behind the United States, China and others.
Most of the Act’s provisions are about supporting the European biotech sector, reducing bureaucratic hurdles, and standardizing rules and processes. But it also includes what I would say is the most substantial biosecurity legislation that the EU has ever attempted. Chapter VIII sets out provisions aimed at regulating access to synthetic genetic material that could potentially be used to create bioweapons. These would be the world’s first binding screening rules covering all suppliers selling into a single market—in this case the EU.
A proposed textof the Act was published by the European Commission in mid-December last year. Negotiations have just resumed, including on thousands of proposed amendments that were tabled by members of the European Parliament in July. The current goal is for the Parliament to vote on it in December, although that timeline could shift.
Q:Why are the Biotech Act’s biosecurity provisions needed?
MS: Genomic information about most of the known dangerous pathogens is already available in the public domain.
But over the past two decades or so taking that kind of genomic information and turning it back into physical material has become much easier and cheaper. Now you can order DNA to custom specifications from a commercial supplier and have it delivered in the regular post.
There are legitimate reasons why someone would want to recreate the DNA of a pathogen—for research on diagnostics, treatment and prevention, for example. But there is also a risk that synthetic DNA could be used to create a biological weapon.
In 2017 a small team in Canada reconstructed the horsepox virus using DNA fragments ordered from a commercial supplier. The work required specialist virology expertise and an appropriately equipped laboratory but was achieved in under six months and for less than US$100 000. That fact highlights why the Biotech Act is looking at supplies of synthetic DNA as the point of intervention in the supply chain.
It’s also important to note that the Canadian experiment was carried out without the help of AI. Current debates about generative AI have included concerns about increased biosecurity risks, adding to the urgency of regulating biotech and synthetic biology.
Screening requirements for orders of synthetic genetic material remain disjointed. The proposed rules would introduce common biosecurity requirements for suppliers selling into the EU market. By one estimate, only around 15 per cent of suppliers worldwide currently screen orders for potentially dangerous sequences. Gaps in screening create opportunities for orders of genetic material of concern to go undetected. The Biotech Act would serve to close at least some of those existing gaps.
Q: If it is adopted, how would the European Biotech Act address those risks?
MS:The biosecurity provisions in the current draft of the Act focus chiefly on commercial suppliers of synthetic nucleic acids, as well as online marketplaces, offering products on the EU market. They would place obligations on these ‘economic operators’ to verify the identity of whoever places an order for a biotechnology product of concern and assess that they have a legitimate need for it, as well as to refuse and report suspicious transactions.
The proposed Act would also establish a new expert body, the Advisory Group on Biosecurity,which would advise the European Commission on biosecurity risks from rapidly developing biotechnology, including AI models used in biological applications. If a model falls within the scope of the (2024) EU AI Act, the Advisory Group would refer its concerns to the AI Act's own panel of independent experts.
Then there is an article specifically on benchtop nucleic acid synthesizers: commercially available machines that can be used to synthesize DNA from genomic information. These must contain a screening mechanism to flag for sequences of concern.
It will be up to individual member states to implement and enforce these provisions. The Act sets a maximum penalty that can be imposed on a supplier for negligent or deliberate violations: up to 5 per cent of their previous year’s annual worldwide turnover. All member states must designate a competent authority to carry out inspections and enforce compliance.
An annex sets out in detail what is meant by a ‘sequence of concern’. These include both sequences matching the genomes of agents on internationally recognized control lists and sequences that could reasonably be expected ‘to increase a biological agent's ability to be used to deliberately cause disease or death . . . even if not derived from a listed agent’.
The annex also refers to fragments of DNA that could be assembled by someone with some laboratory skills to create sequences that fall into the first two categories. This is to cover a potentially important gap revealed by research on current select-agent regulations in the USA.
It’s worth noting that the biosecurity provisions are among the areas that have attracted the most proposed amendments. This is unsurprising given that they are proposing something so new. The co-legislators will still need to work through these details.
Q. How does AI change the biosecurity risks related to synthetic biology?
MS: AI can facilitate the design step in synthetic biology. There is published work now showing generative AI models producing functional genetic designs, and separate work showing that AI-assisted protein design can produce sequences that slip past the screening tools being tested. That presented a real problem, prompting updates to improve detection.
But the design is only part of the process. Laboratory skills, getting hold of materials, scaling up and delivering bioweapons remain significant barriers. Screening is not infallible, which makes improving sequence detection alongside customer verification essential. DNA synthesis is one point of intervention, a significant chokepoint where suppliers can check both orders and customers.
There are efforts to make sure that the Biotech Act is future-proof, so that it can keep up with new potentially dangerous sequences that are developed, including through AI, without the need to constantly update it. Some potentially dangerous sequences may not be on our radar now, but may be in two or three years. The annex is not limited to sequences from listed agents; it also considers sequences with potential harmful function. That allows it to capture some emerging risks without waiting for control lists to be updated. As scientific evidence develops, the Advisory Group would advise the European Commission on necessary updates, and the Commission could amend the annex through delegated acts.
Q. How significant is the European Biotech Act, especially given that it only covers the European market?
MS: The BTWC relies on national measures to prevent the proliferation of bioweapons. One thing that is really interesting about the European Biotech Act is that it could be a significant new means for EU member states to demonstrate national implementation of their BTWC obligations. And the fact that it is being done through market regulation rather than traditional arms control really says something about where the multilateral machinery is able to make progress and where it is not.
Looking at it from a different angle, it is a very positive thing that the Act incorporates biosecurity into what is essentially a market-focused instrument seeking to boost competitiveness in biotech and the health sector. Biosecurity is being treated as a fundamental condition for a successful biotechnology sector.
While the Act would only cover the EU market, I would not characterize that as a problem. This conversation has been ongoing for a couple of years in different parts of the world. The United Kingdom has issued voluntary guidance, while the USA has also linked screening requirements to federal research funding. In May 2025, the Trump administration ordered the US screening framework to be revised or replaced, but nothing has been seen publicly yet.
Regulations are coming in other markets, but by being ahead of the pack, the EU has a chance to set the standard for others to follow.
Q: Do you see any other potential limitations or factors that could jeopardize the effectiveness of the Act?
MS: When it comes to effectiveness, would the Act prevent a determined actor from creating a bioweapon? No, but no law is going to do that. What it could do and what we want it to do is to raise the cost, making it more difficult to order potentially dangerous DNA while remaining anonymous and invisible. It’s important to remember that the synthesis provisions only target one step in the process of developing a bioweapon: accessing genetic material. Interactions with other EU laws and structures will be essential to mitigating the new risks from AI and synthetic biology.
Probably the most serious potential limitation of the Act concerns the tempo: the technological capabilities it seeks to regulate move in months—weeks in some cases—whereas legislation tends to move in years. That has always been an issue. It can be managed, but the gap can probably never be closed entirely. One of the foremost priorities during negotiations has been future-proofing the Act.
But even if the Act is adopted, that is not the finish line. Important technical details and implementation arrangements still need to be developed. Adoption will therefore need to be followed by sustained work to make the requirements effective in practice.
Linked to that is the importance of properly engaging industry. They will need to understand what their new obligations are and how to fulfil them. They will need to make a range of adjustments as well as bearing the costs involved in screening and so on, and that will take time.
While industry associations have been involved in the process, it’s unclear how much the thousands of companies affected by the Act have been kept up to date. This is especially true when it comes to manufacturers of benchtop synthesizers. If manufacturers are unaware of the mechanisms they need to build into their equipment, that is not a good situation. The EU needs to prioritize engaging industry in the months ahead.
ABOUT THE AUTHOR(S)
Dr Miranda Smith is a Researcher in the SIPRI Weapons of Mass Destruction Programme.
The European Union (EU) has resumed work to finalize legislation aimed at regulating access to synthetic genetic material, including DNA and RNA, that could be used to produce biological weapons.
If it is adopted, the European Biotech Act could significantly strengthen EU member states’ ability to implement their obligations under the 1972 Biological and Toxin Weapons Convention (BTWC), argues SIPRI’s Dr Miranda Smith, and the fact that it comes in response to market pressure speaks volumes about the state of multilateral arms control today.
In this Q&A, Smith talks about why the European Biotech Act is significant, the new biosecurity risks emerging in the era of rapidly developing artificial intelligence (AI), and what the Act can and cannot do.
Q: What is the European Biotech Act, and where are we in the process?
MS: The Biotech Act is primarily framed as an instrument to keep the EU competitive in the biotech realm, where EU companies have had difficulty converting biotech research into commercially viable products and risk falling behind the United States, China and others.
Most of the Act’s provisions are about supporting the European biotech sector, reducing bureaucratic hurdles, and standardizing rules and processes. But it also includes what I would say is the most substantial biosecurity legislation that the EU has ever attempted. Chapter VIII sets out provisions aimed at regulating access to synthetic genetic material that could potentially be used to create bioweapons. These would be the world’s first binding screening rules covering all suppliers selling into a single market—in this case the EU.
A proposed text of the Act was published by the European Commission in mid-December last year. Negotiations have just resumed, including on thousands of proposed amendments that were tabled by members of the European Parliament in July. The current goal is for the Parliament to vote on it in December, although that timeline could shift.
Q: Why are the Biotech Act’s biosecurity provisions needed?
MS: Genomic information about most of the known dangerous pathogens is already available in the public domain.
But over the past two decades or so taking that kind of genomic information and turning it back into physical material has become much easier and cheaper. Now you can order DNA to custom specifications from a commercial supplier and have it delivered in the regular post.
There are legitimate reasons why someone would want to recreate the DNA of a pathogen—for research on diagnostics, treatment and prevention, for example. But there is also a risk that synthetic DNA could be used to create a biological weapon.
In 2017 a small team in Canada reconstructed the horsepox virus using DNA fragments ordered from a commercial supplier. The work required specialist virology expertise and an appropriately equipped laboratory but was achieved in under six months and for less than US$100 000. That fact highlights why the Biotech Act is looking at supplies of synthetic DNA as the point of intervention in the supply chain.
It’s also important to note that the Canadian experiment was carried out without the help of AI. Current debates about generative AI have included concerns about increased biosecurity risks, adding to the urgency of regulating biotech and synthetic biology.
Screening requirements for orders of synthetic genetic material remain disjointed. The proposed rules would introduce common biosecurity requirements for suppliers selling into the EU market. By one estimate, only around 15 per cent of suppliers worldwide currently screen orders for potentially dangerous sequences. Gaps in screening create opportunities for orders of genetic material of concern to go undetected. The Biotech Act would serve to close at least some of those existing gaps.
Q: If it is adopted, how would the European Biotech Act address those risks?
MS: The biosecurity provisions in the current draft of the Act focus chiefly on commercial suppliers of synthetic nucleic acids, as well as online marketplaces, offering products on the EU market. They would place obligations on these ‘economic operators’ to verify the identity of whoever places an order for a biotechnology product of concern and assess that they have a legitimate need for it, as well as to refuse and report suspicious transactions.
The proposed Act would also establish a new expert body, the Advisory Group on Biosecurity, which would advise the European Commission on biosecurity risks from rapidly developing biotechnology, including AI models used in biological applications. If a model falls within the scope of the (2024) EU AI Act, the Advisory Group would refer its concerns to the AI Act's own panel of independent experts.
Then there is an article specifically on benchtop nucleic acid synthesizers: commercially available machines that can be used to synthesize DNA from genomic information. These must contain a screening mechanism to flag for sequences of concern.
It will be up to individual member states to implement and enforce these provisions. The Act sets a maximum penalty that can be imposed on a supplier for negligent or deliberate violations: up to 5 per cent of their previous year’s annual worldwide turnover. All member states must designate a competent authority to carry out inspections and enforce compliance.
An annex sets out in detail what is meant by a ‘sequence of concern’. These include both sequences matching the genomes of agents on internationally recognized control lists and sequences that could reasonably be expected ‘to increase a biological agent's ability to be used to deliberately cause disease or death . . . even if not derived from a listed agent’.
The annex also refers to fragments of DNA that could be assembled by someone with some laboratory skills to create sequences that fall into the first two categories. This is to cover a potentially important gap revealed by research on current select-agent regulations in the USA.
It’s worth noting that the biosecurity provisions are among the areas that have attracted the most proposed amendments. This is unsurprising given that they are proposing something so new. The co-legislators will still need to work through these details.
Q. How does AI change the biosecurity risks related to synthetic biology?
MS: AI can facilitate the design step in synthetic biology. There is published work now showing generative AI models producing functional genetic designs, and separate work showing that AI-assisted protein design can produce sequences that slip past the screening tools being tested. That presented a real problem, prompting updates to improve detection.
But the design is only part of the process. Laboratory skills, getting hold of materials, scaling up and delivering bioweapons remain significant barriers. Screening is not infallible, which makes improving sequence detection alongside customer verification essential. DNA synthesis is one point of intervention, a significant chokepoint where suppliers can check both orders and customers.
There are efforts to make sure that the Biotech Act is future-proof, so that it can keep up with new potentially dangerous sequences that are developed, including through AI, without the need to constantly update it. Some potentially dangerous sequences may not be on our radar now, but may be in two or three years. The annex is not limited to sequences from listed agents; it also considers sequences with potential harmful function. That allows it to capture some emerging risks without waiting for control lists to be updated. As scientific evidence develops, the Advisory Group would advise the European Commission on necessary updates, and the Commission could amend the annex through delegated acts.
Q. How significant is the European Biotech Act, especially given that it only covers the European market?
MS: The BTWC relies on national measures to prevent the proliferation of bioweapons. One thing that is really interesting about the European Biotech Act is that it could be a significant new means for EU member states to demonstrate national implementation of their BTWC obligations. And the fact that it is being done through market regulation rather than traditional arms control really says something about where the multilateral machinery is able to make progress and where it is not.
Looking at it from a different angle, it is a very positive thing that the Act incorporates biosecurity into what is essentially a market-focused instrument seeking to boost competitiveness in biotech and the health sector. Biosecurity is being treated as a fundamental condition for a successful biotechnology sector.
While the Act would only cover the EU market, I would not characterize that as a problem. This conversation has been ongoing for a couple of years in different parts of the world. The United Kingdom has issued voluntary guidance, while the USA has also linked screening requirements to federal research funding. In May 2025, the Trump administration ordered the US screening framework to be revised or replaced, but nothing has been seen publicly yet.
Regulations are coming in other markets, but by being ahead of the pack, the EU has a chance to set the standard for others to follow.
Q: Do you see any other potential limitations or factors that could jeopardize the effectiveness of the Act?
MS: When it comes to effectiveness, would the Act prevent a determined actor from creating a bioweapon? No, but no law is going to do that. What it could do and what we want it to do is to raise the cost, making it more difficult to order potentially dangerous DNA while remaining anonymous and invisible. It’s important to remember that the synthesis provisions only target one step in the process of developing a bioweapon: accessing genetic material. Interactions with other EU laws and structures will be essential to mitigating the new risks from AI and synthetic biology.
Probably the most serious potential limitation of the Act concerns the tempo: the technological capabilities it seeks to regulate move in months—weeks in some cases—whereas legislation tends to move in years. That has always been an issue. It can be managed, but the gap can probably never be closed entirely. One of the foremost priorities during negotiations has been future-proofing the Act.
But even if the Act is adopted, that is not the finish line. Important technical details and implementation arrangements still need to be developed. Adoption will therefore need to be followed by sustained work to make the requirements effective in practice.
Linked to that is the importance of properly engaging industry. They will need to understand what their new obligations are and how to fulfil them. They will need to make a range of adjustments as well as bearing the costs involved in screening and so on, and that will take time.
While industry associations have been involved in the process, it’s unclear how much the thousands of companies affected by the Act have been kept up to date. This is especially true when it comes to manufacturers of benchtop synthesizers. If manufacturers are unaware of the mechanisms they need to build into their equipment, that is not a good situation. The EU needs to prioritize engaging industry in the months ahead.
ABOUT THE AUTHOR(S)