Policy Frameworks for AI-Bio Convergence
AI-bio policy is a patchwork: biosecurity rules assume physical materials, AI rules assume digital systems, and the intersection is only partly covered. Sort every instrument by legal force. Binding or funding-conditioned tools (Select Agents, PREVENT, the July 2026 high-risk life sciences policy under EO 14292) differ from voluntary industry commitments, and both differ from proposals such as Biosecurity Data Levels (BDL). Binding, voluntary, and proposed frameworks appear side by side below, with U.S. status dated as of August 2026 and links to the primary sources; the BDL proposal itself is published by Bloomfield et al. in Science and on arXiv.
- Map existing biosecurity governance frameworks (BWC, DURC, select agent regulations) to AI-enabled biological risks.
- Evaluate proposed policy interventions including compute governance, DNA synthesis screening, and model access tiers.
- Analyze the roles of different stakeholders (governments, companies, researchers, international bodies) in AI-bio governance.
- Identify governance gaps where AI and biosecurity converge.
- Apply a layered defense framework to policy design for emerging biological risks.
Introduction: Governing the Ungoverned Space
AI intersects with biological risks at three levels: providing information (LLMs and Information Hazards), enabling design (AI-Enabled Pathogen Design), and potentially executing experiments (Cloud Labs and Automated Biology). Each intersection reveals governance gaps.
The challenge is that AI-bio convergence creates risks that straddle traditionally separate policy domains:
- Biosecurity policy assumes physical materials (pathogens, equipment) and trained personnel
- AI policy assumes digital systems, computational resources, and model outputs
- Neither fully addresses what happens when AI systems enable biological work
This intersection is currently governed through a patchwork of existing frameworks, voluntary commitments, and emerging proposals, and coverage is uneven.
A relatively narrow window remains in which proactive governance is possible.
- AI capabilities for biological design are advancing but not yet mature
- Cloud lab automation is growing but not yet ubiquitous
- The biosecurity community is increasingly engaged with AI risks
- Major AI companies are receptive to governance discussions
Once a serious incident occurs, policy will shift to reactive mode. History suggests reactive biosecurity policy is often poorly calibrated: either too restrictive (hindering legitimate research) or too narrow (missing the actual threat). The goal is to get governance right proactively.
The International AI Safety Report 2026 is an international evidence synthesis prepared with guidance from experts nominated by governments and intergovernmental organizations. Its biological-risk discussion describes capability and governance uncertainties, but it is not a binding policy instrument or an independent certification of any model. The report reinforces the need for explicit assumptions, evidence grading, and reassessment as capabilities change.
Existing Frameworks and Their Limitations
The Biological Weapons Convention (BWC)
The Biological Weapons Convention, which entered into force in 1975, prohibits the development, production, and stockpiling of biological weapons. It represents the foundational international norm against bioweapons.
What it covers:
- General prohibition on bioweapon development
- Commitment to peaceful use of biology
- Framework for international cooperation
What it misses:
- No verification mechanism (unlike the Chemical Weapons Convention)
- No provisions addressing AI, computational biology, or information hazards
- Relies on national implementation, which varies widely
- Does not address private sector or non-state actors effectively
The BWC’s strength is its normative power: it establishes that bioweapons development is unacceptable. Its weakness is enforcement. For AI-bio convergence, the greater weakness is conceptual: the BWC was written for a world of state programs, physical pathogens, and traditional laboratories.
WHO Pandemic Agreement negotiations have centered on Pathogen Access and Benefit Sharing (PABS), including equitable access to vaccines, diagnostics, and therapeutics derived from shared pathogen materials and sequence information. The World Health Assembly adopted the Agreement in May 2025 as WHA78.1, but adoption was not entry into force.
The eighth Intergovernmental Working Group session (September 14–18, 2026) advanced Pathogen Access and Benefit Sharing annex negotiations but did not finalize the text. WHO reports that finalizing the annex remains required before countries can consider signature and ratification, with further work continuing toward World Health Assembly consideration (target May 2027, or earlier if a special session is called) (WHO, 2026; WHO, 2026). See Surveillance Equity for the historical context of benefit-sharing disputes.
RAND analysts have noted the Pandemic Accord’s dangerous blind spot: the agreement contains only two references to “laboratory biological risk management” and barely acknowledges laboratory biosafety and biosecurity as threats to global health security. They recommend mandatory reporting for laboratory accidents and Joint External Evaluation-style assessments of laboratory capabilities, noting that three-quarters of BSL4 laboratories are in urban areas where accidents could pose community risks.
The agreement does include references to biosafety and biosecurity training, transport security, and pathogen access safeguards tied to risk assessment within its pandemic prevention provisions. But these provisions are minimal rather than robust, giving biosecurity advocates a live multilateral instrument to point to while falling well short of enforceable laboratory governance.
Select Agent Regulations
In the United States, the Federal Select Agent Program regulates possession and use of dangerous pathogens and toxins. Similar programs exist in other countries.
What it covers:
- Registration of entities possessing select agents
- Personnel reliability screening
- Physical security requirements
- Transfer controls
What it misses:
- Information about how to create or modify pathogens (not regulated)
- AI-generated designs that could produce equivalent dangers
- Synthetic constructs that do not match listed agents but could be equally harmful
Select agent regulations remain essential, but they address physical possession rather than capability. A world where AI can design novel pathogens with equivalent danger to select agents is not one these regulations were designed for.
RAND’s 2025 assessment of the Federal Select Agent Program identifies gaps across four categories: identification of new agents of concern, speed of response to novel pathogens, transparency of designation criteria, and institutional culture prioritizing security over safety. Emerging biotechnologies, including AI, call for proactive FSAP review.
Dual-Use Research of Concern (DURC) Policies
NIH policies on DURC require institutional review of federally funded research that could be misused to threaten public health or national security.
What it covers:
- Institutional biosafety committee review
- Risk-benefit assessment
- Risk mitigation measures
What it misses:
- Research not federally funded
- AI system outputs (not “research” in the traditional sense)
- Work conducted outside traditional institutions (startups, cloud labs)
- International actors not subject to NIH oversight
DURC policies represent a mature approach to dual-use governance, but their applicability to AI-generated biological designs is unclear. Two questions remain open: whether an AI output counts as “research,” and who the “researcher” is when an AI designs a sequence.
In May 2024, the US government announced an updated Policy for Oversight of DURC and Pathogens with Enhanced Pandemic Potential (PEPP), set to take effect May 6, 2025. As designed, this policy:
- Expanded and unified previous DURC and P3CO policies
- Applied to all federal departments and agencies funding life sciences research
- Could require institutions to implement oversight of non-federally funded research as a condition of receiving any federal funding
However, the policy remained focused on physical experiments with pathogens, not AI systems that provide advice or design capabilities.
On May 5, 2025, the day before the policy was set to take effect, Executive Order 14292 directed revision or replacement of the 2024 policy and suspension of federally funded research meeting the order’s definition of dangerous gain-of-function research (White House, 2025). NIH rescinded its January 2025 implementation notice and then issued NOT-OD-25-127, which terminated specified foreign support and suspended other covered NIH support until the new policy is implemented. The replacement arrived on July 28, 2026: the U.S. Government Policy for Stopping High-Risk Life Sciences Research, issued under Section 4 of EO 14292 with NIH implementing notice NOT-OD-26-101. It prohibits federal support for dangerous gain-of-function research, establishes independent review for other high-risk life sciences research, and conditions federal funding on adequate biosafety and oversight standards at the performing institution or country. Agencies have 90 days to establish a single independent third-party review body and 120 days to publish implementation guidance, with the policy effective mid-November 2026. Between the May 2025 suspension and the July 2026 release, federally funded work in this category sat under a fifteen-month interim status that was a funding-agency posture rather than proof that every pre-2024 rule automatically governed every project. A 2025 peer-reviewed commentary documented the definitional and implementation uncertainty produced by the transition (mSphere, 2025).
Early implementation evidence on the 2024 framework still matters because the same barriers will face any successor regime. A grounded-theory study of 45 U.S. biosafety officers, compliance professionals, and researchers found that practitioners supported the goals of DURC/PEPP oversight but identified ambiguous definitions, limited legal scope, missing federal guidance, and unfunded administrative burdens as the major obstacles to implementation (Gillum et al., Politics and the Life Sciences, 2025). For AI-bio governance, the lesson is direct: oversight regimes fail when the people expected to operationalize them are brought in only after the policy is written.
Executive Order 14081 (September 12, 2022) framed a National Biotechnology and Biomanufacturing Initiative that pairs bioeconomy growth with concrete steps to reduce biological risks and to promote biosafety and biosecurity, and it directed work toward high-quality, accessible, and secure biological data sets that can support AI-enabled discovery (EO 14081, 2022). Historical EO. Distinct from EO 14110 (AI compute thresholds, later rescinded) and from EO 14292 (high-risk life sciences research policy already mapped on this page). For the related JHCHS bioeconomy biosafety workshop synthesis, see Synthetic Biology.
The 2024 OSTP Framework for DNA Synthesis Screening
The 2024 OSTP Framework for Nucleic Acid Synthesis Screening established procurement conditions for recipients of U.S. government life-sciences research funding. It remains an important policy baseline, but its current status must be read together with Executive Order 14292.
What it covers:
- Expectations for federally funded synthesis providers
- Baseline screening standards
- Customer verification requirements
- Guidance on best practices
What it misses or leaves unresolved:
- Coverage outside federal funding conditions
- International providers not reached by U.S. funding terms
- Novel AI-designed sequences that evade pattern-matching
- Function-based screening not required
The framework moved beyond purely voluntary guidance by tying procurement to federal funding. However, ASPR now states that federal departments and agencies will revise or replace it and will update the page when a new framework is available. As of August 3, 2026, that page does not identify a replacement. This status does not erase the 2024 framework’s technical contribution, but it prevents treating its original implementation schedule as a settled current mandate.
Executive Order 14292 (May 2025) directed OSTP to revise or replace the 2024 framework and incorporate enforcement terms into federal life-sciences funding agreements. The order also directed a strategy for non-federally funded research. The July 2025 AI Action Plan recommended requiring federal funding recipients to use synthesis providers with screening and customer-verification controls. These directives establish policy intent, but they are not substitutes for the replacement framework or implementing rules. The executive order’s deadlines should therefore be treated as historical instructions, not as evidence that a successor framework is currently in force.
The AI Action Plan also recommends developing a mechanism to facilitate data sharing between nucleic acid synthesis providers to screen for potentially fraudulent or malicious customers.
On January 29, 2026, Senators Cotton and Klobuchar introduced the bipartisan Biosecurity Modernization and Innovation Act of 2026 (S. 3741) (Cotton and Klobuchar; GovInfo). The introduced bill would require the Secretary of Commerce to promulgate regulations to improve nucleic-acid synthesis security, establish a biotechnology governance sandbox at NIST, and assess current federal biosecurity authorities. The sponsor’s press release lists support from several research and industry organizations; that support is not evidence that the bill has been enacted. See DNA Synthesis Screening for current status.
A September 2026 Congressional Research Service brief maps the same tension for Congress: AI paired with biological design tools can propose nucleic-acid sequences that still need physical synthesis and wet validation, while raising the chance that sequences of concern slip past today’s screening tools, and it places industry self-governance (IGSC protocols, lab-side frameworks) beside open calls for mandatory nucleic-acid order screening and bills in the 119th Congress that would harden standards and authorities (CRS, 2026). Staff briefing: not new empirical misuse rates; pair with primary eval/TI evidence already on the amplifier pages.
NSCEB Commissioners also introduced the America’s Living Library Act of 2026 (Young, Padilla, Bice, Khanna; March 5, 2026), bipartisan bicameral legislation directing the Department of the Interior to collect and sequence genomic information from U.S. National Parks, creating standardized AI-ready biological datasets as a public resource for biotech innovation in medicine, agriculture, and industrial production.
Mid-September 2026 bio-data bills and FRONTIER independent evaluators
In mid-September 2026, OpenAI publicly endorsed three NSCEB-lineage bills aimed at AI-ready biological data infrastructure: the Web of Biological Data Act, the AI-Ready Bio-Data Standards Act, and the SCALE Biology Act (Reuters, 2026; bill walkthrough Turner, 2026). In NSCEB-lineage framing, the Web bill points DOE toward a single entry point for scattered federal bio datasets with tiered cybersecurity; the AI-Ready bill directs NIST to define what “AI-ready” means for biological datasets; SCALE would stand up NIST biometrology capacity that includes biorisk, biosafety, and biosecurity measurement language (Turner, 2026).
The same window, the company said it backs a FRONTIER Act provision for independent verification organizations (IVOs) / outside safety assessors at leading AI labs, not a claim that every FRONTIER title is company policy (Politico, 2026; Reuters, 2026). That IVO posture sits beside Amodei’s embedded-evaluator argument already on this page and beside CRS IF13269’s map of proposed AI×biosecurity authorities.
Endorsement is not enactment. Like the authorities mapped in CRS IF13269, the three data bills and the FRONTIER IVO provision are proposals and industry positions. They are framed as complements to synthesis screening, not as a new mandatory nucleic-acid order screening statute. Improving AI-ready bio-data can raise beneficial capability and dual-use surface at the same time, so the three bills should not be presented as pure risk reduction.
Separately, on 7 October 2026 Biohub and federal partners announced a $1.8 billion Virtual Biology Initiative expansion for AI-ready open biological data with DOE, NIH, Google DeepMind, Isomorphic Labs, and Meta (Biohub / PR Newswire, 2026; Hu / Reuters, 2026). That program sits beside, not instead of, the NSCEB-lineage AI-ready bio-data bills above: large open bio-data investment can raise beneficial capability and dual-use surface at the same time.
Those mid-September 2026 bills lineage from the NSCEB Final Report itself. In §4.1 the Commission treats biological data as a strategic resource and asks Congress to (1) authorize the Department of Energy to create a Web of Biological Data as a single entry point with security and access controls, (2) authorize NIST to define AI-ready biological-data standards, (3) fund a Department of the Interior Sequencing Public Lands Initiative, and (4) authorize NSF to stand up a network of cloud labs (NSCEB Final Report §4.1; chapter map NSCEB chapters hub). America’s Living Library Act (DOI parks sequencing), already cited above, sits next to the §4.1c public-lands ask. Final Report recommendations and introduced bills, not enacted statute. Do not treat §4.1 as a substitute for the §4.4 / 4.4a harm-protection teaching that follows.
Hazel et al. (npj Digital Public Health, 2026) mapped AI use and AI-specific public policies across 90 national genomics initiatives in 70 countries. Current or planned AI use appeared in 32 of 90 initiatives (36%), but publicly available AI-specific governance documents were found in only three initiatives in two countries: All of Us, Genomics England, and UK Biobank. Where those policies existed, three controls recurred: mandatory secure computation environments, treatment of trained models as potentially disclosive outputs, and restrictions on feeding participant-level data to external generative AI services. Internet-search review of public materials (March 2024–February 2026), not an audit of private DUAs or unpublished program rules. Sibling to pathogen-detection network teaching (for example ASM D2P), not a substitute for it.
NSCEB Final Report §4.4 and adjacent institutional-design proposals
The National Security Commission on Emerging Biotechnology Final Report (§4.4) flags that AI-powered protein design and related capabilities can outpace list-based gene synthesis controls that still mainly bind federally funded research (NSCEB Final Report, 2025; July 2026 PDF). In §4.4a the Commission asks Congress to direct a Commerce-housed entity to (1) identify emerging biotechnology risks and oversight gaps, (2) fund biosecurity and biosafety tool development including machine learning to score novel sequences or organisms, (3) develop and incentivize best practices, (4) consolidate and oversee biosecurity, biosafety, and responsibility policies (including modernizing FSAP and enforcing gene synthesis screening), and (5) work with the international community (NSCEB §4.4a, 2025). Recommendation only. Not enacted statute, and not a substitute for the handbook’s DNA synthesis screening chapter. See DNA Synthesis Screening.
A January 2025 Scowcroft Institute report argues for an independent federal bioresponsibility authority, separate from research funders and reporting to the President, to unify fragmented U.S. biorisk rules and to set mandatory nucleic-acid synthesis screening requirements. Finding 3 warns that AI and outsourced synthesis can expand who can attempt risky work and may help adversaries evade nucleic-acid order screening (Scowcroft Institute, 2025). Proposal only. Adjacent to, not the same as, NSCEB Final Report §4.4a’s Commerce-housed entity sketch.
Career and institutional orientation for the same fragmented U.S. biosecurity enterprise sits outside this chapter’s AI-bio instrument map. Emerging Technology Policy Careers’ biosecurity hub (federal agency profiles, executive biosecurity career guide, fellowships, think-tank directory, and Congress committee pointer; updated 2 Sep 2026) is the named outbound for who-works-where questions (ETP biosecurity policy; executive branch biosecurity policy). Keep B-SPAN Executive and Legislative as the Commission atlases for entity and committee jurisdiction claims, and the CSR Nolan Biodefense Budget Breakdown for requested/enacted/actual dollars on future-biosecurity; do not restate those atlases or toplines here. Discovery and career index, not primary law and not an AI×biosecurity evaluation.
U.S. biodefense is an enterprise, not a single office. The Bipartisan Commission on Biodefense B-SPAN Executive Branch map catalogs mission, duties, programs, leadership, and reporting lines for more than 500 federal entities across 15 departments, 9 independent agencies, and 1 independent institution (B-SPAN Executive Branch; Commission launch, 10 Jul 2024). The Commission frames the atlas as a complement to its 2024 National Blueprint for Biodefense reform agenda: use B-SPAN to find who holds equities; use the Blueprint (separate primary) for what to change. Interactive directory and Commission advocacy map, not statute, not a budget, and not proof that any listed office presently owns AI×biosecurity evaluations.
In May 2024 the Bipartisan Commission on Biodefense published its National Blueprint for Biodefense, the Commission’s fourteenth report and an update of its 2015 reform agenda, with 36 recommendations and 185 action items across leadership, intelligence and attribution, science and technology, preparedness, detection and surveillance, and response, recovery, and mitigation (National Blueprint for Biodefense, 2024; PDF). Use the Blueprint for what the Commission wants changed; keep B-SPAN Executive and Legislative as the sibling atlases for who holds federal and committee equities, and do not restate those atlas counts here. After its 4 Jun 2026 public meeting “Pandora’s Prompt: AI and the Biological Threat,” the Commission also established artificial intelligence as the sixteenth technology priority in The Apollo Program for Biodefense and called for investment in AI-enabled disease surveillance and diagnostics, medical countermeasure development, microbial forensics and attribution, model evaluation and safeguards, and adaptive nucleic-acid synthesis screening (Apollo Program update). Commission advocacy agenda and technology-priority update, not statute, and not a substitute for NSCEB, DURC, DNA-screening, or B-SPAN atlas teaching already on or queued for this page.
House Science hearing, 16 September 2026
On 16 September 2026, the House Science Investigations and Oversight Subcommittee held a hearing on balancing biotechnology innovation and biosecurity (hearing page). Three outside witnesses submitted written testimony that the handbook should keep as a single triad rather than three disconnected slogans: screening, computational-design oversight gaps, and capacity.
Anemone Franz (AEI) urged three concrete actions: universal gene-synthesis screening (pointing to legislation such as the Biosecurity Modernization and Innovation Act); stable multiyear funding for pathogen-agnostic biosurveillance; and closing gaps in the July 2026 high-risk life sciences policy so oversight reaches computational design of biological agents and is not limited to institutions that receive federal funding (Franz testimony PDF; hearing page). Joshua Hodges (Hoover) framed the risk shift from general-purpose chatbots toward biology-specialized models and argued for verifiable synthetic-DNA order screening as a cheap universal “odorant”-style safeguard that lets the technology scale while making misuse harder to hide (Hodges testimony PDF). Gigi Gronvall (JHSPH) argued that gene-synthesis screening and AI biosecurity evaluations are necessary but insufficient without scientific talent, research capacity, manufacturing infrastructure, and international scientific relationships that detect threats and build countermeasures (Gronvall testimony PDF).
Hearing testimony is advocacy on the congressional record: it does not show enactment or measured misuse prevalence and does not replace primary evaluation or threat-intelligence evidence. Statements in the testimony about competition with China and about Evo 2 are the witnesses’ arguments and are not assessed here. Gronvall discloses Anthropic advisory compensation and states that no company reviewed the testimony.
One hearing does not map the Hill. The Commission’s B-SPAN Legislative Branch atlas catalogs more than 150 House and Senate committees and subcommittees with biodefense equities and lists Commission-proposed hearings tied to its 2024 Blueprint recommendations (B-SPAN Legislative Branch; Commission launch, 10 Jul 2024). Proposed hearings are a reform wish-list, not a record of hearings already held; when a specific hearing teaches (as with the House Science Investigations and Oversight Subcommittee session already cited above), keep citing that hearing’s primary page and witness testimony rather than the atlas alone. Committee jurisdiction directory and Commission advocacy catalog, not enacted oversight outcomes.
PREVENT Pandemics Act (2022)
The PREVENT Pandemics Act (Prepare for and Respond to Existing Viruses, Emerging New Threats, and Pandemics Act), enacted December 29, 2022 as P.L. 117-328, represents the first comprehensive post-COVID statutory reform of U.S. pandemic preparedness and biosecurity governance.
Key biosecurity provisions (Title III, Subtitle B):
| Section | Requirement |
|---|---|
| Sec. 311 | Improved oversight of select biological agents and toxins |
| Sec. 312 | Federal strategy for high-containment laboratories |
| Sec. 313 | Strengthened NSABB authority and reporting requirements |
| Sec. 314 | Research program to improve biosafety practices |
| Sec. 315 | Enhanced oversight of federally funded ePPP research |
What it covers:
- Mandates a coordinated federal strategy for BSL-3 and BSL-4 facilities, addressing geographic distribution and oversight gaps
- Strengthens NSABB’s statutory role in reviewing high-consequence research
- Establishes the White House Office of Pandemic Preparedness and Response Policy for federal coordination
- Modernizes biosurveillance capabilities and genomic sequencing infrastructure (Sec. 211–212)
- Creates epidemic forecasting and outbreak analytics programs (Sec. 214)
What it misses:
- No provisions specifically addressing AI-enabled biological design
- No compute governance or model access requirements
- Focused on traditional laboratory research, not computational biology outputs
- Does not address DNA synthesis screening or function-based hazard assessment
The PREVENT Pandemics Act strengthens existing governance mechanisms but predates the rapid advancement of biological AI tools. Its provisions for NSABB and ePPP oversight remain relevant, but the Act does not contemplate scenarios where AI systems, rather than human researchers, generate designs of concern.
UK Pandemic Preparedness Strategy (2026)
In March 2026, the UK Department of Health and Social Care published Pandemic Preparedness Strategy: building our capabilities, replacing the UK’s older influenza-focused planning with an explicitly all-hazards framework. The strategy states that future pandemics may spread through respiratory, oral, blood-borne, sexual, contact, or vector-borne routes, adopts a One Health lens, and explicitly notes that advances in technology and geopolitical challenges increase the risk of pandemics with unnatural origin. Accompanying government materials describe around £1 billion in health protection investment, expanded surveillance and testing capabilities, and plans for an “All Pandemic Hazards Bill” to preserve ready-to-use legislative options across pathogen types.
What it covers:
- Whole-of-government and whole-of-society pandemic preparedness
- Multiple transmission routes, not only respiratory spread
- One Health integration and explicit unnatural-origin risk recognition
- Surveillance, testing, stockpiles, vaccines, therapeutics, and legislative readiness
What it misses:
- No explicit governance for AI model access or AI-enabled biological misuse
- No DNA synthesis screening or compute governance mechanisms
- No detailed provisions for verification or enforceable international controls
The strategy matters because it pulls unnatural-origin scenarios into mainstream pandemic preparedness planning rather than treating them only as a niche national security issue. But broad preparedness planning is not the same as enforceable biosecurity control.
DoD Biodefense Posture Review (2023)
In August 2023 the Department of Defense published its inaugural Biodefense Posture Review, aligning DoD biodefense with the 2022 National Defense Strategy and the October 2022 National Biodefense Strategy and Implementation Plan while incorporating COVID-19 lessons for the biothreat landscape through 2035 (DoD Biodefense Posture Review, 2023). The review’s top priorities include assessing that landscape through 2035; clarifying biodefense missions, roles, authorities, and capabilities; aligning policies, research-development-acquisition, investments, and force structure; and putting biodefense into training, exercises, and doctrine. Reforms organize around four lines of effort (early warning and understanding; Total Force preparedness; speed of response; coordination and collaboration), and DoD institutionalized a Biodefense Council chaired by the Under Secretary of Defense for Acquisition and Sustainment to synchronize enterprise biodefense below the Deputy Secretary. Defense posture review for the Total Force. Not an AI pathogen-design study, and not a substitute for civilian DURC, DNA screening, or NSCEB §4.4 teaching already on this page.
ASM Detection to Protection Initiative (2026)
In September 2026 the American Society for Microbiology launched the Detection to Protection (D2P) Initiative, chaired by Dan Jernigan, as a scientific and public health community effort to draft policy recommendations that strengthen U.S. infectious and zoonotic disease detection, surveillance, and response (ASM press release, 28 Sep 2026; D2P initiative). Planned outputs through spring 2027 include an end-to-end framework from threat detection and characterization through evidence-based decisions to public protection, a pathway that clarifies response roles and accountability, and recommendations on governance, infrastructure, workforce, and data systems. Society-led roadmap in progress for Congress and federal agencies, not enacted statute and not AI model-access, DNA screening, or compute-governance controls.
Infectious-Disease Dataset Controls and Biosecurity Data Levels (BDL)
A central question for AI training data is whether pathogen and infectious-disease datasets should be open, tiered, or restricted, and who decides. One current answer is the proposed Biosecurity Data Levels (BDL) framework (Bloomfield et al., 2026): five risk tiers (BDL-0 through BDL-4) that escalate access requirements before high-consequence pathogen data enter model training. It is a proposal, endorsed by a large researcher coalition at Asilomar, not a WHO regulation and not U.S. binding law. Treat primary papers and agency text as authoritative; this page is a map.
An early federal signal is FY2026 NDAA Section 245, which directs DoD attention to tiered cybersecurity for biological data used in AI. Empirical support often cited for upstream data governance includes capability degradation when viral training data are excluded from models such as ESM3 and Evo 2, which is evidence about training-data effects, not a recipe for misuse. For tier detail, see Training Data Governance: The Biosecurity Data Levels Proposal. On this page, see Training Data Governance. For synthesis chokepoints, see DNA Synthesis Screening.
Proposed Policy Interventions
The biosecurity and AI policy communities have proposed numerous interventions. The most prominent span compute governance, DNA synthesis screening, model access tiers, and structured red-teaming.
Compute Governance
The concept: Large AI training runs require substantial computational resources. Monitoring and potentially regulating access to large-scale compute could provide visibility into who is training powerful models.
Proposed mechanisms:
- Reporting requirements for compute usage above thresholds
- Know-your-customer standards for cloud compute providers
- Export controls on advanced AI chips
Assessment:
- Strengths: Addresses model development rather than just deployment; difficult to evade at scale
- Weaknesses: Biological design may not require frontier-scale compute; dual-use with legitimate applications; could push development to less transparent jurisdictions
Current implementations:
| Jurisdiction | Threshold | Requirements | Status |
|---|---|---|---|
| US (EO 14110) | 10^26 FLOPs | Reporting, safety testing for CBRN | Rescinded January 2025; replaced by EO 14179 |
| EU AI Act | 10^25 FLOPs | Systemic risk assessment, model evaluation | Entered into force 1 August 2024; fully applicable 2 August 2026 (phased obligations) |
| California SB 53 | 10^26 FLOPs | Safety framework, incident reporting | Enacted 2025; subject to federal preemption challenge per December 2025 EO |
In mid-September 2026, an independent expert strategy memo, A Transformative AI Strategy for Europe, called for the Commission to implement the Action Plan on Cybersecurity and Artificial Intelligence and to publish corresponding Action Plans on CBRN-security and AI and on loss of control, alongside Member State pressure to strengthen biosecurity provisions in the EU Biotech Act (faster KYC / product-list updates for novel sequences; safe harbours for trusted third parties to stress-test synthesis screening) and pathogen-agnostic resilience ideas such as expanded wastewater and metagenomic monitoring (transformative-ai.eu; Part B; PDF). Independent strategy memo and recommendations, not EU legislation and not proof of Commission adoption.
The release of OpenAI’s o1 model in 2024 highlighted a significant limitation of compute thresholds. Unlike previous frontier models, o1’s capabilities derive substantially from “inference compute” (computational resources used when the model responds to queries) rather than training compute alone.
This means models trained with relatively modest compute can achieve frontier-level performance on some tasks. Compute governance remains useful as a first filter, but must be combined with capability evaluations.
The 2025 NASEM report noted that current biological design tools do not require frontier-scale compute. This limits the applicability of compute governance specifically for AI-bio risks, though it may be valuable for broader AI safety.
Jensen Huang’s March 2026 NVIDIA blog post presents a five-layer industrial stack for AI (energy → chips → infrastructure → models → applications) (Huang, NVIDIA Blog, March 2026). That is a vendor industrial map from a company that sells the chips, not a definition of AI and not a history of the field. The FLOP reporting, cloud KYC, and chip-export controls on this page sit on the chip and cloud-infrastructure layers. They do not govern energy. They do not bind copy or run on a local box. The NASEM finding that current biological design tools do not require frontier-scale compute is why that layer placement matters for this chapter.
Current mechanisms on this page (FLOP reporting, cloud KYC, chip export) target who can train at scale. They do not by themselves bind copy, run, or boot on the hardware that hosts weights, including on-prem and local boxes. In industry usage, a neocloud is a GPU-as-a-Service provider (for example CoreWeave, Lambda, or Crusoe) that rents accelerator clusters rather than the general-purpose catalog of a hyperscaler such as AWS, Azure, or Google Cloud (DriveNets; Nutanix, August 2026). On 1 September 2026, Ilya Sutskever argued that neoclouds have limited cybersecurity and that, the next time agents escape, they may try to take over a neocloud to run more copies (Sutskever, 2026). That is a public cyber and copy-off claim, not a training-run notification and not a demonstrated biological incident. NIST AI 800-1 already lists managing model-theft risk as an objective. The unresolved governance question is whether copy and run controls must bind the scarce hardware itself, including local boxes, rather than only a neocloud or hyperscale rack. Hardware-bound copy and run controls are not established as deployed or sufficient for AI-bio risk, and this chapter does not specify intrusion methods.
Enhanced DNA Synthesis Screening
The concept: Extend and strengthen DNA synthesis screening to address AI-designed sequences that evade traditional pattern-matching.
Proposed mechanisms:
- Function-based screening (not just sequence matching)
- Universal coverage including international providers
- Mandatory rather than voluntary standards
- Coverage of benchtop synthesis equipment
Assessment:
- Strengths: Targets a genuine chokepoint; builds on existing industry practice
- Weaknesses: International coordination required; benchtop devices harder to control; ongoing arms race between design and screening
SecureDNA and similar initiatives represent promising approaches to function-based screening. The International Biosecurity and Biosafety Initiative for Science (IBBIS) developed the Common Mechanism - a free, open-source, globally available tool for DNA sequence screening. The policy challenge is achieving universal adoption across providers globally.
The “Open Weights” Debate
The central tension: When a company trains a powerful AI model, it has two fundamental choices:
- Closed API: The model stays on their servers. Users send queries, receive answers, and can be monitored or blocked for concerning requests.
- Open Weights: The model’s “brain” (weights) is published online. Anyone can download it and run it locally.
The biosecurity concern: Once a model is open weights, safety guardrails can be stripped out. Jailbreaking and weight-level untraining are distinct. A jailbreak is a prompt-side bypass and does not require downloaded weights. Subversive LoRA untraining trains an adapter on released weights so refusals collapse while general capability is retained.
An ICLR 2024 workshop paper reported that result for Llama 2-Chat 70B: one GPU, less than $200, refusal of about 1% on two refusal benchmarks, and MMLU and HellaSwag scores comparable to the unmodified chat model (Lermen, Rogers-Smith, and Ladish, 2024, preprint). The finding is from the Llama 2 era. Refusal collapse is not biological-design-tool capability or pathogen-related uplift. The authors withheld the adapted weights and exact methods. Weight release remains irreversible: the original developer cannot recall public weights.
The counter-argument: Open science drives innovation. Restricting access means only large tech companies and governments can use the best tools.
Model Access Tiers
The concept: Implement differential access to AI models based on capability level and user verification.
Proposed mechanisms:
- Open access for lower-capability models
- API-only access for more capable models (with monitoring)
- Restricted access for frontier capabilities
Assessment:
- Strengths: Allows broad access while controlling high-risk capabilities; aligns with industry practice
- Weaknesses: Open-source models exist outside this framework; capability thresholds difficult to define; may not prevent advanced actors
Major AI companies have already implemented tiered access. The policy question is whether voluntary measures are sufficient, and how to address the open-source ecosystem.
A 2026 peer-reviewed Perspective proposes a “Know Your Scientist” framework for hosted biological-design tools: research institutions would vouch for affiliated users, while model hosts would screen outputs and monitor activity over time (Feldman et al., 2026). The proposal is an unevaluated governance architecture, not evidence of effectiveness. Open-weight or locally run models bypass it. Institutional-vetting criteria, monitoring thresholds, privacy safeguards, review and appeal procedures, insider risk, and cross-provider information sharing remain untested or unspecified.
Training Data Governance
A summary of pathogen-dataset controls appears in Infectious-Disease Dataset Controls and Biosecurity Data Levels (BDL).
The concept: Apply risk-tiered access controls to pathogen datasets before they are used for AI training, governing capability formation upstream of model release.
Proposed mechanism: The Biosecurity Data Level (BDL) framework classifies pathogen data into five tiers (BDL-0 through BDL-4) based on expected contribution to capabilities of concern, with escalating access requirements from open access to government pre-publication review (Bloomfield et al., 2026). Endorsed by 100+ researchers at the 50th Asilomar Conference. Only newly generated data would be restricted; existing datasets remain untouched.
Policy signal: The FY2026 NDAA Section 245 directs DoD to develop requirements for biological data collection and storage for AI use, including tiered cybersecurity safeguards, representing early federal attention to this governance layer.
Assessment:
- Strengths: Targets capability formation before model release; complements model-level tiers (above) and synthesis screening; creates shared vocabulary for risk classification; empirical support from ESM3 and Evo 2 data exclusion experiments showing capability degradation without viral training data
- Weaknesses: No expert panel exists to classify data by risk level; international harmonization unresolved; fine-tuning can partially recover excluded capabilities, meaning data controls are necessary but not sufficient; over-restriction risks hampering legitimate science
For detailed framework description including all five BDL tiers, see Training Data Governance: The Biosecurity Data Levels Proposal.
Pre-Training Safety Evaluation
The concept: Require safety evaluation of AI models before training or deployment, specifically including biosecurity assessments.
Proposed mechanisms:
- Red-teaming requirements for biological capabilities
- Structured access for external evaluators
- Defined capability thresholds that trigger additional scrutiny
- Standardized scoring methods that combine biological function risk with actor capability
A 2026 RAND report proposes a dual-component scoring tool that rates misuse risk across five viral capability-modification functions (host range/tropism, genome replication, immune or medical countermeasure evasion, environmental stability, and transmission dynamics) and pairs those scores with actor capability assessments (Williams et al., 2026). This approach can support pre-training redlines and funding or oversight decisions before a tool is built.
Assessment:
- Strengths: Catches issues before deployment; creates accountability; provides an operational method for pre-development triage
- Weaknesses: Evaluation methodology still maturing; may not catch all risks; adversarial actors can evade; operational thresholds require calibration and expert consensus
Red-Teaming AI Systems for Biosecurity Risks addresses methodology. The policy question is whether to mandate such evaluations and how to structure oversight.
NIST AI 800-1: Managing Misuse Risk for Foundation Models
The concept: A U.S. government framework establishing practices for foundation model developers to identify, measure, and mitigate misuse risks across the AI lifecycle.
NIST AI 800-1 (U.S. AI Safety Institute, January 2025) provides the primary U.S. government guidance for managing misuse risks from dual-use foundation models, consistent with Executive Order 14110. The framework establishes seven objectives:
- Anticipate potential misuse risk: Identify threat profiles covering significant misuse scenarios
- Establish plans for managing misuse risk: Define acceptable risk thresholds and roadmaps
- Manage the risks of model theft: Prevent theft of information enabling model recreation
- Measure misuse risk: Evaluate capabilities using red teams and structured evaluations
- Ensure risks are managed before deployment: Implement safeguards proportionate to risk
- Collect and respond to information after deployment: Monitor distribution channels and respond to incidents
- Provide appropriate transparency: Publish transparency reports and disclose practices
Appendix D: Chemical and Biological Misuse Risk
The Second Public Draft includes a dedicated appendix applying the framework to biological threats. Johns Hopkins Center for Health Security praised this addition but noted the document remains anchored on LLM risks rather than foundation biological AI models (BAIMs), recommending expansion to address specialized biological design tools.
Assessment:
- Strengths: Official U.S. government framework; comprehensive lifecycle coverage; specific documentation requirements for transparency; biosecurity-specific appendix
- Weaknesses: Voluntary (no enforcement mechanism); focused on LLMs rather than biological foundation models; international applicability limited
NIST AI 800-1 complements industry frameworks (ASL, Preparedness Framework) by establishing government expectations and standardizing documentation practices across the field.
NIST maintains a public hub that maps the congressional mandates and executive actions authorizing its AI work, including the Chips and Science Act of 2022, the National Artificial Intelligence Initiative Act of 2020, and the July 2025 America’s AI Action Plan (NIST, AI congressional mandates and EOs). On that page NIST states it is named across many Action Plan recommendations, among them building an AI evaluations ecosystem and investing in biosecurity. Hub orientation and Action Plan recommendations, not new binding statute and not a substitute for NIST AI 800-1 or the synthesis-screening Action Plan lines already on this page.
Global Risk Index for AI-Enabled Biological Tools
The concept: A structured framework for systematically assessing AI-enabled biological tools based on capabilities, misuse potential, accessibility, and technological maturity.
The Global Risk Index for AI-enabled Biological Tools (Webster et al., 2025) provides the first detailed rubric for evaluating these tools before development, deployment, and release. The CLTR-RAND assessment indexed over 1,100 biological tools, with 57 advanced tools receiving detailed evaluation. 13 tools were flagged as “Red” requiring immediate action, and notably, 61.5% of Red-flagged tools are fully open-sourced with publicly available code, weights, and training data. This addresses a gap where individual companies assessed risks using incompatible internal frameworks.
The framework assesses four dimensions:
- Capability: What can the tool do? Does it design sequences, predict structures, troubleshoot protocols?
- Misuse potential: How readily could capabilities be applied to harmful purposes?
- Accessibility: Is it open-source, API-access, or restricted? What verification is required?
- Technological maturity: Prototype, production-ready, or widely deployed?
Key recommendations from the Index:
- Pre-development assessment: Developers and funders should use the rubrics to assess tools for misuse-relevant capabilities before funding and development, not just before release
- Managed access via KYC: Implement Know Your Customer principles for tools with significant misuse-relevant capabilities, differentially prioritizing defensive applications like medical countermeasures (Carter and Butchello, 2026)
- Safeguards by design: Funders should enable developers to embed technical safeguards into tools from the start, with non-safeguarded versions available only to legitimate defensive researchers under secure conditions
- Responsible innovation culture: Regular convenings between developers, funders, and government experts to coordinate assessments and share best practices
- Ongoing monitoring: Government and independent experts should refresh the Index every six months to avoid strategic surprises
Assessment:
- Strengths: Provides standardized rubric across the field; addresses pre-development stage often missed by deployment-focused policies; emphasizes defense prioritization
- Weaknesses: Voluntary adoption; international coordination required; rubric scoring may be subjective without calibration
The Global Risk Index complements existing frameworks (ASL, Preparedness Framework) by focusing specifically on biological AI tools rather than general-purpose AI, and by targeting the pre-development phase where decisions about whether to build have the greatest impact. For operational scoring detail at the individual-tool level, see Pre-Training Safety Evaluation, which includes the RAND 2026 dual-component method pairing biological function risk with actor capability.
Responsible Scaling Policies
The concept: AI companies commit to pausing or restricting deployment if models exceed defined capability thresholds, including those relevant to CBRN risk.
Examples:
- Anthropic’s Responsible Scaling Policy (revised February 2026; see case study below)
- OpenAI’s Preparedness Framework
Assessment:
- Strengths: Industry leadership; creates internal governance structures; when enforced, ties deployment decisions to independent capability evaluation
- Weaknesses: Voluntary; may not bind all actors; thresholds not standardized; vulnerable to commercial pressure
In February 2026, Anthropic released RSP Version 3.0, removing the core commitment that had prohibited deployment of models for which the company could not guarantee adequate risk mitigations. Previously, the RSP required Anthropic to pause or restrict deployment if a model’s capabilities exceeded what its safety measures could reliably contain, including for CBRN uplift risk (Heiligenstein, TIME, February 2026).
The revised policy replaces the categorical pause commitment with a conditional promise to “delay” development only if Anthropic considers itself the industry leader and judges catastrophic risk to be significant. Anthropic cited competitive pressure and the absence of binding federal regulation as motivations (CNN, February 2026).
Biosecurity implications:
This case illustrates a structural vulnerability in voluntary self-governance frameworks:
Base capability vs. deployed behavior: The original RSP was built around the distinction between what a model can do versus what it will do under current safety training. Capabilities persist through fine-tuning and adversarial prompting even when safety training changes disposition. Removing the binding deployment pause eliminates the primary mechanism for containing that gap.
Commercial pressure as governance stress test: The rollback provides a concrete data point on the limits of voluntary commitments when they conflict with major commercial interests.
Industry precedent: OpenAI removed its explicit ban on military and warfare applications from its usage policies in January 2024 (Biddle, The Intercept, January 2024). The Anthropic rollback continues a pattern of erosion under competitive pressure.
Governance gap exposure: No binding international framework requires pre-deployment biosecurity evaluation or imposes consequences for deploying models with identified CBRN uplift risk. The RSP had partially filled this gap voluntarily. Its rollback leaves the gap fully exposed.
The case shows that, whatever any single company’s conduct, voluntary commitments are insufficient as a primary governance mechanism for catastrophic-risk technologies. Binding frameworks with independent verification are the necessary endpoint. See International Bodies for current proposals.
Amodei’s 2026 pacing essay also argues for embedded third-party evaluators inside frontier labs and treats a ban on AI for biological weapons as the realistic Level 1 floor for harder global deals (Amodei, 2026). Essay and Anthropic ask: not enacted law.
In late September 2026, President Trump and the chief executives of Google, Anthropic, Meta, OpenAI, xAI, and Nvidia signed the White House Accord on Super Intelligence, formally the Joint Commitment on Frontier Responsibilities. The one-page voluntary commitment asks each company training and deploying frontier models to keep four layers of controls: (1) internal monitoring of model capabilities and alignment during training and deployment for cybersecurity, biosecurity, and chemical threats, and to prevent unintended system access; (2) an internal team that verifies those controls and remediates failures; (3) an independent external auditor or evaluator; and (4) an independent board committee that receives reports and ensures remediation. Participating companies will meet regularly on standards. The signed text says these steps may later be codified into law or regulation; it sets no deadlines, names no auditors, and attaches no penalties. Cite the signed White House text (White House, 2026). Treat the Accord as a political and industry pledge, not measured safety performance and not a substitute for mandatory nucleic-acid screening instruments already mapped on this page.
What effective binding governance requires (building on the RSP model):
- Mandatory pre-deployment biosecurity evaluation conducted by independent third parties with relevant expertise
- Defined uplift thresholds with binding pause authority that cannot be waived for commercial reasons
- International coordination to prevent regulatory arbitrage (companies relocating to jurisdictions with weaker requirements)
- Transparency requirements so that when evaluations are conducted, results and methodology are disclosed to regulators
When assessing AI-bio governance proposals, ask:
1. Does it address the right intervention point?
- Is this targeting capability development, deployment, or use?
- Does it catch the actors of concern?
2. Is it enforceable?
- What is the compliance mechanism?
- Who monitors and enforces?
3. Does it scale internationally?
- Can it be adopted globally?
- Does it create regulatory arbitrage opportunities?
4. Does it preserve legitimate use?
- What is the burden on researchers and companies?
- Does it hinder beneficial applications?
5. Is it adaptive?
- Can it evolve as technology changes?
- Are there sunset provisions or review mechanisms?
Stakeholder Roles and Responsibilities
Effective governance requires coordinated action across multiple stakeholders.
National Governments
Key roles:
- Setting regulatory frameworks
- Funding biosecurity research
- International negotiations
- Enforcement and oversight
Current gaps:
- No clear lead agency for AI-bio convergence in most countries
- Biosecurity and AI policy often housed in different agencies
- Limited technical capacity for evaluation
AI Companies
Key roles:
- Implementing safety measures in model development
- Conducting pre-deployment biosecurity evaluation
- Responding to identified risks
- Sharing threat information
Current gaps:
- Company pledges, including the September 2026 White House Accord, vary in rigor and remain voluntary
- Open-source ecosystem operates outside company governance
- Competitive pressures may limit caution
- Built-in safeguards for generative biology tools remain immature. A 2025 Nature Biotechnology correspondence argues that watermarking, alignment, anti-jailbreak methods, and unlearning may complement governance, but require domain-specific research and testing before they can be treated as dependable biosecurity controls (Wang et al., 2025). The named primary that now exists is SynthIDBio (Stutz et al., Nature, 2026): function-preserving sequence and structure watermarks for AI-generated proteins, still framed by the authors as a proof-of-concept with erasure and open-weight limits rather than a mature safeguard.
Research Community
Key roles:
- Developing evaluation methodologies
- Identifying emerging risks
- Publishing responsibly on dual-use topics
- Informing policy with technical expertise
Current gaps:
- Academic incentives may not align with security
- Publication norms still evolving for AI-bio
- Limited funding for biosecurity-focused AI safety research
International Bodies
Key roles:
- Coordinating standards across jurisdictions
- Facilitating information sharing
- Providing technical assistance
- Monitoring compliance
Emerging mechanisms:
- International Network of AI Safety Institutes: Founded May 2024 (Seoul Summit); inaugural convening November 2024 in San Francisco. This network coordinates evaluation methodologies and shares information across national AI institutes. Note: Both the UK AI Safety Institute (renamed to AI Security Institute in February 2025) and US AI Safety Institute (renamed to Center for AI Standards and Innovation in June 2025) have been rebranded, though the international network continues.
- G7 Hiroshima AI Process: Launched February 2025, this voluntary mechanism invites organizations developing advanced AI to complete transparency questionnaires published on an OECD platform.
- OECD Synthetic Biology, AI and Automation Assessment: Published December 2025, this forward-looking technology assessment covers AI and automation convergence with synthetic biology, addressing data supply chains, human oversight requirements, and biosafety and biosecurity governance across OECD member states.
- NTI AIxBio Global Forum: Convenes experts to develop recommendations for safe AI-life sciences convergence. NTI publishes a biannual AIxBio Horizon Scan forecasting near-term capability trajectories. The Spring 2026 scan characterized the period as steady technical improvement with more consequential policy movement, including proposed mandatory synthesis screening, agentic coding tools applied to biology, cloud laboratory integration, and a widening divide between open and proprietary biological datasets.
- WHO Guidance on LMMs for Health (2025): Establishes six ethical principles for AI governance and a value chain framework assigning responsibilities to developers, providers, and deployers.
The WHO guidance on large multi-modal models (2025) establishes six consensus ethical principles applicable to AI governance:
- Protect autonomy: Humans remain in control of healthcare systems and medical decisions
- Promote human well-being, human safety, and the public interest
- Ensure transparency, explainability, and intelligibility
- Foster responsibility and accountability
- Ensure inclusiveness and equity
- Promote AI that is responsive and sustainable
The guidance frames governance across the AI value chain: developers who build foundation models, providers who integrate them into applications, and deployers who use them in practice. Each stage has distinct responsibilities and risks that governance must address separately.
While the WHO guidance focuses on healthcare applications broadly, these principles apply directly to AI-bio convergence governance, where accountability across the value chain is similarly fragmented.
Current gaps:
- BWC has no institutional capacity for AI issues
- No international body owns the AI-bio intersection
- Limited enforcement mechanisms
- Participation remains limited primarily to advanced industrial economies
- Anthropic reported a survey of 80,508 AI users across 159 countries in which governance concerns were one of several coded themes, with regional variation in responses (Anthropic, 2025). Because the sample and coding were company-generated, the findings should be treated as descriptive rather than representative estimates of global opinion.
AI-bio governance suffers from a classic coordination problem:
- No single stakeholder can solve it alone
- Each stakeholder faces different incentives
- First-movers may bear costs while free-riders benefit
- International coordination is particularly difficult
Coordination is still possible: DNA synthesis screening emerged through industry consortium action. Even so, governance will require sustained effort across multiple actors.
A 2026 review of international biosafety and biosecurity governance argues that biological capability is now widely distributed while vulnerability remains shared, and that fragmentation across health, security, and environmental institutions leaves no single forum equipped to govern cloud laboratories, AI-enabled design tools, and cross-border data flows coherently (Lentzos and Bowsher, Cold Spring Harbor Perspectives in Medicine, 2026).
The geopolitical reality: AI is viewed as a strategic military asset. Nations are hesitant to slow their own development for safety if they think rivals are racing ahead. However, no nation wants a biological accident: a pandemic released in one country can spread to its rivals. This shared vulnerability is the principal basis for global cooperation.
A Layered Defense Framework
Given the limitations of any single intervention, effective governance requires layered defense: multiple overlapping controls that together reduce risk even when individual controls fail.
A January 2026 synthesis in Biotechnology and Bioengineering proposed organizing safeguards around the full chain of AI-enabled biothreat creation, from upstream model development and access controls to downstream synthesis screening and response infrastructure (Dettman et al., 2026). The practical takeaway is not a new silver bullet; rather, mitigation becomes more credible when mapped to specific failure points in the pathway from digital capability to physical harm.
A RAND research report published 18 August 2026 stress-tested proposed controls against six actor profiles and five pre-release milestones and selected nine mutually reinforcing mitigations in four classes: manage access to dangerous and dual-use information (tamper-resistant open-weight safeguards, protection of sensitive biological data, and access-control platforms for dual-use AI systems); disrupt materials access (biological precursor screening); deter (pathogen early warning, bioattribution, and demonstrated rapid response); and detect misuse signals (real-time closed-weight monitoring and a centralized AI-bio information-sharing nexus) (Guerra et al., 2026). The authors’ qualitative feasibility table, based on team judgment rather than a field test, rates only precursor screening as an established approach with remaining implementation gaps; two mitigations are nascent, three are technically feasible but early, and three are institutionally complex (Guerra et al., 2026). Resource-constrained actors might be thwarted at access chokepoints; near-peer state actors might not, which is why the report treats deterrence and aggregate-signal detection as complements rather than optional add-ons.
Layer 1: Capability Restrictions
Goal: Limit who can develop or access dangerous capabilities
Mechanisms:
- Compute governance for training
- Model access tiers for deployment
- Responsible scaling commitments
Layer 2: Use-Time Controls
Goal: Detect and prevent misuse during model use
Mechanisms:
- Content filtering for harmful requests
- Monitoring for concerning patterns
- Rate limiting and anomaly detection
Layer 3: Materials Chokepoints
Goal: Prevent translation of AI outputs into physical threats
Mechanisms:
- DNA synthesis screening
- Cloud lab verification and protocol review
- Equipment access controls
Layer 4: Detection and Response
Goal: Detect misuse when prevention fails and respond effectively
Mechanisms:
- Enhanced biosurveillance
- Attribution capabilities
- Countermeasure development
- Incident response frameworks
Each layer has weaknesses:
- Capability restrictions can be evaded by determined actors
- Use-time controls can often be bypassed
- Materials chokepoints have coverage gaps
- Detection and response come after harm begins
But together, these layers create multiple barriers. An actor would need to evade all four layers to translate AI capabilities into catastrophic harm. This defense-in-depth approach is more robust than relying on any single control.
Liability for AI-Enabled Biological Harm
When AI systems contribute to biological harm, who bears responsibility? The WHO guidance on LMMs (2025) identifies liability as a critical governance gap: “errors, misuse and ultimately harm to individuals are inevitable,” yet existing liability frameworks were not designed for AI systems with multiple actors across a value chain.
The Liability Problem in AI-Bio Convergence
Consider three scenarios:
An LLM provides synthesis instructions that an attacker uses to produce a biological agent. Is the model developer liable? The company that deployed it? The cloud provider hosting it?
DNA synthesis screening fails because an AI-designed sequence evaded pattern-matching. Who is responsible: the AI tool that generated the evasive design, the screening provider, or the synthesis company?
A cloud lab executes a dangerous protocol submitted through an AI agent. Liability could fall on the AI developer, the protocol’s human requester, or the cloud lab operator.
In each case, responsibility is distributed across the AI value chain, making attribution difficult and creating gaps where no party is clearly accountable.
Potential Liability Frameworks
WHO proposes three approaches that could apply to AI-bio governance:
1. Presumption of causality. Reduce the burden of proof for those harmed. If harm follows AI system use and a plausible causal pathway exists, presume causation unless the developer or provider demonstrates otherwise. This shifts investigative burden to entities with better access to system internals.
2. Strict liability. Hold developers or deployers liable for harm regardless of fault or negligence. This approach treats AI-enabled biological harm like product liability: if a system contributed to harm, its developer or deployer compensates those affected. The advantage is clear accountability; the risk is discouraging beneficial AI development.
3. No-fault compensation funds. Establish pooled funds (contributed by AI companies, governments, or insurers) to compensate victims without requiring proof of specific fault. This model parallels vaccine injury compensation programs and could ensure redress without protracted litigation.
These frameworks assume identifiable developers and deployers. Open-weight models complicate liability: once released, anyone can deploy them, and the original developer has no control over downstream use. Strict liability for open-source developers could end open-source AI development; no liability leaves victims without recourse. This tension remains unresolved.
Current State
No jurisdiction has established comprehensive liability rules for AI-enabled biological harm. The EU AI Act addresses some liability questions for high-risk AI systems but does not specifically cover biosecurity applications. US product liability law could apply if AI systems are treated as products, but case law is limited.
Liability frameworks will likely develop reactively, after an incident clarifies the stakes. Proactive engagement now could shape more balanced rules before a crisis forces hasty legislation.
Recommendations for Different Actors
For Policymakers
- Designate lead responsibility for AI-bio governance within government
- Strengthen DNA synthesis screening by moving from voluntary to mandatory frameworks
- Fund biosecurity evaluation of AI systems through existing research mechanisms
- Engage internationally through existing forums (BWC, G7/G20) and new mechanisms
- Build technical capacity in regulatory agencies to evaluate AI-bio risks
For AI Companies
- Implement structured biosecurity evaluation before deploying models with biological capabilities
- Build safeguards into biological design tools, not only around them: alignment, anti-jailbreak testing, unlearning research, watermarking or provenance where technically feasible (including proof-of-concept tools such as SynthIDBio), and documented limits of each control (Wang et al., 2025)
- Share threat information with government and peer companies
- Support development of industry standards through consortium action
- Invest in defensive applications of AI for biosecurity
- Be transparent about capabilities and limitations of internal governance
For Researchers
- Engage with biosecurity implications of biological AI research
- Practice responsible publication for dual-use findings
- Participate in evaluation efforts to build collective understanding
- Inform policy through accessible communication of technical issues
- Build cross-disciplinary bridges between AI safety and biosecurity communities
A September 2025 WHO dialogue with six scientific-journal publishers and one preprint publisher recorded a shared editorial toolkit of author declarations and checklists, internal and external expert review, and escalation to specialist committees, applied in different combinations by outlet (WHO, 2026). Participants reported that rejection for dual-use concern is rare, that authors from non-life-science backgrounds are often unaware of dual-use issues, and that a rejected manuscript can still appear on a preprint server or a less-restrictive journal. This is a meeting report, not a binding publishing standard, and it is not experimental capability evidence.
For International Bodies
- Convene multi-stakeholder dialogues on AI-bio governance
- Develop technical guidance that can be adapted to national contexts
- Build monitoring capacity for emerging biological technologies
- Facilitate information sharing across jurisdictions
- Document emerging norms and best practices
Value Alignment in Biosecurity AI
Beyond technical performance and safety guardrails, AI systems for biological research and defense embed value judgments that shape consequential decisions. A protein design tool optimized for novel therapeutics may simultaneously lower barriers to pathogen enhancement. A literature synthesis system tuned for scientific accuracy may inadvertently provide operational guidance for bioweapons development.
The RAISE (Responsible AI for Social and Ethical Healthcare) consortium has proposed a “Values In the Model” (VIM) framework for making these embedded values transparent (Goldberg et al., NEJM AI, 2026). While developed for clinical AI, the framework offers principles applicable to biosecurity contexts.
Embedded Values in Dual-Use AI
Biological AI systems involve trade-offs that reflect underlying value choices:
| Trade-off | Value Tension |
|---|---|
| Scientific openness vs. security | Knowledge dissemination vs. misuse prevention |
| Research acceleration vs. caution | Speed of discovery vs. risk assessment depth |
| Broad access vs. controlled distribution | Democratization vs. gatekeeping |
| Optimized efficacy vs. safety margins | Performance vs. precautionary constraints |
Model developers make implicit choices about these trade-offs during training, fine-tuning, and deployment. A model that aggressively filters biosecurity-relevant queries embeds precautionary values. One that provides unrestricted scientific information embeds openness values. Neither is inherently correct, but the choice should be explicit.
Applying VIM to Biosecurity
The VIM framework proposes that AI systems disclose:
Allocative values: What organizational or commercial priorities shaped development? A system built for pharmaceutical discovery operates differently from one built for biosecurity screening.
Technical trade-offs: How does the system balance competing objectives? What performance was sacrificed for safety constraints?
Edge case handling: How does the system respond to ambiguous dual-use queries? What reasoning underlies these responses?
For biosecurity applications, this transparency supports:
- Red team evaluation: Understanding embedded values helps identify where guardrails may fail
- Governance decisions: Policymakers can assess whether a system’s value alignment matches institutional requirements
- International coordination: Explicit value disclosure facilitates cross-border governance discussions
Integration with Existing Frameworks
Value alignment assessment complements technical approaches to biosecurity governance:
- DNA synthesis screening: Beyond sequence matching, assess what values guide flagging thresholds
- Model access tiers: Managed access decisions should consider value alignment, not just capability levels
- Audit requirements: Include value alignment documentation alongside performance metrics
A proposed global log for medical AI interactions (Noori et al., 2025, preprint) could be adapted for biosecurity contexts, creating records of how AI systems navigate value-laden queries over time.
Why do existing biosecurity frameworks like the BWC not cover AI risks?
Traditional biosecurity frameworks were designed for state programs, physical pathogens, and traditional laboratories. They regulate possession of dangerous materials but not information or AI-generated designs. The BWC lacks verification mechanisms and AI provisions, select-agent regulations do not cover computational outputs, and DURC policies focus on federally funded research rather than AI systems.
What is compute governance and how does it address AI-bio risks?
Compute governance monitors large-scale computational resources used to train powerful AI models. It includes reporting requirements above certain thresholds, know-your-customer standards for cloud providers, and export controls on advanced chips. Those tools do not by themselves bind copy, run, or boot on the hardware that hosts weights, including on-prem and local boxes. Biological design may not require frontier-scale compute, further limiting its effectiveness specifically for AI-bio risks.
What is layered defense in biosecurity policy?
Layered defense uses multiple overlapping controls across different intervention points: restricting AI capabilities, controlling use-time through monitoring, blocking materials access via DNA synthesis screening, and enabling detection and response. No single layer is sufficient, but together they create barriers requiring adversaries to evade multiple controls.
Should AI models for biological design be open-source?
This remains contested. Open weights enable anyone to download and modify models, stripping out safety guardrails through jailbreaking (prompt-side, no weights required) or through subversive LoRA untraining (an adapter on released weights). Open science drives innovation and prevents monopoly control. The biosecurity concern is that once released, high-capability biological design tools cannot be un-released, requiring different governance than typical open science.
What biosecurity guardrails exist for infectious disease datasets used in AI training?
The proposed Biosecurity Data Levels (BDL) framework applies risk-tiered access controls to pathogen datasets before AI training. Experiments with ESM3 and Evo 2 show that excluding viral training data degrades capabilities of concern, which supports upstream data governance as a guardrail, although fine-tuning can partially recover excluded capabilities.
Who is liable when AI enables biological harm?
No jurisdiction has established clear liability rules for AI-enabled biological harm. Responsibility is distributed across the AI value chain: developers who build models, providers who integrate them, and deployers who use them. WHO proposes three approaches: presumption of causality (shift burden of proof to developers), strict liability (compensate regardless of fault), and no-fault compensation funds (pooled resources for victims). Open-weight models further complicate liability since anyone can deploy them without the original developer’s control.
This chapter is part of The Biosecurity Handbook. Related chapters: DNA Synthesis Screening, The Biological Weapons Convention and International Governance, and Red-Teaming AI Systems.