Biosecurity Is Too Important to Be Left Unregulated

Contributed commentary by Scott Fay, Ansa Biotechnologies  

November 11, 2026 | Recently, California became the first state to enact a law requiring nucleic acid synthesis companies to screen sequences and vet customers before delivering their products. California is a pioneer in creating enforceable regulations of nucleic acid synthesis screening. Unfortunately, it’s not enough.  

I build software systems for a DNA synthesis company. An important part of my job is to help mitigate the risk of a bad actor using synthetic biology for harm to put society at enormous risk. The new California state law is a welcome step toward establishing a stronger framework for regulation of nucleic acid synthesis screening. However, if regulation devolves into a patchwork of state-level rules, it will hamstring industry. What we really need is robust, uniform federal and international regulation to help ensure biosecurity for synbio, especially as AI tools are raising the stakes by making pathogenic sequences easier to design and disguise to evade simple screening protocols.  

Prior to the passage of the California law, there were no enforceable regulations governing how nucleic acid providers screen sequences or customers. Many vendors are members of the industry-led International Gene Synthesis Consortium, voluntarily following best practices described in the Harmonized Screening Protocol. But until the California state law was passed, there was no consequence for vendors who violated those practices. It only takes one instance of a vendor ignoring screening guidance to give a bad actor access to potentially dangerous material.  

Unfortunately, business incentives do not naturally align with biosecurity precautions. No one at a synthesis company wants to contribute to a bioterror threat. But implementing and performing screening protocols costs money and time. Introducing barriers to fulfilling orders runs counter to commercial incentives. That’s why regulation is so important: It creates an even playing field among synthetic nucleic acid providers while upholding security. DNA synthesis companies already have many compelling reasons to conduct rigorous screening protocols, given the threats to their own businesses and to society at large. It’s time to establish a standardized regulatory structure with real penalties and guaranteed follow-through for companies that fail to follow the rules. 

The right regulation should also support development of screening tools and better governance in the face of constantly improving generative AI tools. These tools can allow bad actors to design sequences specifically for their ability to pass screening protocols. We should expect that they will only get stronger and more refined in the future, paving the way for people with little scientific background to do the laboratory work necessary to design harmful biological agents. Scientists and policymakers are working hard to establish better governance of bio AI tools, such as managed access to help prevent misuse. Leading AI tool developers are working to self-regulate frontier models, reporting incidents and creating access controls, but just as with synthesis providers, appropriate legislation with real oversight will help incentivize the industry to do the right thing through legal enforcement.  

The other major challenge in our current approach is a lack of clarity about how to establish the credibility or eligibility of someone ordering potentially concerning DNA. Such orders aren’t automatically rejected, since there can be valid reasons to work with pathogenic DNA. But the orders do require vetting of the customer, and we need better guidance for how to do that.   

For example, consider a hypothetical order placed for part of an ebola virus genome. This order has obvious potential to be dangerous and will be caught by available screening tools. But once the order is flagged as concerning, the next step requires figuring out whether there’s a legitimate need for that sequence. Perhaps the scientist works for a well-known national laboratory with a grant to research ebola virus. But what if the scientist works for a lesser-known institution, with a weaker claim for needing the DNA, like a startup working on vaccines? Protocol guidance asks us to consider verifying facts like the destination address, institutional affiliation, and publication history, but there are no specific standard rules to establish legitimacy. Regulations that define clear, objective “know your customer” criteria would help to ensure that the customer verification process is a standardized system we can all trust. 

To be clear, I do believe that most DNA vendors try their best to follow guidelines and take appropriate precautions with every order. But biosecurity threats are too great a risk to be left unregulated. Many leaders of DNA synthesis and AI tool companies have signed an open letter in support of mandatory nucleic acid synthesis screening. The entire industry would benefit from robust, enforceable regulation that applies to all synthesis provider companies. It’s the best way to enable great science while protecting society. 

Scott Fay, PhD, serves as senior vice president of informatics at Ansa Biotechnologies, a DNA manufacturer using enzymatic DNA synthesis. The views expressed are the author’s own. Scott can be reached at [email protected].