Foreign-Risk Screening: The SBIR Rule With No Cure Period

What HHS screens, what triggers automatic denial, and why the check belongs before submission rather than after.

Most requirements in a federal award can be fixed once flagged. A budget is renegotiated, a protocol approval arrives late, a form is corrected at Just-in-Time. Foreign-risk screening does not work that way, and one sentence in the governing notice is the reason:

"HHS will not provide applicants the opportunity to address any identified security risks prior to award."

The screening is mandatory, it applies to every competing application and every active award, and a finding produces a denial rather than a request for correction. That single feature moves the work from the end of the process to the beginning.

The rule is set out in NOT-OD-26-074, released 20 April 2026, implementing the Small Business Innovation and Economic Security Act signed a week earlier.

Who counts as a covered individual

The screening reaches further than a company's payroll. The notice defines a covered individual as someone who either contributes "in a substantive, meaningful way to the scientific development or execution" of the proposed project, or is named in the application as senior key personnel.

Contribution, not employment, is the test. A consultant, a scientific adviser, a subawardee's investigator, or an unpaid co-founder who shapes the science can all fall inside it. Disclosure obligations attach to covered individuals and to owners, which reaches the cap table independently.

What HHS assesses

The due diligence program examines eight areas:

• Cybersecurity practices of the small business
• Patent analysis
• Employee analysis
• Foreign ownership, including financial ties and obligations — surety, equity and debt — of both the company and its employees to a foreign country, person or entity
• Foreign affiliations of a covered individual, owner or other key personnel with an entity in a country of concern
• Investment relationships with an individual or entity in a country of concern
• Technology licensing agreements or joint ventures, including joint venture-like arrangements, with an individual or entity in a country of concern
• Business relationships between a covered individual, owner or key personnel and an individual or entity in a country of concern

The inclusion of debt obligations and of employees' personal financial ties is the part companies tend not to anticipate. So is patent analysis, which reaches assignment and licensing history rather than the science alone.

What produces a denial

HHS cannot make an award where any of the following is found:

The eight lists are specific and public:

Two features of this construction matter. The listed-entity provision requires a security risk connecting the company to a listed entity or individual. A relationship should be assessed in that context; the notice does not state that every connection alone triggers denial. And the criteria reach affiliates of a listed entity, not only the entity itself.

What a denial does and does not mean

HHS tells a denied applicant that a security risk required denial, and indicates which category produced it. It does not explain further, and there is no opportunity to respond first.

The notice is equally explicit that the consequence is not permanent: a denial on security grounds "does not prohibit the small business concern from being eligible for an award in a subsequent award cycle." A company that resolves the underlying relationship can apply again. What it cannot do is resolve it after the finding and salvage the application in hand.

The obligations continue after award

The policy applies to all active awards, regardless of when they were submitted, and the disclosure is a standing duty rather than a submission requirement.

• Annual updates at every RPPR — annual, interim and final.
• Within 30 days of any change in ownership, entity structure, covered individual, or other substantive change in circumstances, filed between RPPRs through the Additional Materials tool in eRA Commons.
• Any change to a previous disclosure, and any material misstatement posing a national security risk, must be reported.

The recovery provision is the one to read closely. A company must repay all amounts received under the award where HHS determines either that it made a material misstatement posing a national security risk, or that a change in ownership, entity structure or circumstances poses such a risk. An award may also be terminated for material failure to comply.

A financing round that changes the cap table is therefore a reportable event on a 30-day clock, and a company that treats disclosure as a one-time submission task acquires exposure it is not watching.

Where early-stage companies are actually exposed

The common patterns are ordinary commercial arrangements rather than anything exotic:

• A foreign investor on the cap table, including through a fund.
• Contract research performed overseas, which is a business relationship and often a data relationship as well.
• In-licensed technology from a foreign institution, which engages both the licensing and the patent-analysis criteria.
• A founder or adviser holding a dual appointment at a foreign research institution — the criterion here names research-institution affiliation directly.

These arrangements require assessment against the specific criteria. Some can directly meet a denial criterion depending on the country and relationship, even without a listed-entity connection. Others require a security-risk determination; foreign involvement alone should not be treated as automatic disqualification.

Conclusions

1. HHS provides no opportunity to address an identified security risk before award. Assess relevant relationships before submission.
2. The scope extends beyond employees. Covered individuals are defined by substantive contribution or senior/key-personnel status, and owners are included separately.
3. Apply each denial criterion as written. The listed-entity provision includes a security-risk condition; other criteria describe specific prohibited relationships.
4. A denial does not permanently bar eligibility. A later application may be eligible, subject to its circumstances and the applicable requirements.
5. Monitoring continues after award. Disclosure updates are required at RPPRs and within the specified 30-day period between reports. Full repayment follows the particular national-security determinations stated in the notice, not every administrative error.

One practical note on cost. Screening for potential foreign involvement is a statutorily named technical and business assistance activity, so it can be paid from an award's TABA allocation once that award exists. A prospective applicant should plan to finance pre-submission screening itself rather than assume that a future award will reimburse it. Post-award screening remains important because disclosure and monitoring duties continue.

Related. Anatomy (and Physiology) of an NIH SBIR/STTR Application · The SBIR/STTR Funding Landscape · After the Summary Statement: Resubmit, Redirect, or Stop

Sources

• NOT-OD-26-074 — Policy Changes to SBIR and STTR Foreign Disclosure and Risk Management, released 20 April 2026. All quoted language and every criterion above is from this notice.
• Prior notices in the same chain: NOT-OD-23-139, NOT-OD-24-029, NOT-OD-25-102.
• NIH SEED — Foreign Disclosure and Risk Management
• FY26 NIH Grants Policy Statement, Section 18.
• Small Business Innovation and Economic Security Act, signed 13 April 2026, reauthorizing SBIR and STTR through 30 September 2031.
• NOT-OD-26-075 — technical and business assistance, under which screening for foreign involvement is an eligible activity.