NIH Foreign Risk Denials: Why Your Consultants and Contractors Matter Most
NIH's small business program is back, and so is its foreign risk review. The data released over the past year points to one blind spot founders keep missing: the people and companies they bring onto the project, not just the company itself.
What the data shows
In August 2026, NIH stated that since HHS began foreign risk assessments in 2023, more than half of HHS's SBIR and STTR denials have been due to foreign risks involving consultants or contractors. NIH did not publish the exact count.
Earlier data from the Senate Small Business Committee gives a sense of scale. According to a May 2025 report from Sen. Joni Ernst, covering 2023 and 2024:
NIH flagged 144 SBIR and STTR applications for foreign ties and denied all 144.
NASA flagged 125 applications and denied one on that basis.
Across all participating agencies, 835 applications were flagged and 303 were denied.
Put together, a flag at NIH has functioned as a denial, and the source of the flag is often a collaborator rather than the applicant.
Why NIH is stricter than other agencies
The Small Business Innovation and Economic Security Act, signed April 13, 2026, reauthorized SBIR and STTR through September 30, 2031 and wrote foreign risk screening into law for every participating agency. NIH implemented it through NOT-OD-26-074, which sets three rules founders need to understand:
No pre-award fix. If HHS identifies a risk, applicants do not get a chance to resolve it before award. You remove the risk and apply again in a future cycle.
Covered individuals are broad. Review extends to owners, key personnel, and anyone who substantively contributes to the project, including consultants, contractors, service companies, and partners.
Disclosure continues after award. Recipients update foreign disclosures with every progress report and report changes within 30 days. If a change or misstatement is found to pose a national security risk, the recipient must repay all funds received.
Other agencies, including the Department of War under its new Foreign Risk Evaluation Program, can treat some findings as mitigatable. At NIH, the practical answer is to get clean before you submit.
Where collaborator risk shows up
NIH's own foreign risk case studies illustrate how outside parties lead to denial:
A contracted research services provider owned by a foreign parent company.
A subject matter expert with in-kind ties to a research institution in a country of concern.
An IT services provider controlled by an entity in a country of concern.
The same case studies show the fix. In two examples, a contract research organization on the DoD 1260H list and a partner company owned by an entity in a country of concern were terminated before the application was submitted, and the award could be made.
The foreign countries of concern are China, North Korea, Russia, and Iran. Review also looks at ownership and investors, foreign affiliations, licensing and joint ventures, patents filed abroad in the last five years, malign foreign talent recruitment programs, and cybersecurity practices.
Action items before your next NIH submission
List every covered party. Include owners, key personnel, consultants, contractors, CROs, CDMOs, IT and service providers, and research partners.
Screen each one against the restricted lists. Check names against the DoD 1260H list, Commerce Entity List, Military End User List, Section 889, OFAC Non-SDN CMIC, and related lists.
Check ownership, not just names. A vendor can look domestic while its parent company or controlling investor is not.
Review the last five years. Look at foreign appointments, collaborations, patents, and financial arrangements for everyone on the project.
Replace risky collaborators before you apply. NIH will not let you mitigate after a finding.
Keep your story consistent. Make sure biosketches, Other Support, and the Foreign Disclosure Form submitted at Just-In-Time tell the same story.
Plan for post-award changes. Set a process to vet new hires, investors, and vendors so a Year 2 change does not put the award at risk.
Screen your collaborators with the BW&CO Foreign Risk Scanner
BW&CO built a free Foreign Risk Scanner so founders can check institutions, CROs, CDMOs, contractors, manufacturers, vendors, and collaborators against U.S. government restricted party lists before they submit. It covers the lists NIH screens plus the DoD Section 1286 list, with no sign-up required.
The scanner is a first-pass check. It does not replace a full ownership review or an agency determination, and a clean result does not guarantee an award decision. If you find a match or are unsure about a relationship, talk with our team before you submit.
Book a call with the BW&CO team
Sources
NOT-OD-26-074: Policy Changes to SBIR and STTR Foreign Disclosure and Risk Management
NIH SEED: Foreign Disclosure and Risk Management and case studies
Sen. Joni Ernst: New Report Exposes Critical Tech Is Vulnerable to China (May 15, 2025)
Crowell: SBIR/STTR Programs Reauthorized After Six-Month Lapse
Program names are used for identification only. BW&CO is not affiliated with or endorsed by the sponsoring agencies.