Biosafety professionals translate precautionary rules into practice, study finds

When the U.S. government tightened oversight of high-risk biological research, the hardest part of compliance turned out not to be the rules themselves but the organizational work of deciding what they meant. A new qualitative study of biosafety and biosecurity professionals finds that precautionary mandates governing dual use research of concern (DURC) and pathogens with enhanced pandemic potential (PEPP) are not simply implemented; they are interpreted, negotiated, and adapted inside institutions before they become actionable decisions. The researchers call this process regulatory translation, and they argue that it is the mechanism through which abstract national policy acquires practical force in laboratories, compliance offices, and university administrations.

The study, published in Frontiers in Political Science, draws on transcripts from a two-day deliberative workshop held October 10–11, 2024, at the University of Nevada-Reno. The workshop brought together 45 participants selected for professional expertise in biosafety, biosecurity, regulatory compliance, and the governance of high-risk life science research. Attendees included biological safety officers, responsible officials, compliance professionals, life science researchers, and biosecurity specialists drawn from universities, pharmaceutical companies, medical research institutes, and federal laboratories. Discussions were conducted under the Chatham House Rule, audio recorded, professionally transcribed, and de-identified, yielding transcripts from sixteen breakout discussions and two full-group deliberative sessions. Quotations are attributed to discussion sessions rather than to named individuals or organizations to preserve confidentiality.

The analysis, led by David R. Gillum and Kathleen M. Vogel of Arizona State University’s School for the Future of Innovation in Society, applied constructivist grounded theory principles, using iterative reading, open coding, and thematic synthesis in NVivo to identify recurring interpretive patterns. The authors are explicit that the evidentiary basis is participants’ accounts and deliberative reasoning, not direct observation or independent verification of the practices described. The sample was purposive, prioritizing relevant expertise over demographic representativeness, and was not designed to support estimates of prevalence or systematic comparisons across organizations. Both authors have extensive professional experience in biosafety and biosecurity, a proximity they acknowledge could shape interpretation and which they addressed through ongoing reflexive discussion during analysis.

What emerged was a picture of oversight in which acceptable risk is negotiated rather than universally defined. Participants linked institutional risk tolerance to leadership preferences, accumulated experience, legal expectations, staff training, and organizational history. One participant described a highly risk-tolerant institution that had followed certain practices for twenty years, cautioning that what works there may not translate elsewhere because legal risk tolerance, training, and experience differ. Compliance, similarly, was described not as mechanical rule-following but as a dynamic and relational practice. One participant admitted wanting to follow regulations as much as possible, whether or not they agreed with them, to avoid personal legal jeopardy. Others described threshold-setting struggles around near misses, where the same type of incident could be classified as trivial by one responsible official and as a formal reportable event by another, depending on local norms, leadership expectations, and professional experience.

This is where the study’s second key concept, the compliance-discretion paradox, comes into focus. Formal accountability systems seek consistency, transparency, and reviewability across institutions, yet the uncertainty that motivates precautionary regulation prevents complete specification of appropriate action in advance. Practitioners must decide what evidence is relevant, when a threshold has been crossed, and what action is proportionate. Standardization can structure judgment, the authors argue, but it cannot eliminate the need for judgment. Indeed, additional reporting rules and accountability procedures may create new discretionary questions about classification, escalation, documentation, and the sufficiency of evidence. The paradox is therefore not a simple opposition between rules and discretion but a recursive relationship in which formal accountability both constrains and depends on professional discretion.

The workshop data also reveal how far oversight decisions extend beyond technical safety considerations. Participants described compliance decisions shaped by institutional liability, public scrutiny, reputational risk, and potential regulatory consequences. A Form 3, the government document used to report the theft, loss, or release of a select agent or toxin, was described as capable of attracting national media attention, and in some government facilities such reports go directly to Congress. Participants discussed FOIA requests, congressional oversight, and media attention as factors that could alter the organizational consequences of a reporting decision, with one noting that the problem is controlling the spin. Reputation was described as a business decision component of cost-benefit analysis, with the science risk-benefit analysis only part of the equation. Some participants described strategies such as over-classifying risks, hyper-documenting safety activities, and conservatively interpreting ambiguous policies to shield themselves and their institutions from scrutiny, a pattern the authors link to defensive compliance rather than proactive commitment to safety.

A further tension concerned the misalignment between biosafety expertise and national security expectations. Although biosafety professionals are tasked with assessing research risks, many emphasized that evaluating potential national security threats, such as misuse of research findings, was beyond their professional training and skill set. One participant observed that the 2024 DURC/PEPP policy and its implementation guide focus on controlling information rather than physical agents, which is a national security issue rather than a safety issue. Another noted that without access to intelligence resources, their security assessments often became performative, based more on institutional liability concerns than substantive national security analysis. The authors suggest this expertise mismatch may reflect a structural feature of precautionary governance: responsibility for evaluating uncertain future harms is assigned to local actors who lack direct access to the specialized knowledge, intelligence resources, or threat-assessment capabilities needed to evaluate those risks fully.

Organizational capacity emerged as a third dimension of the findings. Participants voiced concern over increasing difficulty recruiting and retaining qualified biosafety professionals, particularly for leadership roles, within a climate of heightened scrutiny, institutional pressure, and legal liability. One participant described younger professionals balking at the responsibility relative to compensation, while another recalled that being plugged into the biosafety network was probably the only reason they did not completely get arrested and fined. Others warned of a mass exodus as scientists leave the field because they spend their days filling out forms rather than doing laboratory work. Participants framed these as organizational rather than purely individual challenges, citing limited mentorship, succession planning, and professional development, and raising questions about the long-term sustainability of biosafety and biosecurity expertise within institutions.

Effective governance also depended on institutional buy-in, which participants described as essential for securing compliance and fostering a broader culture of safety. Biosafety professionals positioned themselves as collaborators helping researchers navigate complex oversight systems, but such relational strategies relied on broader institutional backing. Without endorsement and enforcement from senior administrators, biosafety personnel reported having little leverage, and in some cases being explicitly overruled, for example when attempts to withhold protocol approval over incomplete training were pushed back. Buy-in was also necessary across horizontal structures, requiring coordination among contracts and grants, faculty affairs, university communications, and upper administration, not only biosafety offices. Participants noted that support fluctuates over time, describing a constant battle across changing administrations within their own institutions.

The authors caution that the findings are based on practitioner accounts in a group setting that may have amplified shared professional narratives or made minority views less visible, and that the study cannot distinguish cleanly between individual-level and organization-level sources of variation. They also note that discussions focused heavily on governance processes, documentation, communications, leadership engagement, and external scrutiny, with comparatively less attention to changes in laboratory methods or experimental protocols, a pattern that does not establish laboratory practices were unchanged. Still, the study offers a concrete account of how precautionary governance becomes operational: through institutional mediation, professional expertise, and organizational action rather than formal regulatory requirements alone. The authors suggest federal oversight frameworks may benefit from clearer guidance on the respective roles of biosafety, biosecurity, and national security expertise, and that organizations may improve implementation by distributing responsibility across multiple functions rather than concentrating it within biosafety offices. Whether similar dynamics operate in other domains of precautionary governance, such as cybersecurity, artificial intelligence governance, environmental regulation, or public health preparedness, remains an open question for future research.

Subject of Research: How biosafety professionals interpret and implement precautionary U.S. oversight policies for dual use research of concern and pathogens with enhanced pandemic potential

Article Title: Organizational culture and risk in high-stakes life sciences research

Article References: Gillum, D. R., & Vogel, K. M. (2026). Organizational culture and risk in high-stakes life sciences research. Frontiers in Political Science, 8, Article 1945896. https://doi.org/10.3389/fpos.2026.1945896

Image Credits: AI Generated

DOI: 10.3389/fpos.2026.1945896

Keywords: biosafety, biosecurity, dual use research, pathogens with enhanced pandemic potential, precautionary governance, regulatory translation, organizational culture, compliance, risk governance, qualitative research, institutional oversight, workforce sustainability