AI in the Lab: From ­Biological Design to Biological Access ­Control

The convergence of AI and the life sciences has continued to accelerate, while the policy debate around these tools has become increasingly concrete. Over the past year, the discussion has shifted from broad concern about AI-enabled biological design toward questions of who should be able to access these tools, under what conditions, and subject to what forms of oversight.

Regulated Access

Recent work has highlighted a series of practical interventions, including access to sensitive pathogen data, managed access to high-risk biological AI tools, improved screening of synthetic DNA orders, and tighter safeguards for frontier AI model deployment.

Last year’s CNTR Monitor¹ discussed how biological design tools were expanding the possibilities of protein engineering, diagnostics, and related areas, while also raising concerns about misuse. That underlying picture has not changed. AI systems continue to improve researchers’ ability to predict protein structure, generate candidate biomolecules, and assist with specialized biological tasks. What has changed, however, is the level of attention now being paid to governance. A growing number of researchers, policy organizations, and AI companies are asking which parts of the pipeline should remain broadly open and which may require tighter control. The question has moved from simply whether these tools are dual-use to how their scientific value can be preserved, while reducing the risk of them being used to support deliberately harmful applications.

One of the clearest shifts in emphasis is toward managed access. In January 2026, NTI | bio published a Framework for Managed Access to Biological AI Tools² arguing that access to certain biological AI tools should be tiered according to their risk level and limited to validated users where appropriate. Access is increasingly understood as existing on a spectrum, with lower-risk tools being more widely available and higher-risk systems being subject to tighter controls, potentially even requiring identity checks, monitoring, and usage restrictions. The same logic is increasingly being applied to commercial products and service-based platforms, which offer relatively open access to capabilities, while keeping the underlying model weights and training data out of public reach. Just as important, the NTI framework emphasizes that security measures should be balanced with equitable access, ensuring that safety does not become a pretext for concentrating advanced scientific capability in the hands of a small number of institutions or countries.

A related policy development concerns the data used to train biological AI systems. A policy article published in Science in February 2026³ argued for tailored access restrictions on a narrow category of pathogen data that may pose special AI-related misuse risks, while preserving open access in almost all other domains. This underscores the fact that biological data are not all alike. Large volumes of sequence data are already in the public domain and have long supported legitimate research. More sensitive are functional datasets that connect pathogens or pathogen variants to traits such as transmissibility, virulence, immune evasion, or host range. These are the kinds of data most directly relevant to high-risk biological design. The resulting policy direction is narrower than a general call for secrecy, yet more consequential than earlier voluntary norms. This suggests that the debate is beginning to take a more concrete policy form.

DNA Synthesis Screening

One of the most important governance control points remains the synthesis of nucleic acids.⁴ A 2025 Science paper by Wittmann and colleagues⁵ tested whether open-source AI protein design tools could generate variants of proteins of concern that would evade the screening systems used by commercial DNA synthesis providers. They identified a real vulnerability: in some cases, AI-redesigned sequences could evade existing detection methods. Working with synthesis companies, the researchers then developed and deployed patches that greatly improved detection of modified sequences likely to retain the function of the original protein. The paper shows both that AI-assisted biological design can create new screening challenges and that these methods must evolve alongside generative design tools.

Functional screening has also received more attention.⁶ Rather than relying solely on taxonomic or homology-based screening (which identifies sequences based on similarity to known organisms or previously characterized genes), functional approaches seek to identify sequences based on the harmful biological functions they encode, such as tissue damage, immune evasion, or host-cell attachment. This could make screening more robust to recoding or other sequence changes that preserve function, although such methods remain harder to implement at scale and still depend on well-curated functional databases.

While nucleic acid screening has often been treated mainly as a technical problem, it also raises questions of implementation. A 2025 analysis argues that the field still lacks agreed mechanisms to verify whether providers are actually implementing effective screening practices.⁷ This creates economic costs for the firms responsible, makes screening claims difficult to verify, and leaves regulators hesitant to impose stronger requirements in the absence of clear standards. Another unresolved issue is how screening performance should be audited, since future regulation will require agreed standards for comparing platforms and verifying compliance.⁸ A proposed pathway toward enforceable screening standards centers on processes led by industry but supported by regulatory oversight. This includes clearer definitions of sequences of concern (SOCs), third-party testing, certification, and a phased transition from voluntary adoption to enforceable compliance. This approach frames synthesis screening as a standards and governance issue, rather than simply a technical safeguard.

Stronger oversight can still fail in practice if institutions lack the staff, screening capacity, and review systems needed to carry it out effectively. Ambiguous definitions, fragmented regulatory triggers, and underdeveloped institutional capacity could produce oversight that appears rigorous on paper, while delivering limited additional security in practice. In February 2026, a bipartisan U.S. bill proposed mandatory screening of gene synthesis orders and customers, showing how quickly this issue has moved from expert recommendation to proposed legislation.⁹

In June 2026, calls for mandatory screening gained further momentum when the leaders of major AI firms joined an open letter urging the U.S. Congress to require screening of synthetic DNA and RNA orders. At the same time, IBBIS and other organizations continued to develop practical implementation tools and standards, including the Commec screening tool, the DNA Synthesis Screening Consortium, and work related to ISO 20688-2. This also highlights the need for international coordination, since differences in national standards and reporting rules weaken the effectiveness of screening.

Actions by Frontier AI Companies

Measures adopted by AI companies themselves should be distinguished from governance measures imposed by, or coordinated through, public institutions. The first concern internal model development and deployment practices, such as refusals, monitoring, preparedness frameworks, and access controls. The second concern laws, standards, audits, and other forms of external oversight. The aforementioned open letter urging Congress to mandate DNA synthesis screening illustrates how the two can intersect, as it involves companies calling for external governance rather than only expanding their own internal safeguards.¹⁰

Frontier AI companies have also begun to describe the risk of biological misuse in more operational terms. In May 2025, Anthropic announced that it was deploying Claude Opus 4 with AI Safety Level 3 protections as a precautionary response to risks associated with chemical and biological misuse.¹¹ OpenAI has similarly stated that it expects upcoming models to reach high levels of capability in biology under its Preparedness Framework,¹² and has outlined a combination of mitigation measures, including model behavior controls, monitoring, and preparedness measures focused on biological risks. Many questions remain about the effectiveness of refusals, jailbreak resistance, and misuse detection. These developments show that at least some leading firms now treat biological risk as a live deployment issue rather than merely a distant possibility. This shift matters because it moves the conversation from abstract principle to concrete operational practice.

Current biorisk evaluations do not always capture real-world misuse potential, since many standard benchmarks saturate quickly and may not reflect the physical and organizational bottlenecks involved in developing biological weapons. This has resulted in renewed calls for more transparent evaluations and more realistic studies, including physical uplift trials, which better test how model performance translates into practice.¹³

One question is how well safeguards hold up when biological models are released in a form that others can adapt. A 2026 paper examined whether excluding certain data from training remains effective under those conditions.¹⁴ Using Evo 2 as a case study, they found that fine-tuning the model on a relatively small set of harmful human-infecting viruses could partly restore capabilities relevant to misuse. Data filtering can help prevent misuse, but in open models this remains vulnerable to circumvention via fine-tuning and thus serves better as a single layer of protection than as a complete safeguard.

Evaluation and access control have therefore become more central. The main question is how general-purpose reasoning models, biological foundation models, and automated laboratory systems may eventually be combined into integrated workflows. Models are becoming better at navigating specialized scientific domains. Recent governance proposals therefore assume that effective safeguards must be built into the entire pipeline, from training data and model access to sequence synthesis and downstream monitoring. A RAND analysis argues that standard biology benchmarks capture only part of the picture¹⁵. More relevant risks may emerge when AI agents are capable of performing multistep workflows that involve planning, tool use, adaptation, and interaction with biological resources. The central question is how a model performs in more realistic design-build-test-learn tasks. Evaluation, therefore, plays a governance role, as decisions about model access, deployment, and safeguards increasingly depend on how these capabilities are measured and interpreted.

A more cautious RAND Delphi study on the limits of AI-enabled pathogen design found broad agreement that, in the near term, AI should still be understood mainly as an assistive tool rather than an autonomous designer of novel pathogens.¹⁶ Experts engaged in the study emphasized that AI already helps specialists with certain aspects of bioengineering and related work, but that successful translation from digital design to functional biological constructs still depends heavily on laboratory capacity, experimental validation, and high-quality data. This suggests that the most immediate concern is the growing ability of AI systems to accelerate or augment already capable actors, rather than fully autonomous pathogen invention.

The main governance question is therefore situated at the interfaces between digital design, physical synthesis, and institutional oversight. The policy challenge is to decide which forms of openness serve science and society, and which require more structured control. Most biological research data and lower-risk AI tools should remain openly accessible, but a narrower category of high-risk data and high-risk tool access may require verification, monitoring, and managed release. Balancing innovation and security will require a layered approach, combining technical safeguards, managed access, stronger screening, capability evaluations, and public governance that is both internationally compatible and attentive to inequity. As access to sensitive tools and data becomes more regulated, decisions on who gets access and under what conditions will need to be transparent and politically accountable. The tools will also need to be matched to actual institutional capacity, so that new oversight requirements do not become brittle, merely symbolic, or unevenly applied in practice.

Policy Recommendations

1. The EU should establish binding requirements for nucleic acid screening and customer verification across member states. Support the introduction of binding EU requirements for sequence screening and customer verification for synthetic nucleic acid orders, rather than relying on uneven voluntary uptake. The focus should be on common standards, third-party testing, and mechanisms that can keep pace with AI-designed sequence variants.

2. Support managed access to high-risk biological AI tools and datasets. Back national and EU-level frameworks that keep most biological data and lower-risk tools openly accessible, while requiring validated access, monitoring, and clearer governance for higher-risk pathogen data and biological AI systems.

3. Invest in implementation capacity. Any new screening or access-control requirements should be matched by funding for institutional implementation, including biosafety staff, screening tools, review capacity, and guidance for universities and research institutes.

4. Support international coordination on biosecurity standards for DNA synthesis and biological AI tools. Promote internationally compatible standards for nucleic acid screening, managed access, reporting channels, and evaluation practices, ensuring that governance does not remain fragmented across jurisdictions, facilitating circumvention.