The NIH rejection you can't appeal: a foreign risk self-audit & July Funding Radar
Today's edition: A foreign risk self-audit for NIH applicants, plus what's new across OMB, NIH, NSF, and ARPA-H.
What’s Inside:
OMB: Proposed rule would let agencies cancel any grant. Comments close July 13.
NIH: SBIR reopens with higher ceilings and three new programs. Deadline September 8.
NSF + ARPA-H: $250M at NSF with a $40M instrumentation carve-out; ARPA-H summaries due July 10.
NIH policy: A proposed cap on grants per investigator could shift billions toward newer PIs.
AI for science: Co-Scientist and Claude Science move AI from the chat window into the lab.
The foreign risk self-audit: The pre-submission check for the screening you can’t appeal.
🗓️ Funding & Connection Opportunities Round-Up
OMB wants authority to cancel any federal grant
What: The Office of Management and Budget (OMB) published a proposed rule (Federal Register, May 29) that would make peer review advisory, let any agency cancel any grant under a “national interest” justification, restrict international collaboration, and require pre-approval for publication costs and conference travel. Proposed effective date: October 1, 2026.
So what: This is a proposal, not policy. But if finalized as written, the cancellation clause changes the risk math for any company built on federal awards.
Do: Comments close July 13. If you hold or plan federal awards, read the rule and file a comment.
Source: Federal Register | Submit a comment
NIH reopens SBIR with higher ceilings and three new programs
What: NIH’s Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) funding opportunities are open with a September 8 deadline. Several institutes raised ceilings to $700K for Phase I and $3M for Phase II. New: a Commercialization Readiness Pilot, a Phase IIB Strategic Breakthrough Award, and a forecasted Transition Grant for New Entrepreneurs.
So what: The strongest NIH SBIR cycle in years. Ceilings vary by institute, so check yours before you budget.
Do: Check your institute’s award levels at seed.nih.gov and start program officer outreach now. If this is your first NIH SBIR, target September, not January: September feedback arrives in time to revise for January. Wait, and your first feedback lands mid-2027.
Source: NIH Seed Fund
NSF returns with $250M, including $40M for scientific instrumentation
What: NSF reopened SBIR/STTR (solicitations 26-510 and 26-511) with $250M. Phase I runs up to $305K, and a Project Pitch is required before a full proposal; the first deadline is July 27. NSF 26-511 sets aside $40M specifically for scientific instrumentation. Separately, the Advanced Research Projects Agency for Health (ARPA-H) runs its own SBIR program (7 healthcare topics, Phase I up to $600K), taking solution summaries through July 10, a tight window if you’re starting now; the BAA is worth knowing for its next cycle either way.
So what: The instrumentation carve-out is the kind of set-aside most founders never hear about. And both programs use low-effort first gates: a pitch or a summary, not a full proposal.
Do: If you build instruments, read 26-511 before July 27. Healthcare tech: get an ARPA-H solution summary in by July 10.
Source: NSF 26-510 | NSF 26-511 | ARPA-H SBIR
NIH proposes a cap on how many grants one investigator can hold
What: Notice NOT-OD-26-086 proposes capping simultaneous research project grants per investigator at 2, 3, or 4. NIH’s own figures: a cap of 2 would free $3.53B, enough to support 5,230 additional investigators. In FY2025, 10.7% of principal investigators (PIs) held three or more.
So what: Redistribution generally favors newer, smaller applicants, which is most of this audience. The open question: whether SBIR awards (R43/R44) count toward the cap.
Do: Comments are due August 3. Newer investigators have a stake worth a comment; multi-award founders should watch the mechanism question.
Source: NIH Notice NOT-OD-26-086
Google and Anthropic ship AI built for the lab, not the chat window
What: Google DeepMind published Co-Scientist in Nature, a multi-agent system for hypothesis generation. Anthropic released Claude Science, a desktop research environment: local Python/R sessions, connections to 60+ scientific databases, and reproducibility built in. Every output keeps the code and environment that made it, and a background agent flags uncited claims.
So what: Two practical angles for grant-funded teams. Reproducibility pays at Phase II, when you extend results you can rerun instead of rebuilding a year-old analysis. And local compute matters when your data is proprietary or your contract says it stays in-house. Disclosure is the open question: NIH’s current AI policy (NOT-OD-25-132) covers writing, not research design.
Do: Trial one tool on a non-critical task, and start a simple log of how you use AI in your research before any agency asks for it.
Source: Co-Scientist (Nature) | Claude Science
Also on your calendar
NIH “Small Business 101” webinars - Building Your Budget (Jul 14, 1:30pm ET); Managing Foreign Risk (Aug 18, 1:30pm ET). Registration via seed.nih.gov.
Comment deadlines - OMB rule: Jul 13. NIH grant-cap proposal: Aug 3.
One thread connects the OMB proposal and NIH’s August webinar topic: federal funders are tightening on foreign ties. Which brings us to this week’s checklist.
✅ The foreign risk self-audit: run it before DHHS does.
The situation
A biomedical founder described their case on r/SBIR in June: a Commercialization Readiness Pilot application at NIGMS (NIH’s institute for general medical sciences), following a completed Phase I, II, and IIB on the same technology. Every employee, investor, and vendor is a US person or US company. The proposal scored well. It was rejected on the foreign risk assessment, with no explanation of what triggered the finding and no appeal.
Why this matters
Since FY23, every NIH small-business applicant files a required foreign disclosure (NOT-OD-23-139), on a form developed by the Small Business Administration under a congressional mandate. Most founders treat it as paperwork. But the assessment behind it runs at the Department of Health and Human Services (DHHS) level, not at NIH, and the evaluation criteria are not published.
Founders report that rejections arrive without explanation and can’t be fixed mid-cycle: the only path is resubmitting next round. The reports include companies whose flagged staff are US-trained scientists on green cards.
What’s changed: reports of well-scored proposals failing this screen are accumulating, and not just on founder forums. Wisconsin’s SBIR support center documented the same pattern last August: applications that scored well enough to fund, rejected at the Just-in-Time stage. NIH has since extended the requirements to active awards (NOT-OD-25-102), and the OMB proposal above points in the same direction, toward more scrutiny of foreign ties, not less. NIH has reportedly told grant firms that more specific feedback starts with the September cycle. That would help, but it isn’t confirmed, and it won’t restore a lost cycle.
The framework
One thing to be straight about: DHHS does not publish its criteria. So this audit has two layers. The disclosure requirements come from the official form and NIH’s guidance. The reported triggers are the risk surface founders and grant firms describe from experience: a map drawn from other founders’ rejections, not a regulation. Both layers are worth checking; only the first is official. The statute behind the program (the SBIR and STTR Extension Act of 2022) names what gets assessed: cybersecurity practices, patent analysis, employee analysis, and foreign ownership including financial ties. The steps below turn that scope into checks you can run yourself.
1. Start from the official disclosure requirements
What to do: Read NIH’s foreign disclosure and risk management page and the required disclosure form before anything else.
Why it matters: The form defines what you must disclose: covered individuals, foreign talent program affiliations, foreign ownership and support.
Practical note: Disclosure is mandatory; the categories below are how you find what belongs on it.
2. Audit key personnel and covered individuals
What to do: List everyone the government counts as key on the project. Confirm no affiliations with foreign talent recruitment programs.
Why it matters: A covered individual tied to a flagged program is the clearest trigger in the official materials.
Practical note: Reported: even employees not on the project draw questions about data access. Be ready to describe how project data is fenced.
3. Search publication histories (reported trigger)
What to do: Search every named person’s co-authorships for institutions in China, Russia, Iran, or North Korea.
Why it matters: Grant firms report old or incidental co-authorships tripping the screen, including ties applicants didn’t consider relevant.
Practical note: There is no confirmed lookback window. Treat “it was years ago” as a thing to address, not a reason to skip it.
4. Ask your investors and check your vendors (reported triggers)
What to do: Ask investors whether foreign money or ownership from countries of concern sits in their fund. Check the ownership of every vendor, subcontractor, and manufacturer on the budget.
Why it matters: Community reports include flags from a US fund’s foreign backing and from foreign-owned vendors, even ones operating through US facilities.
Practical note: Ask in writing and keep the answers on file. If a flag ever needs a mitigation plan, documented diligence is your starting point.
5. If anything surfaces, write a mitigation plan before you submit
What to do: For each tie, document four things: what the relationship was, when and how it ended, the controls now in place (no ongoing contact, no travel to the country of concern, restricted data access), and who in the company verified it.
Why it matters: Practitioners who work these cases advise getting ahead of the screen; there is no cure after it.
Practical note: The honest limit of the reports: it isn’t confirmed where this document goes - submitted with the application, held on file, or provided if questions come. That question, plus anything ambiguous in your audit, is what you take to a research-security or compliance professional before you submit.
The checklist
Before your next NIH submission:
Read the official foreign disclosure page and form (seed.nih.gov)
List covered individuals; confirm no foreign talent program ties
Search each person’s co-authorships for countries-of-concern institutions
Check your patents for foreign co-inventors, assignees, or filings
Ask each investor about foreign money or ownership in their fund
Check ownership of every vendor, subcontractor, and manufacturer
Know who can access project data; be ready to describe the controls
Any flag found: write a mitigation plan before submitting
Anything ambiguous: get professional research-security review
The case
A grant-writing firm described its experience on r/SBIR: a client rejected on foreign risk two years ago, with no recourse and no explanation. Their process since: search every contributor, from PI to lab assistant, for co-authorships with institutions in countries of concern before any submission, and write a mitigation plan whenever a tie appears. The lesson: they stopped trying to predict the screen and started assuming every tie needs an answer in writing.
One thing to do this week
Take the proposal you plan to submit September 8 and start with its most-published person. Pull their publication list (CV, ORCID, or Google Scholar profile) and scan the co-author affiliation lines for institutions in China, Russia, Iran, or North Korea. Expect about an hour for a long record. If anything surfaces, you have two months to prepare a mitigation plan, and you’ll have the method down for the rest of the team.
One boundary on all of this: a clean self-audit reduces surprises. It does not guarantee clearance, and none of this is legal advice. For ownership structures, export control, or personnel questions, use a qualified research-security or compliance professional.
If someone forwarded this to you…
Till next time,
—Lana.
Commercialization Co-Founder
P.S. This edition runs heavy on warnings: cancellations, caps, screenings. So here’s the other half, plainly: these are the best NIH SBIR terms in years, three agencies are open at once, and most applicants will read none of the fine print above. The boring details are the edge.
Know a founder submitting to NIH on September 8? Forward this; the checklist could save them a cycle…