teleo-codex/inbox/queue/2026-04-21-penn-ehrs-durc-pepp-governance-vacuum.md

---
type: source
title: "DURC/PEPP Governance Vacuum: EO 14292 120-Day Deadline Missed, No Replacement Policy"
author: "University of Pennsylvania EHRS / NIH / White House OSTP"
url: https://ehrs.upenn.edu/announcements/update-us-government-policy-oversight-durc-and-pepp
date: 2025-09-29
domain: grand-strategy
secondary_domains: [health, ai-alignment]
format: policy-document
status: unprocessed
priority: high
tags: [biosecurity, DURC, PEPP, gain-of-function, EO-14292, governance-vacuum, AI-bio-convergence, indirect-governance-erosion, mechanism-2]
flagged_for_vida: ["DURC/PEPP rescission creates biosecurity governance vacuum — health domain, AI-assisted pathogen design risks"]
flagged_for_theseus: ["AI-biosecurity convergence: AI capabilities for pathogen design advancing while oversight framework dismantled"]
---

## Content

Aggregated policy status from multiple sources:

**EO 14292 (May 5, 2025):** "Improving the Safety and Security of Biological Research"
- Halted all federally funded "dangerous gain-of-function" (DGOF) research
- Rescinded May 2024 DURC/PEPP policy (Dual Use Research of Concern / Pathogens with Enhanced Pandemic Potential)
- Directed OSTP to publish replacement policy within 120 days (~September 3, 2025 deadline)
- Justification framing: anti-gain-of-function populism (NOT AI arms race framing)

**NIH implementation:**
- May 7, 2025 (NOT-OD-25-112): Immediately stopped accepting grant applications for DGOF research
- June 18, 2025 (NOT-OD-25-127): Required all awardees to complete portfolio reviews identifying DGOF research by June 30, 2025

**OSTP deadline: MISSED**
- September 29, 2025 (Penn EHRS last update): No replacement policy published
- As of April 2026: OSTP has not published the replacement policy
- Research community remains in policy vacuum
- Pause on dangerous gain-of-function research in effect BY DEFAULT without operative classification framework

**Budget context (from Council on Strategic Risks / prior sessions):**
- NIH: -$18B
- CDC: -$3.6B
- NIST: -$325M (30%)
- USAID global health: -$6.2B (62%)

**AI-biosecurity convergence risk:**
The Council on Strategic Risks "2025 AIxBio Wrapped" report: "AI could provide step-by-step guidance on designing lethal pathogens, sourcing materials, and optimizing methods of dispersal" — precisely the risk DURC/PEPP was designed to govern. As of April 2026, AI-bio capability is advancing without the oversight framework that existed specifically to govern AI-assisted dual-use biological research.

## Agent Notes
**Why this matters:** This is stronger than the 04-14 session framing suggested. It's not just that DURC/PEPP was replaced with something weaker — it was rescinded and replaced with NOTHING. Seven months past the 120-day deadline with no replacement. This is an indefinite governance vacuum specifically covering AI-bio dual-use research at the moment when AI-bio capability is most rapidly advancing.

**What surprised me:** OSTP missing its own executive order deadline by 7+ months with no published explanation. This is unusual for a mandated policy process. Either OSTP lacks the expertise/resources to develop the replacement (consistent with DOGE budget cuts), or there is deliberate delay (consistent with "anti-gain-of-function" framing being politically convenient but scientifically incoherent as a policy framework). The absence is more alarming than a weakened replacement would have been.

**What I expected but didn't find:** Congressional action to fill the vacuum. The CRS has flagged it as an open concern, but no legislation has been introduced to restore DURC/PEPP oversight. This tracks with the Mechanism 2 finding from 04-14: biosecurity advocates don't see the AI connection; AI safety advocates don't see the bio governance connection.

**KB connections:**
- [[existential-risks-interact-as-a-system-of-amplifying-feedback-loops-not-independent-threats]] (Belief 2 grounding) — this is the specific causal chain: AI capability advancing + AI-bio oversight dismantled = compound existential risk
- [[voluntary-ai-safety-constraints-lack-legal-enforcement-mechanism]] — voluntary constraints aren't even relevant here; the issue is absence of mandatory oversight
- [[pandemic-agreement-confirms-maximum-triggering-event-produces-broad-adoption-without-powerful-actor-participation]] — the IHR framework that existed for pandemic governance is now being undermined by the same deregulatory environment

**Extraction hints:** Primary claim: "EO 14292's DURC/PEPP rescission created an indefinite biosecurity governance vacuum: OSTP missed its 120-day replacement policy deadline by 7+ months, leaving AI-assisted dual-use biological research without an operative oversight framework during the period of fastest AI-bio capability growth." Secondary (Mechanism 2 application): "The AI-biosecurity governance vacuum was produced by anti-gain-of-function framing structurally decoupled from AI governance debates — creating the most dangerous variant of indirect governance erosion, where the community that would oppose the erosion doesn't recognize the connection."

**Context:** This is the empirical grounding for Session 04-14's Mechanism 2 (indirect governance erosion) finding. The DURC/PEPP case is now more severe than originally understood: it's not a weakened replacement, it's an absence of replacement. Flag for Vida and Theseus — this is cross-domain (health + AI alignment).

## Curator Notes (structured handoff for extractor)
PRIMARY CONNECTION: [[existential-risks-interact-as-a-system-of-amplifying-feedback-loops-not-independent-threats]]
WHY ARCHIVED: Concrete evidence for Belief 2's AI-bio compound risk pathway — the governance mechanism specifically designed for AI-assisted dual-use biosecurity has been dismantled without replacement
EXTRACTION HINT: Two separate claims: (1) the governance vacuum itself (DURC/PEPP rescinded, no replacement 7 months later); (2) the structural decoupling (anti-GOF framing prevents AI safety community from recognizing the AI-bio governance gap)