Science

The air over the federal grants yard smells like fresh paper and burnt coffee. Somewhere in a server room, an error message is warming up like a grill getting hot. And on April 22, 2026, NIH reminded universities that leniency for Common Forms is about to end, while research security training language gets folded back into the Common Forms for the next cycle.

NIH announces the end of its Common Forms leniency period and upcoming system enforcement for research security training

I have seen this movie. NIH issued a Guide Notice telling the research community that system enforcement of Common Forms will move from warnings to hard errors. It also says Research Security Training certification language is being restored into the Common Forms so people have time to comply for the next cycle.

The moment the warning turns into an error, that is when the power grab gets real

NIH says the current leniency period ends on May 7, 2026, with the final AIDS standard receipt date for Cycle 1. Then, on May 8, 2026, system warnings change to errors that will stop submissions not using the compliant Common Forms. In other words, you can keep arguing with the customer service script until the smoke clears, but after that, the gate swings shut.

Now bring in Research Security Training. NIH also explains that SciENcv and the SciENcv system updates are deploying on April 22, 2026, adding the RST certification back to the Common Forms for individuals. NIH says that move targets applications with due dates on or after May 25, 2026. During the window when someone is submitting before that effective date, NIH says it will not hold individuals accountable for the portion of the certification tied to the training requirement effective for those later due dates.

Who benefits from the paperwork treadmill, besides the IT contractors and policy shops?

NIH frames this as implementation of requirements tied to the CHIPS and Science Act. The earlier NIH notice spells out the overall intent: covered individuals must certify they completed Research Security Training within a 12 month window, and institutions must certify compliance too. NIH says the training requirement is optional for now, with certifications effective for applications due on or after May 25, 2026, and that NIH recognizes specific training modules as meeting the requirement.

Scientific integrity should not become checkbox governance

Sure, there is a national-security rationale behind it. But when you turn integrity into a compliance script, you create a steady compliance workload. NIH says it is aligning implementation with statutory Research Security Training requirements and the Common Forms timeline, and it lays out a tight sequence: leniency ends May 7, errors begin May 8, RST certification language is restored on April 22, and the training requirement is aimed at due dates on or after May 25. Tight sequences squeeze humans, and humans miss details.

What this means for America: fewer chances for discovery, more chances for paperwork casualties

America funds research to push the frontier, not to keep the front office busy with error messages. When compliance becomes the main hurdle, the risk shifts from bad science to missed submissions. NIH is telling everyone exactly what is coming, and it is not hiding the dates. The question is whether the real-world implementation keeps the focus on integrity or drifts into checkbox governance.

When May 8 turns warnings into errors, will universities treat this like a speed bump or like a roadblock, and what gets hit first when the grants system tightens its grip?

The newsroom coffee tastes like burnt pennies. Outside, sirens duet with construction beeps. Inside, my inbox fills with press releases like confetti from a corporate wedding. This week’s bouquet: the University of Texas at Austin announcing a $750 million gift from Michael and Susan Dell to build what UT calls the country’s first “AI-native” medical center, projected to open in 2030.

Michael and Susan Dell fund an “AI-native” medical center at UT Austin with a $750 million gift

Here is the clean fact pattern. On April 21, 2026, UT announced a $750 million donation from the Michael and Susan Dell Foundation to launch a new advanced research campus with the UT Dell Medical Center as a centerpiece. UT says it expects to break ground this fall and that the medical center is projected to open in 2030. UT also says the Dells have now surpassed $1 billion in giving to the university.

A big academic medical center can do real good. Training. Clinical trials. Translational research. Better access to care if it is built that way. I am not allergic to building hospitals. I am allergic to how we are building the power system that decides what hospitals are for.

Translation: “AI-native” means “data-first,” and patients are the data

Translation: “AI-native” sounds like a stainless-steel miracle. In plain English anger, it usually means building the institution around data capture, algorithmic decision support, and infrastructure that makes those systems hard to avoid.

Start from the floor plan: sensors, workflow software, EHR integrations, cloud pipelines, model monitoring, vendor contracts that outlast a dean. Every hallway becomes a funnel for information. Every clinical decision becomes a chance to standardize, quantify, and later monetize. Not automatically evil. Automatically powerful. And power, in America, is a magnet for grift.

UT’s language is about improving patient care through AI, making the system more predictive and seamless. Fine. The question is never whether AI can help. The question is: help whom, under whose rules, with whose accountability, and with what escape hatch when it breaks.

Follow the money: philanthropy is the soft power wing of privatization

Follow the money: the Dells did not just write a check. They bought a lever. Naming rights are the receipt. The leverage is what comes next: priorities, partnerships, procurement, and prestige.

Universities love words like “catalyze” and “redefine.” That is PR fog. What this does is move a public institution’s center of gravity. When the biggest line item comes from a billionaire, every meeting starts with an unspoken survival math problem: keep the donor happy, keep the board calm, keep the pipeline of gifts flowing.

These deals are engineered to look like pure public benefit, and the hard choices show up later, quietly, in contracts, committees, and nondisclosure agreements.

Here is the mechanism: build the institution, lock in the vendors, normalize the ideology

Here is the mechanism: you do not need a conspiracy when you have incentives. An “AI-native” medical center needs compute and infrastructure, plus development, deployment, maintenance, monitoring, and compliance. That means vendors, often the same outfits selling the tools and the narrative.

Once you architect a hospital around AI, opting out becomes like opting out of electricity. Systems harden into policy. Pathways get encoded. Metrics get encoded. Then when harm happens, the institution points to the model, the benchmark, the “best practice.” Responsibility gets laundered through process.

The quiet part: this is about legitimacy, not just medicine

The quiet part: billionaire money buys legitimacy. It buys the feeling that our institutions still work, even as the public side gets hollowed out and the private side picks the locks.

So before the concrete dries, I want binding transparency on partnerships and vendor relationships, public-interest governance with real community power, independent audits of models and outcomes, ironclad protections against data misuse, and enforceable guarantees this does not become a concierge machine for the insured while everyone else gets told to download an app.

Mic drop: a $750 million check is not accountability. It is influence. Who is going to audit the contracts, the governance, and the data rules before “AI-native” becomes a polite synonym for donor-native medicine?

I read NIH’s latest notice the way you read a court docket in a quiet library: not for entertainment, but because it tells you who holds the keys. SBIR and STTR still promise non-dilutive funding for real science. Now they also come with a foreign-risk screening process that can end in a denial you cannot rebut before it is final.

What NIH changed, and when

On April 20, NIH issued a notice outlining changes to SBIR and STTR foreign disclosure and risk management. NIH ties the update to the Small Business Innovation and Economic Security Act, which NIH says President Trump signed on April 13, 2026. NIH says the law reauthorizes SBIR and STTR through September 30, 2031, and the notice spells out how the foreign-risk machinery will work for competing applications and proposals, and for active awards.

The new screen: broad, and aimed beyond the CEO

NIH emphasizes an HHS “due diligence program” that assesses security risks posed by applicants. As described, it can examine cybersecurity practices, patent analysis, employee analysis, foreign ownership and financial ties, foreign affiliations of key people, investment relationships involving a foreign country of concern, technology licensing or joint ventures with such parties, and other business relationships involving covered individuals and owners.

The notice also tightens who counts as a “covered individual”: anyone contributing in a substantive, meaningful way to the scientific development or execution of the project, or identified as senior key personnel. Translation: this can land on a principal investigator or scientist, not just executives.

The headline in the footnotes: denial without a chance to respond

NIH says HHS cannot make an SBIR or STTR award if it determines an applicant has certain relationships, including:

• An owner or covered individual involved with a malign foreign talent recruitment program.
• A business entity, parent company, or subsidiary located in the People’s Republic of China or another foreign country of concern.
• An owner or covered individual with a foreign affiliation with a research institution located in the PRC or another foreign country of concern.

NIH also describes denial triggers tied to entities or individuals on several government lists, and a category where the security risk has a primary source that is classified. NIH says HHS will not give applicants an opportunity to address identified security risks prior to award. You may be told which denial category applied, but not given a pre-award chance to argue your case.

After the award: monitoring, fast updates, and repayment risk

Recipients must monitor relationships with foreign countries of concern and submit updated disclosure forms for certain changes, including annual updates tied to research performance reporting. For certain changes between reports, NIH says updates are required within 30 days. NIH says if NIH, CDC, and FDA determine there was a material misstatement posing a national security risk, or a change in ownership or structure that poses such a risk, the small business concern can be required to repay all amounts received.

The tradeoff (and the Paine test)

Yes, public dollars and sensitive tech justify scrutiny. But the liberty ledger matters: a system that can deny funding without a pre-award response, including on classified-source risk, concentrates power behind a curtain. Guardrails NIH could pair with this approach are already obvious in plain text: an appeal lane with a real timeline, a process to cure fixable mistakes before denial, aggregate public reporting on denials and reversals, regular audits by inspectors general and Congress, and an independent reviewer when classified sources are involved.

We can defend the country without building a grants system that behaves like a secret proceeding. If this black box is acceptable here, where else will we install it next?

The newsroom coffee tastes like burnt toner. My phone keeps vibrating with the same three forces that run this town: money, paranoia, and administrative power. A new rule gets stapled to a grant application and suddenly a lab’s future depends on whether you can translate bureaucrat into human.

NIH updates SBIR and STTR foreign disclosure and risk management rules

On April 20, 2026, NIH posted a notice telling SBIR and STTR applicants that policy changes have landed for Foreign Disclosure and Risk Management. It reads like a warning label for anyone trying to get federal innovation money through HHS, with NIH as the biggest gravitational mass in that solar system.

Yes, it’s arriving right as SBIR and STTR are freshly reauthorized. Reauthorization on April 13, 2026 sounds like a ribbon cutting. The April 20 notice feels like a metal detector at the door.

In the real world, SBIR and STTR fund the boring, expensive middle of innovation. The stretch between “cool idea” and “product that helps people.” NIH’s message: you still might get funded, but first you will be processed.

Translation: “Foreign risk management” can become a silent veto

Translation: “Foreign Disclosure and Risk Management” sounds like a spy thriller. In practice, it can become a compliance gate that decides your fate without a scientific argument. Not a peer-review fight over methods. A risk process where you may never be told what tripped the wire.

This apparatus has been building across agencies, with best practices, due diligence frameworks, and “covered individuals” language turning foreign-risk checks into a default step, not an exception.

The sales pitch is “protect America from influence and IP leakage.” Fine. The operational reality is that the more opaque the scoring, the easier it is to punish normal collaboration and normal lives, while shrinking accountability for delays, denials, and extra hoops.

Here is the mechanism: friction functions like a budget cut

Here is the mechanism: Congress can fund a program. Agencies can still choke it by adding friction. The lever isn’t always “no.” It’s “not yet,” “submit again,” “more documentation,” “more certification,” “wait for clearance.”

Compliance produces attrition. The rich survive it. The desperate die in it. If you have venture capital, you hire the right counsel and keep moving. If you’re a scrappy startup built by scientists, you learn the real curriculum: paperwork is power.

And because this is a notice, not a scandal, it slides through the system like a paper cut. No cameras. No vote board. Just expectations that reshape who even bothers to apply.

Follow the money: barriers to entry create winners

Follow the money: The more you wrap SBIR and STTR in risk bureaucracy, the more you tilt the field toward firms that can afford compliance labor. Compliance labor is an industry, and every new rule is a market opportunity.

The biggest winners are incumbents and well-capitalized players who love barriers to entry. They don’t call it that. They call it “security,” “integrity,” “resilience.”

The losers are the people NIH’s brochures praise: new entrants, weird ideas, immigrant founders, and spinoffs long on science and short on legal budget. Even if every check is justified, the distributional impact is not neutral. It selects for who can endure the process, not just who has the best science.

I was parked in a public library, the kind with dust in the vents and civic faith in the stapler. On my screen: another government attempt to solve an oversight shortage with software. When power is in a hurry, guardrails always seem to be “phase two.”

Pentagon says AI will screen Pentagon-funded academics for China ties

Defense News reports the Pentagon is moving toward computer screening, including AI tools, to vet military-funded academics for problematic foreign ties, with China as the headline concern. The impetus is painfully familiar: a watchdog found oversight staffing was badly outmatched by the volume of awards and disclosures that need review.

This is the “easy button” genre. Only this button can freeze grants and scorch reputations.

Why the Pentagon is reaching for automation

The Department of Defense funds a vast amount of fundamental research. It wants innovation fast, and it wants adversaries not to siphon it off faster. Congress has warned about research security for years, and a 2025 House Select Committee report said it identified roughly 1,400 papers that acknowledged DoD support while involving collaboration with PRC entities, arguing DoD policies were fragmented and inconsistently enforced.

Then the math problem arrives: per Defense News, an inspector general evaluation highlighted thin staffing compared with the number of awards requiring scrutiny. So the Pentagon says computers will help do the sorting.

A January 7, 2026 memorandum from the office overseeing defense research and engineering points components toward tighter risk-based security reviews and explicitly calls for developing automated vetting and continuous monitoring capabilities, building a common research grant database, and conducting spot checks and reporting.

The Paine test:

Does this expand liberty or concentrate power? Automation that surfaces real deception while preserving due process is a guardrail. Automation that quietly widens surveillance and denial decisions behind a dashboard is power with a user interface.

The tradeoff: speed versus fairness

Security is not imaginary. Spies exist, and technology transfer is real. But the moment an algorithm triages “trustworthiness,” false positives become policy, and those false positives land on actual people: grad students, tenure files, labs on deadlines, immigration paperwork.

This is also how the United States repeats itself. We build a blunt tool for a real threat, get impatient with case-by-case judgment, and then act surprised when proxies get punished: surnames, nationality, co-authorship networks, old affiliations, a conference trip from years ago. The China Initiative era left scars for a reason.

The Orwell check: “continuous monitoring” as a euphemism

Automated vetting. Continuous monitoring. Risk-based review. Common repository. Clean language, big consequences. What data feeds the model? Who sees the outputs? How long is it kept? Can a person see, correct, and appeal before the penalty hits?

Per the Defense News reporting, the Pentagon declined to provide specifics about criteria and weighting for threat assessments. That might be normal inside the building. It is not good enough when civilians and universities are on the receiving end.

Guardrails before the software gets a badge

If any screening is automated, rules should be bright-line and public: human judgment as final decision-maker with documented reasoning; notice and an appeal process with real timelines; a narrow data diet; independent audits for bias and error rates reported to Congress and made public to the maximum extent possible; and hard limits on retention and sharing, because a risk flag can become a career-long stain.

If you were the researcher getting flagged, what due process would you insist on before you called it fair?

The air over D.C. still smells like burnt charcoal and wet paperwork, and today the NIH is basically turning the SBIR and STTR pipeline into a security checkpoint. Not because science is bad. Because oversight matters, and foreign strings are not a side quest.

NIH issues a Notice of Information on SBIR and STTR foreign disclosure and risk management

Served hot off the grill: NIH published a new Notice of Information, NOT-OD-26-074. It lays out policy changes for HHS small-business grant applicants to disclose foreign affiliations, plus how the agency will run due diligence to assess security risks. It also spells out consequences if the foreign-risk picture comes up ugly, including denial of awards and repayment requirements where someone misstates ties or where ownership shifts under the hood.

Follow the money: transparency for taxpayers, workers, and real innovators

Who benefits when the government demands visibility? Taxpayers. Workers. And the actual innovators who build on home turf and earn their spot in the American supply chain.

Under the notice, disclosed foreign affiliations and relationships feed into a due diligence program that can assess things like cybersecurity practices, patent analysis, employee analysis, and even foreign ownership and financial ties. That is not vibes. That is risk management with a checklist aimed at stopping the kind of grift where federal cash shows up, foreign entanglements get hidden, and the intellectual property starts doing laps overseas like it paid tolls.

The villain is the incentive: control, influence, and technology transfer

The incentive at the center of the story is power and control. Foreign ties can mean foreign influence, technology transfer, and the slow-motion theft of American ideas. The notice also points to situations where HHS cannot make an award if certain risk categories apply, including connections to a foreign country of concern or listed security-risk entities.

Security screening without a do-over, plus post-award monitoring

Sure, mistakes happen. But the notice says applicants and recipients are encouraged to consider security risks, and per the Act, HHS will not give an opportunity to address identified security risks prior to award. Decision gate happens before the check clears.

After awards, the notice describes post-award monitoring and reporting requirements. If there is a material misstatement posing a national security risk, or a change in ownership or entity structure that meets risk criteria, it describes repayment of amounts received.

What this means for America: science that stays American

The notice ties these changes to the reauthorization of SBIR and STTR through September 30, 2031, referencing the Small Business Innovation and Economic Security Act. The goal is straightforward: update the rules based on what the nation learned, and publish the implementation details so applicants know the road rules before they rev.

So if you are doing honest work, transparency is not your enemy. It is your shield. Now tell me, friends: why would an honest scientist or small-business innovator be scared of disclosing foreign ties instead of trying to dodge the gate?