An entity shall establish an appropriate biosafety and biosecurity management mechanism.
For the management of the pathogens and biotoxins in Risk Groups 2 to 4, an entity shall appoint a biosafety officer (hereinafter referred to as "BSO"); an entity which has thirty employees or more shall also set up an institutional biosafety committee (hereinafter referred to as "IBC").
An entity that is required to set up an IBC according to the preceding paragraph shall do so before it is allowed to possess, use, import and export, store or dispose of pathogens in Risk Groups 3 and 4 and select agents and toxins.
The BSO must have at least three years of working experience in laboratory biosafety and biosecurity.
The IBC shall have several members; the head or deputy head of the entity shall act as its chairperson, the BSO is an ex officio member of the committee, and the other members are as follows:
1. A representative of laboratory or storage facility directors.
2. A representative of laboratory or storage facility managers.
3. A representative of engineering technicians or other personnel with relevant professional knowledge.

An entity must, within one month after the establishment of the BSO position or a IBC, report it to the local competent authority for approval. The same shall apply to any changes thereafter.
Only after an entity has completed the approval process in the preceding paragraph may its laboratory or storage facility start to possess, use, import and export, store or dispose of the pathogens and biotoxins mentioned in Paragraph 2 of the preceding article.

The BSO shall attend training courses designated by the central competent authority and obtain certificates therefor within three months after the approval prescribed by Paragraph 1 of the preceding article has been granted.
The BSO shall attend at least eight hours of continuing education courses every year, and have his or her professional competence re-approved once every three years.
The training courses and continuing education mentioned in the preceding two paragraphs shall be offered by the central competent authority itself or professional institutions commissioned by it; the re-approval shall be undertaken by the local competent authority.

Duties of the BSO are as follows:
1. Act as the contact person of the entity for external communication of biosafety and biosecurity matters;
2. Provide consultation on biosafety and biosecurity matters of laboratories and storage facilities;
3. Review the application of laboratories and storage facilities for possession, use, import and export, storage or disposal of pathogens and biotoxins in Risk Groups 2 - 4;
4. Supervise the biosafety and biosecurity training of laboratory or storage facility personnel;
5. Conduct internal audits of biosafety and biosecurity of laboratories and storage facilities every year;
6. Supervise the performance evaluation of high-containment laboratory personnel competence and the operation of biorisk management system;
7. Supervise the emergency response drills of laboratories and storage facilities;
8. Supervise cleaning and disinfection operations before maintenance and repair of equipment in laboratories or storage facilities;
9. Supervise decontamination operations of laboratories and storage facilities when leakage of infectious biological materials or other incidents occur;
10. Supervise the waste management of laboratories and storage facilities; and
11. Investigate biosafety or biosecurity anomalies or accidents of laboratories and storage facilities, report the findings, and make recommendations to the IBC.

Duties of the IBC are as follows:
1. Establish biosafety and biosecurity management policies and rules for laboratories and storage facilities;
2. Review the biosafety level of laboratories;
3. Review the possession, use, import and export, storage or disposal of pathogens and biotoxins in Risk Groups 2 to 4;
4. Review biosafety, biosecurity and emergency response plans of laboratories and storage facilities;
5. Review the plans for construction, reconstruction, expansion, inception and termination of use of laboratories and storage facilities;
6. Review matters concerning disputes over biosafety or biosecurity of laboratories and storage facilities;
7. Establish a health monitoring mechanism for laboratory or storage facility personnel; and
8. Review and supervise other matters concerning management of infectious biological materials and biosafety and biosecurity of laboratories and storage facilities.
For entities exempted from the establishment of an IBC, their BSO shall take charge of the tasks mentioned in the preceding paragraph.

When a laboratory or storage facility of an entity no longer has the need to possess, use, import and export, store or dispose of any pathogens in Risk Groups 2 to 4 and biotoxins, the entity shall submit documents evidencing that all of the infectious biological materials mentioned above have been consumed, destroyed or transferred to the local competent authority for record keeping.

An entity may possess, use, store, or dispose of pathogens and biotoxins in Risk Groups 2 to 4 only after passing the review conducted by its IBC. However, the possession, storage, or addition of pathogens in Risk Group 3 or 4 or increase/decrease in the quantity of such pathogens as a result of transfer shall also be reported to and approved by the central competent authority in advance.
An entity that removes pathogens in Risk Group 3 or 4 from its inventory shall report to the central competent authority for record keeping within thirty days following the removal.

For the import and export of infectious biological materials, an entity shall submit applications and relevant documents to the central competent authority for permission according to Paragraph 2, Article 34 of the Act.
In the event that the infectious biological materials to be imported or exported are pathogens and biotoxins in Risk Groups 2 to 4, consent documents from the IBC of the entity shall be enclosed with the application.

Laboratories and storage facilities that store pathogens in Risk Groups 2 - 4 and biotoxins shall carry out the following:
1. Assign a person to take charge of storage management;
2. Establish access control and implement proper security mechanisms for storage facilities and equipment;
3. Keep inventory of stock and records of retrieval and storage;
4. Draw up biosecurity related management manuals; and
5. Take periodic inventory of items and quantity or weight of pathogens and biotoxins at laboratories or storage facilities.

Level 2 to 4 biosafety and animal biosafety laboratories shall post at a conspicuous place the biosafety level, bio-hazard signs, names and telephone numbers of laboratory directors and managers, and emergency contact, and have biosafety related management manuals available on site.
For laboratory personnel who work with pathogens in Risk Group 3 and/or Risk Group 4, an entity shall keep their serum specimens for ten years after they have left the job. For laboratory personnel who work with pathogens in Risk Group 2, the necessity of retaining their serum specimens and retention period shall be decided by the IBC.

Laboratories or storage facilities that use or store pathogens in Risk Group 3 or 4 shall establish a biorisk management system.

Newly established high-containment laboratories may be inaugurated for use after obtaining the consent of the entity’s IBC and obtaining approval from the central competent authority.
The term “high-containment laboratory” in the preceding paragraph refers to Level 3 and Level 4 biosafety and animal biosafety laboratories.

New employees of a laboratory or storage facility shall attend at least eight hours of foundation courses on biosafety and biosecurity. However, biosafety and biosecurity courses attended by new employees of a high-containment laboratory must be recognized by the central competent authority.
Personnel working at a laboratory or storage facility shall attend at least four hours of continuing education courses on biosafety and biosecurity every year.
With regard to the courses and continuing education mentioned in the preceding two paragraphs, an entity may offer related courses on its own or through other institutions, juridical persons or groups commissioned by it, or arrange for its personnel to attend courses or continuing education offered by other entities, institutions, juridical persons or groups.

Laboratories and storage facilities shall safekeep records on the inventory, disposal, anomalous events, personnel training and other relevant activities in connection with pathogens in Risk Groups 2 to 4 and biotoxins for at least three years.

The transport of infectious biological materials shall meet the triple packaging rules set forth by the central competent authority, use appropriate vehicles, and comply with the rules and regulations set forth by the central transportation and communications authority.
In the event that infectious biological materials leak or have other incidents during the course of transport, transport-related personnel shall promptly undertake necessary measures and notify the entity that requests the transport. Upon receiving such a notice, the entity shall immediately inform the local competent authority where the incident occurs and the central competent authority through the established system or by other appropriate means.

An entity shall promptly inform its BSO when its laboratory or storage facility has an anomalous event.
If an anomalous event mentioned in the preceding paragraph involves inconsistency in the item or quantity of pathogens in Risk Group 3 or 4 to be stored or transferred, or when the aforementioned pathogens are in use, the negative pressure of a laboratory or the functions of a biosafety cabinet are abnormal and cannot be restored immediately, the entity shall report the event to competent authorities at all levels within three days; competent authorities at all levels should, in view of the circumstances, conduct an investigation or obtain details about the event, and take appropriate action as deemed fit.
The BSO shall, within 30 days from the next day following the receipt of a report, complete an investigation of the anomalous event under the preceding paragraph, submit a report to the IBC and propose an improvement plan; the entity shall, within seven days from the next day following approval of the investigation report and the improvement plan by the IBC, report to the competent authorities at all levels for recordkeeping.

The accidental leakage of infectious biological materials at a laboratory or storage facility is classified into the following hazard levels by the degree of leakage:
1. High: the leakage of infectious biological materials spreads to areas outside the laboratory or storage facility, and poses a threat of infecting or harming personnel on duty, personnel of other departments, or people in the surrounding communities.
2. Moderate: the leakage of infectious biological materials is confined within the laboratory area or storage facility, and poses a threat of infecting or harming personnel on duty.
3. Low: the leakage of infectious biological materials is confined to the safety equipment of the laboratory or storage facility, and poses a threat of infecting or harming personnel on duty.
The directions for the reporting and management of leakage accidents mentioned in the preceding paragraph shall be prescribed by the central competent authority.

An entity shall ensure that leakage of infectious biological materials and infection caused by leakage do not occur, and its BSO shall supervise its laboratories and storage facilities to undertake the following:
1. Establish an emergency response plan that contains the following items and particulars:
(1) Emergency response team and tasks;
(2) Types of accidents, identification of hazard level and risk assessment;
(3) Accident alarm, management and reporting mechanisms;
(4) Inventory management of emergency response supplies;
(5) Procedures of emergency medical care and rescue;
(6) Safety protection measures for response personnel;
(7) Emergency evacuation procedures and other response measures; and
(8) Cleaning, disinfection, remediation of hazard areas, coordination with other personnel of the organization, follow-up measures, and investigation reports.
2. Conducting annual drills in accordance with the emergency response plan under the preceding subparagraph and conducting a field drill once every three years.

For the needs of disease prevention and control, the central competent authority may order an entity to destroy, transfer custody of, or dispose of by other means certain infectious biological materials in an appropriate manner within a given period of time.

The central competent authority may conduct inspections of laboratories or storage facilities that use or store pathogens in Risk Group 3 or 4.
Local competent authority may conduct inspections of laboratories or storage facilities in their locality that use or store pathogens in Risk Group 2 or non-select biotoxins; if deemed necessary, the central competent authority may assign personnel to supervise or conduct the inspections.
When deficiencies are found in inspections conducted pursuant to the preceding two paragraphs, the competent authority shall order the entity to take corrective actions within a given period of time, and if deemed necessary, order the entity to stop using or storing relevant infectious biological materials.
Entities may not evade, interfere with or refuse the supervision or inspection by competent authorities.

When a laboratory or storage facility has a biosafety or biosecurity incident or there is concern that it may have such an incident, the competent authority may order the entity to suspend the use or disposal of relevant infectious biological materials.
When safety concern in the preceding paragraph is properly addressed, which has also been confirmed by the IBC of the entity, the entity may resume the use or disposal of relevant infectious biological materials after reporting it to and obtaining the consent of the competent authority.