The Biohacker and the Regulator

In the summer of 1929, in a provincial hospital north-east of Berlin, a twenty-five-year-old surgical trainee numbed the inside of his own elbow, opened a vein and fed a thin rubber catheter up his arm towards his chest. Then he walked, catheter still in place, to the X-ray department, where the film showed its tip lying in his heart. His name was Werner Forssmann. Twenty-seven years later he shared a Nobel Prize for the technique that grew out of that afternoon 1. Medicine tells this story fondly, and it is one of several. The self-experimenter is one of the profession's founding heroes.

How does medicines regulation deal with a modern biohacker experimenting with peptides? Mostly, it does not deal with them at all. Medicines law is written around products and what is said about them: who makes a product, who supplies it, what it is presented as doing, and who administers it to someone else. It was never designed around a lone individual and their own body. That is why, when regulators moved against the peptide trend in 2026, they went to a British clinic and a South African pharmacy rather than to anyone's kitchen. This piece is about that gap. How substances come to be scheduled under drug-control law is a separate story told elsewhere on this site; this one concerns medicines law, the individual, and the places where the two collide.

A tradition with a hall of fame

Forssmann had asked permission and been refused, and he went ahead anyway. What he wanted to show was that a tube could safely be passed into a living human heart, which was the precondition for measuring pressures and flows inside it. The profession did not cheer, and he did not stay in cardiology. The technique was taken up by others, notably in New York, and in 1956 the Nobel committee honoured Forssmann alongside André Cournand and Dickinson Richards for their discoveries concerning heart catheterisation and pathological changes in the circulatory system 1.

Half a century later a physician in Perth ran a different kind of experiment on himself. Barry Marshall and the pathologist Robin Warren had been arguing that a spiral bacterium living in the stomach lining caused gastritis and peptic ulcers. The idea met strong resistance, partly because nobody believed anything could live in stomach acid, and their attempts to infect animals had failed. In 1984 Marshall drank a culture of the organism. Within days he was unwell. A little over a week later a biopsy showed the inflamed, colonised stomach lining the theory predicted, and he then took treatment 2. The account was published in 1985 3, and in 2005 Marshall and Warren shared the Nobel Prize 2.

These are the stories that get told, and they share features that are easy to overlook in the admiration. Each experimenter tested a single, specific hypothesis. Each measured something objective, with an X-ray film in one case and a biopsy in the other. Each wrote the result down and submitted it to people whose job was to disbelieve it. Most important, the experiment was designed to produce knowledge other people could check. The courage was real, but it was put to work in a method.

What the heroes had that the feed does not

The contemporary biohacker is a descendant of this tradition, and most would say so. What is inherited is the willingness, not always the method. A typical self-experiment with an unlicensed peptide has one participant, no comparison, no blinding and no objective measure beyond how the person feels. It usually starts in the middle of other changes, such as new training, a new diet or an injury already healing on its own. And it ends as a testimonial rather than a record. That is not a moral failing. It is simply a different activity from the one that won the Nobel Prizes, even though it borrows their prestige.

Research ethics has thought about self-experimentation more than one might expect, and the difficulty is instructive. The core ethical instrument for medical research on people, the World Medical Association's Declaration of Helsinki, requires a written protocol, review by an independent ethics committee, a proper assessment of risks against benefits, and freely given informed consent 4. A self-experimenter meets the consent condition almost by definition. The other conditions exist for reasons that do not vanish when experimenter and subject are the same person. The independent eye is there to catch the enthusiast's blind spot, and nobody is more enthusiastic about a hypothesis than the person who swallowed it.

Where medicines law actually bites

To see why regulators almost never meet the lone biohacker, look at how medicines law defines its subject. In the United Kingdom a medicinal product is any substance presented as having properties for treating or preventing disease in human beings, or any substance used in or given to people to restore, correct or modify physiological functions, or to make a diagnosis 5. The first half of that definition is about presentation, meaning what is claimed. The machinery then built on it, including licensing, manufacturing authorisations, wholesale dealing, advertising controls and the rules on who may supply what, concerns products moving between people.

That design is deliberate. Medicines regulation grew out of disasters in which a manufacturer's product harmed people who had trusted a label, and its instruments are aimed at the manufacturer and the label. A regulator's natural targets are therefore the points where a substance changes hands with a claim attached: the seller, the advertiser, the premises and the professional. The lone self-experimenter, taking a substance of their own choosing on their own initiative, sits at the edge of that design rather than at its centre.

Case study: the clinic

The first 2026 collision came when self-experimentation became a service. In April the UK's Medicines and Healthcare products Regulatory Agency said it was investigating clinics offering experimental peptide injections, after a newspaper investigation found websites promoting them with claims about ageing and recovery from injury 6. The clinics' customers were, in effect, biohackers who preferred to outsource the process. The clinics themselves were something else: businesses supplying and administering substances to other people, with a promise attached.

That promise is what turned the question from a lifestyle matter into a regulatory one. Many of the products were described as research materials, and the regulator addressed that directly, saying it would disregard research-purpose claims where they were being used to try to avoid medicines regulation 6. Under the presentation limb of the definition, a clinic's web page describing what a peptide does for patients is precisely the kind of presentation that makes a product a medicine 5. The same molecule on a laboratory order form and on a clinic's treatment menu is, legally, two different things.

Case study: the pharmacy

The second collision took place in Pretoria, and it involved a legal category that is itself built around the individual. Compounding, the preparation of a medicine by a pharmacist for a named patient against a prescription, is the oldest thing pharmacy does, and South African law permits it within those limits. In May 2026, SAHPRA and the South African Pharmacy Council announced the result of a joint inspection of a pharmacy that had been producing GLP-1 and GIP medicines under the heading of compounding. The regulators found it manufacturing and marketing for broad commercial distribution, mainly for weight management. They seized all the injectable stock, ordered a recall, noted reports of adverse events including hospital admissions, and warned pharmacy staff that involvement in such supply risked removal from the professional register 7.

The logic mirrors the clinic case. Individual demand, one person wanting one thing for their own body, is exactly what the compounding exception is designed to serve. Aggregated and industrialised, that demand becomes something else, and the regulator's instruments come into range. The two case studies are really one observation made twice. The law meets the biohacker only at the point where the biohacker becomes a market.

Two people talking past each other

This explains why arguments between the two sides so rarely land. The biohacker frames the question as one of liberty: my body, my risk, my choice. The regulator frames it as one of products: what is being sold, by whom, with what claim, and made to what standard. Each is broadly right within their own frame, and each tends to hear the other as answering a question they did not ask. A regulator seizing a pharmacy's stock is not ruling on anyone's autonomy, and a person asserting their autonomy has not said anything about how the stock was made.

The historical heroes sit awkwardly in this argument, because they belong to neither side. Forssmann and Marshall were not rebels against institutions. They were insiders, with training, a hospital, a laboratory and a journal to answer to. Their dissent was aimed at a consensus, not at the idea of evidence, and what flowed out of their experiments was knowledge. What flows out of the contemporary version, when it scales, is mostly product, which is exactly the thing medicines law was built to govern.

The rigorous version already exists

There is a coda that neither side mentions much. Medicine has a formal, respectable version of the single-person experiment. In 1986 a group of clinical epidemiologists described the randomised trial in an individual patient, now usually called the n-of-1 trial. One person receives an intervention and a comparison in randomised, blinded periods, repeated until the pattern is clear or clearly absent, with outcomes decided in advance 8. It is designed for the patient who genuinely wants to know whether something works for them in particular, and it answers that question with a rigour a diary never can.

What it requires is everything the heroes had and the feed lacks: a prescriber, a licensed product or an approved protocol, a comparison, blinding, measurement, and someone independent reading the result. That is where a piece about culture has to stop, because the rest is methodology, meaning how periods are sequenced, how blinding is maintained and how a result from one person is analysed. It is worth knowing the design exists. The tradition the biohacker claims is real, and its rigorous modern form was built inside medicine rather than against it.