The Bureau of Industry and Security has issued a final rule that will ban the importation or sale of connected vehicles integrating specific pieces of hardware and software, or those components sold separately, with a sufficient nexus to China (including Hong Kong or Macau) or Russia. This rule also prohibits manufacturers with a sufficient nexus to China or Russia from selling such vehicles in the U.S. even if they are made in the U.S.
While today’s vehicles contain a myriad of connected components that provide greater convenience for consumers and increase road safety, BIS states, the incorporation of progressively more complex hardware and software systems that facilitate these features has also increased the means by which malign actors may exploit vulnerabilities to gain access to a vehicle. BIS has determined that China and Russia pose particular risks in this respect because of their legal, political, and regulatory regimes as well as their current and anticipated growth and involvement in the connected vehicles sector.
According to BIS, the final rule focuses on (1) hardware and software integrated into the vehicle connectivity system, which is the set of systems that allow the vehicle to communicate externally, including telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules, and (2) software integrated into the automated driving system, which includes the components that collectively allow a highly autonomous vehicle to operate without a driver behind the wheel.
Specifically, this rule (1) prohibits VCS hardware importers from knowingly importing certain hardware for VCS, (2) prohibits connected vehicle manufacturers from knowingly importing completed connected vehicles incorporating covered software, and (3) prohibits connected vehicle manufacturers from knowingly selling within the U.S. completed connected vehicles that incorporate covered software. These prohibitions will apply when such VCS hardware or covered software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. The rule also prohibits connected vehicle manufacturers who are persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia from knowingly selling in the U.S. completed connected vehicles that incorporate VCS hardware or covered software.
BIS states that this rule will apply only to passenger vehicles (defined as those under 10,001 pounds). The prohibitions on software will take effect for model year 2027 and the prohibitions on hardware will take effect for model year 2030, or Jan. 1, 2029, for units without a model year. BIS anticipates issuing “in the near future” a separate rulemaking addressing the technologies present in connected commercial vehicles like trucks and buses.
BIS is also implementing several mechanisms to facilitate compliance with this rule: (1) requiring the annual submission of declarations of conformity certifying compliance, (2) allowing BIS to issue general authorizations for certain types of transactions posing lower risk, and (3) allowing regulated parties to seek specific authorizations to engage in otherwise prohibited transactions and BIS advisory opinions on whether a prospective transaction may be prohibited.
Copyright © 2025 Sandler, Travis & Rosenberg, P.A.; WorldTrade Interactive, Inc. All rights reserved.