The Bureau of Industry and Security is accepting comments through Oct. 28 on a proposed rule that would prohibit the importation or sale of connected vehicles integrating specific pieces of hardware and software, or those components sold separately, with a sufficient nexus to China or Russia. The rule would also prohibit manufacturers with a nexus to China or Russia from selling such vehicles in the U.S. even if they are made in the U.S.
While today’s vehicles contain a myriad of connected components that provide greater convenience for consumers and increase road safety, BIS states, the incorporation of progressively more complex hardware and software systems that facilitate these features has also increased the means by which malign actors may exploit vulnerabilities to gain access to a vehicle. BIS has determined that China and Russia pose particular risks in this respect because of their legal, political, and regulatory regimes as well as their current and anticipated growth and involvement in the automotive sector (although comments may be submitted on whether other foreign adversaries pose similar risks).
According to BIS, the proposed rule focuses on (1) hardware and software integrated into the vehicle connectivity system, which is the set of systems that allow the vehicle to communicate externally, including telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules, and (2) software integrated into the automated driving system, which includes the components that collectively allow a highly autonomous vehicle to operate without a driver behind the wheel.
Specifically, this rule would (1) prohibit VCS hardware importers from knowingly importing certain hardware for VCS, (2) prohibit connected vehicle manufacturers from knowingly importing completed connected vehicles incorporating certain software that supports the function of VCS or ADS, (3) prohibit connected vehicle manufacturers from knowingly selling within the U.S. completed connected vehicles that incorporate covered software, and (4) prohibit connected vehicle manufacturers that are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia from knowingly selling in the U.S. completed connected vehicles that incorporate VCS hardware or covered software. These prohibitions would apply when such VCS hardware or covered software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia.
The rule would apply to all wheeled on-road vehicles, such as cars, trucks, and buses, but would exclude vehicles not used on public roads like agricultural or mining vehicles. The prohibitions on software would take effect for model year 2027 and the prohibitions on hardware would take effect for model year 2030, or Jan. 1, 2029 for units without a model year.
BIS is also proposing to implement several mechanisms to facilitate compliance with these prohibitions by VCS hardware importers and connected vehicle manufacturers: (1) declarations of conformity confirming that they are not engaging in prohibited transactions, (2) advisory opinions to allow them to seek guidance from BIS on whether a prospective transaction may be prohibited, (3) general authorizations allowing them to engage in otherwise prohibited transactions without the need to notify BIS beforehand if certain conditions are met, (4) specific authorizations that grant them the ability to engage in otherwise prohibited transactions, including because the associated undue or unacceptable risks have been, or can be, mitigated, and (5) a process to inform them that a specific authorization may be required because an activity could constitute a prohibited transaction.
Copyright © 2025 Sandler, Travis & Rosenberg, P.A.; WorldTrade Interactive, Inc. All rights reserved.