Commerce Department Proposes Controls on Connected Vehicles and Components with Links to China and Russia

On September 26, 2024, the US Department of Commerce’s Bureau of Industry and Security (BIS) Office of Information and Communications Technology and Services (OICTS) published a notice of proposed rulemaking (the “Proposed Rule”) titled “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles.”

The Proposed Rule builds on the advance notice of proposed rulemaking (ANPRM) released on March 1, 2024, and focuses on vehicle connectivity system (VCS) hardware as well as VCS and Automated Driving Systems (ADS) software in which there is a foreign interest (“Covered Software”) and that are “designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction” of the People’s Republic of China (China) and Russia. The Proposed Rule also precludes connected vehicle manufacturers that are owned or controlled by or subject to the jurisdiction or direction of China and Russia from selling in the United States completed connected vehicles that incorporate VCS hardware or Covered Software, regardless of their origin.

The proposed prohibitions and compliance obligations related to VCS hardware, Covered Software, and completed connected vehicles incorporating the hardware and software, and the phased-in implementation plan are discussed in greater detail below. Highly anticipated, the proposed rule is likely to have a significant effect in the US automotive sector’s supply and distribution chains for years to come.

Background

Following previous rulemaking identifying China and Russia as “foreign adversaries” and Executive Order 13973 authorizing the Secretary of Commerce to identify and address information and communications technology and services (ICTS) transactions involving foreign adversaries, the March ANPRM (discussed in our Legal Update), identified national security risks stemming from connected vehicle systems with vulnerabilities that could be exploited by malign foreign actors. The Proposed Rule focuses on China and Russia, noting these countries’ ability to “leverage domestic legislation and regulatory regimes to compel companies subject to their jurisdiction, including carmakers and their suppliers, to cooperate with security and intelligence services.”

Prohibitions

To address the national security concerns previously identified by BIS,¹ the Proposed Rule prohibits three categories of activity (collectively, the “Prohibited Transactions”) involving VCS hardware² or Covered Software:³

• VCS hardware importers are prohibited from knowingly importing VCS hardware that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China⁴ or Russia. BIS notes that the country of citizenship of natural persons who are employed, contracted, or otherwise similarly engaged to participate in the design, development, manufacture, or supply of the VCS hardware will not independently cause a VCS hardware transaction to be prohibited.
• Connected vehicle manufacturers are prohibited from knowingly importing into or selling in the United States completed connected vehicles that incorporate Covered Software that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. Like the prohibition, the citizenship of Covered Software developers will not independently cause a Covered Software transaction to be prohibited.
• Finally, connected vehicle manufacturers that are persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia are prohibited from knowingly selling in the United States completed connected vehicles that incorporate VCS hardware or Covered Software, regardless of origin.

Violations of these prohibitions entail significant civil penalties as well as criminal penalties, including imprisonment, depending on the facts and circumstances.

BIS has clarified that “connected vehicle” applies only to road vehicles (e.g., passenger vehicles, motorcycles, buses, small and medium trucks, class 8 commercial trucks, recreational vehicles), not rail vehicles or unmanned aerial vehicles. BIS anticipates that, based on industry trends, nearly all new vehicles sold in the United States will be captured by “connected vehicle.” Furthermore, VCS hardware and software are only covered when they enable transmission, receipt, conversion, or processing of radio frequency communications at a frequency over 450 megahertz (which excludes those ICTS that pose a lower risk, such as electronic key fobs or tire pressure monitoring systems).

Phased Implementation

BIS officials are reportedly hoping to finalize the rule as early as January 2025, although the timing remains uncertain. BIS will consider comments filed through the end of the comment period and publish any final rule in the Federal Register. If adopted, the final rule would take effect 60 days after publication in the Federal Register, and BIS currently intends to phase-in implementation of the various compliance obligations described below as follows:

• Connected vehicles incorporating Covered Software may be imported into and sold in the United States so long as the connected vehicle was manufactured prior to Model Year 2027.
• Connected vehicle manufacturers that are owned or controlled by or subject to the jurisdiction or direction of China or Russia may sell connected vehicles that incorporate VCS hardware or Covered Software in the United States so long as the connected vehicle was manufactured prior to Model Year 2027.
• VCS hardware not associated with a vehicle model year may be imported prior to January 1, 2029.
• VCS hardware associated with a vehicle model year or integrated into a connected vehicle may also be imported so long as the vehicle model year is prior to 2030.

Chinese or Russian Ownership, Control, Jurisdiction, or Direction

For purposes of these prohibitions, persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia is very broadly defined to include:

• Any person, regardless of location, acting as an agent, representative, or employee or in any other capacity at the order, request, or under the direction or control of China or Russia or of a person whose activities are directly or indirectly supervised, directed, controlled, financed, or subsidized in whole or in majority part by China or Russia.
• Citizens or residents of China or Russia or of a country controlled by China or Russia who are not US citizens or permanent residents.
• Entities with a principal place of business in, headquartered in, or incorporated or organized under the laws of China or Russia or of a country controlled by China or Russia.
• Entities, wherever organized or doing business, that are owned or controlled by China or Russia. This includes when any of the persons listed above that possess the power—direct or indirect; whether or not exercised; and through majority ownership or dominant minority, board representation, proxy voting, special shares, contractual arrangement, or other formal or informal arrangements—to determine, direct, or decide important matters affecting the entity.

Compliance Requirements and Mechanisms

BIS proposes a number of mechanisms for compliance with those prohibitions:

• Declarations of Conformity: Under the Proposed Rule, Declarations of Conformity would be submitted annually to BIS by VCS hardware importers and connected vehicle manufacturers to confirm that they have not engaged in Prohibited Transactions. BIS believes this requirement will help ensure that importers and manufacturers covered by the Proposed Rule implement the due diligence and other procedures necessary to identify Chinese and Russian links in their supply chains and thus comply with the relevant prohibitions.
• General Authorizations: BIS proposes certain limited categories of general authorization for otherwise prohibited activities. These include general authorizations for certain small businesses (those with a total production of completed connected vehicles containing Covered Software or total production of VCS hardware numbering fewer than 1,000 units in a calendar year) as well as for companies engaged in certain limited testing, R&D, and display activities with respect to the completed connected vehicle.
• Parties using a general authorization would not need to notify BIS but would be responsible for ensuring that their activities do not exceed the scope of the general authorizations.
• Specific Authorizations: For parties interested in Prohibited Transactions not covered by a general authorization, a specific authorization from BIS would be required before they could proceed. The authorizations would only be available “in circumstances where BIS determines, based on the information submitted by the applicant and other collected information, that the otherwise Prohibited Transaction does not present an undue or unacceptable risk to U.S. national security.” Not unlike other BIS export control licensing processes, as a condition of approval, BIS might impose certain requirements and mitigation measures on the VCS hardware importers and connected vehicles manufacturers seeking to proceed with the Prohibited Transaction.

BIS also proposes two processes to assist potentially impacted parties:

• Advisory Opinions: In line with broader BIS procedures, VCS hardware importers and connected vehicle manufacturers would be able to seek guidance from BIS on whether a prospective transaction may be prohibited.
• “Is-Informed” Notification Process: The Proposed Rule includes a mechanism to inform VCS hardware importers and connected vehicle manufacturers that a specific authorization may be required because an activity could constitute a Prohibited Transaction.

Takeaways

The scope and potential industry impacts of the Proposed Rule are considerable and will shape the connected vehicle industry for years to come. If adopted, the Proposed Rule will force VCS hardware importers and connected vehicle manufacturers to closely scrutinize and, as necessary, rearrange their supply chains.

These efforts will likely spill over well beyond VCS hardware and Covered Software and into other automotive parts, putting them at risk of further rulemaking. Implementation of the Proposed Rule may also result in commercial litigation related to long-term supply agreements (including those in place for Covered Software or hardware or vehicles containing them) as a result of these restrictions and the relatively short compliance timeline.

Affected parties are strongly encouraged to carefully review the Proposed Rule and consider business impacts, including future requirements to seek authorizations.

BIS is seeking comments from interested parties through October 28, 2024.

¹ The Proposed Rule defines a “connected vehicle” as an on-road vehicle that “integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication, cellular telecommunications connectivity, satellite communication, or other wireless spectrum connectivity with any other network or device.”

² The Proposed Rule defines “VCS hardware” as “the following software-enabled or programmable components and subcomponents that support the function of Vehicle Connectivity Systems or are part of an item that supports the function of Vehicle Connectivity Systems: microcontroller, microcomputers or modules, systems on a chip, networking or telematics units, cellular modem/modules, Wi-Fi microcontrollers or modules, Bluetooth microcontrollers or modules, satellite navigation systems, satellite communication systems, other wireless communication microcontrollers or modules, and external antennas. VCS hardware does not include component parts that do not contribute to the communication function of VCS hardware (e.g., brackets, fasteners, plastics,
and passive electronics).”

³ The Proposed Rule defines “covered software” as “the software-based components, in which there is a foreign interest [emphasis added], executed by the primary processing unit of the respective systems that are part of an item that supports the function of Vehicle Connectivity Systems or Automated Driving Systems at the vehicle level. Covered software does not include firmware, which is characterized as software specifically programmed for a hardware device with a primary purpose of controlling, configuring, and communicating with that hardware device. Covered software also does not include open-source software that can be freely used, modified, and distributed by anyone, with both access to the source code and the ability to contribute to the software's development and improvement unless that open-source software has been modified for proprietary purposes and not redistributed or shared.” In turn, “foreign interest” for these purposes is defined as “any interest in property of any nature whatsoever, whether direct or indirect, by a non-US Person.” This would include, without limitation, any interest through ownership, intellectual property, contract, profit-sharing, or fee arrangement, as well as any other cognizable interest.

⁴ Including the Hong Kong Special Administrative Region.