US Commerce Department Finalizes Rule on Connected Vehicles With Supply Chain Links to China and Russia

On January 16, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) issued a final rule (the “Final Rule”) addressing national security concerns regarding information and communications technology and services (“ICTS”) in connected vehicles. The Final Rule prohibits certain transactions involving hardware and software integrated into the Vehicle Connectivity System (“VCS”) and software integrated into the Automated Driving System (“ADS”) that are “designed, developed, manufactured, or supplied by” entities under the control or jurisdiction of “foreign adversaries,” namely China and Russia, without BIS authorisation. The Final Rule also precludes connected vehicle manufacturers that are owned, controlled by or subject to the jurisdiction or direction of China or Russia from selling connected vehicles in the United States without authorization if those vehicles incorporate any VCS hardware or Covered Software, regardless of whether there is any other nexus to either country.  

The Final Rule builds on an Executive Order initially adopted during the first Trump Administration (as discussed in our prior Legal Updates here and here) and an extensive public comment and rulemaking process (as discussed here and here).  Although it remains to be seen whether the second Trump Administration will maintain and enforce the Final Rule in current form, or seek to amend it, the rule is scheduled to go into effect on March 1, 2024.

The changes to the Proposed Rule are discussed in greater detail below.

Background

Following previous rulemaking identifying China and Russia as “foreign adversaries” and Executive Order 13973 authorizing the Secretary of Commerce to identify and address ICTS transactions involving foreign adversaries, the Final Rule discusses national security risks stemming from connected vehicle systems with vulnerabilities that could be exploited by malign foreign actors.

Regulated Systems and Related Definitions

In consideration of comments to the notice of proposed rulemaking, BIS has made several changes concerning the regulated systems and related definitions. Each will be discussed in turn.

• Automated Driving System (“ADS”). ADS includes the components that collectively allow a highly autonomous vehicle to operate without a driver. BIS did not make any changes to the proposed ADS definition based on comments. However, BIS stated that although it is declining, at this time, to explicitly reference SAE International’s J3016 standard in the ADS definition, it believes that the definition for ADS adequately covers only those systems that would fall into SAE categorization Level 3 and above.
• Vehicle Connectivity System (“VCS”). VCS includes the set of systems that allow the vehicle to communicate externally, including telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules. Commenters took issue with the Proposed Rule’s threshold of 450 MHz, arguing the cutoff is overly broad. In response, BIS amended the definition of VCS to include a variety of function-based exclusions to exclude certain low-risk use cases and provide industry with greater flexibility.
• Connected Vehicle. Recognizing the substantial compliance concerns associated with the complex commercial vehicle sector, BIS determined that commercial vehicle sector will not be covered by this Final Rule. Specifically, a connected vehicle with a gross vehicle weight rating of more than 4,536 kilograms (10,000 pounds) is not included in the definition of Connected Vehicle. BIS indicated that it intends to address commercial vehicles in a future rulemaking. BIS indicated that it intends to address commercial vehicles in a future rulemaking.
• Connected Vehicle Manufacturer. BIS modified the definition of a Connected Vehicle Manufacturer to clarify its intention to capture entities who purchase otherwise completed (and compliant) connected vehicles from a third party and then integrate their proprietary ADS on the vehicle to enable autonomous driving.
• Covered Software. Based on comments to the Proposed Rule, BIS changed its definition of Covered Software to better align with industry practices. More concretely:
  1. BIS acknowledged the burden of determining the origin of software subcomponents for legacy code bases and therefore added an exclusion for code that was designed, developed, manufactured, or supplied before March 17, 2026, as long as those software subcomponents are not maintained, augmented, or otherwise altered by an entity owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary after March 17, 2026. [TS1][EK2]
  2. BIS added specificity to the covered software definition to explicitly include application, middleware, and system software, while continuing to exclude firmware. BIS also provided examples to clarify what constitutes application, middleware, and systems software in the Final Rule.
  3. BIS clarified that if only one software subcomponent of an ADS software suite is designed, developed, manufactured, or supplied by a Chinese or Russian entity, then the entire ADS software suite would be considered designed, developed, manufactured, or supplied by a foreign adversary entity.
• Person owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary. BIS has retained the definition from the Proposed Rule. However, it provided several examples on how to apply this definition. Notably, BIS emphasizes that VCS hardware and covered software would not be considered designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia based solely on the country of citizenship of one or more natural persons who are employed by, contracted by, or otherwise similarly engaged in such actions through the entity designing, developing, manufacturing, or supplying the VCS hardware or covered software. In particular, BIS confirms that visa holders in the United States would not be considered persons controlled by China or Russia solely based on their citizenship.
• VCS Hardware. BIS clarified that VCS hardware includes aftermarket devices not contained in a completed connected vehicle at sale but that are later integrated into the vehicle to perform VCS functions. Conversely, VCS hardware does not include aftermarket devices whose primary function is not to enable vehicle connectivity.
• VCS Hardware Importer. Commenters highlighted that the Proposed Rule’s broad definition of both VCS Hardware and VCS Hardware Importer would capture the import of components whose primary use is not automotive and thus cause severe ancillary effects on other industries. In response, BIS clarified the definition of VCS hardware importer to include only those entities who are importing VCS hardware components that are for use in completed connected vehicles, or that are already incorporated in a connected vehicle (incomplete or completed).

Prohibited Transactions

The Final Rule largely retains these same prohibitions as the Proposed Rule, but in response to comments, BIS added several examples to provide more clarity for the scope of transactions that fall under the rule. These prohibitions (collectively, “Prohibited Transactions”), absent a general or specific authorization otherwise, prohibit:

1. VCS Hardware Importers from knowingly importing into the United States certain hardware for VCS, when such VCS hardware is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia,
2. connected vehicle manufacturers from knowingly importing into the United States completed connected vehicles incorporating Covered Software, when such Covered Software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia,
3. connected vehicle manufacturers from knowingly selling within the United States completed connected vehicles that incorporate covered software, when such Covered Software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia, and
4. prohibits connected vehicle manufacturers who are persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia from knowingly selling in the United States completed connected vehicles that incorporate VCS hardware or Covered Software, regardless of whether such VCS hardware or Covered Software is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia.

Commenters requested that BIS provide clearer guidance on what constitutes a Prohibited Transaction, notably (1) to demonstrate the difference between “design” and “develop” (relevant to both the VCS hardware and the Covered Software prohibitions) and (2) to narrow the scope of the entity responsible for the “design” or “development” of the item when multiple entities are involved in its creation. BIS acknowledged the need for clearer guidance and therefore included new examples to clarify the scope of “design and develop” and the entities responsible.

Compliance Mechanisms

The Final Rule also largely retains the Proposed Rule’s three primary compliance mechanisms with limited changes.

• Declarations of Conformity. After considering public comments, BIS restructured the Declarations of Conformity requirement to clarify the certification, narrow the reporting requirements, and add recordkeeping elements. BIS also extended the timeline for submitting updates to a Declaration of Conformity from 30 to 60 days.

Additionally, BIS introduced an exemption for the submission of Declarations of Conformity for those transactions where the only foreign interest in the product arises from a foreign entity’s equity ownership in a U.S. person.

• General Authorizations. In the Final Rule, BIS amended the provision to allow BIS to issue general authorizations on its website and in the Federal Register, rather than provide for predetermined general authorizations in the rule as it proposed in the Proposed Rule. BIS noted that it anticipates issuing a set of general authorizations shortly after publication of this rule that align with the general authorizations outlined in the Proposed Rule, including general authorizations for small businesses; for connected vehicles used infrequently on public roads; for display, testing, or research purposes; and for repair, alteration, or competition.
• Specific Authorizations. BIS amended the Final Rule to allow for the ability to grant exceptions to the default minimum one-year specific authorization and for durations of less than one year. These exceptions are in response to: (1) 2027 Model Years that include covered software and are actively being sold or imported as of the effective date of this rule; (2) force majeure events, (3) as a result of a corporate merger, investment, acquisition, joint venture, or conversion of equity (such as from debt) that occurs during model year production; (4) as a result of the closure or relocation of facilities involved in the production of covered software or VCS hardware; and (5) other instances as determined by BIS.

Exemptions

In the Proposed Rule, BIS delineated several exemptions. The Final Rule maintains this existing list of exemptions while adding a specific exemption for parts that are imported for purposes of warranty or repair of a completed connected vehicle with a model year prior to 2030.

BIS also noted that it understands that the implementation dates for the rule may fall mid-generation for many connected vehicle manufacturers. In such situations, BIS will consider issuing a time-bound specific authorization in cases where connected vehicle manufacturers are able to demonstrate that they are moving into compliance with the rule for the next vehicle generation refresh.

Advisory Opinions, Is-Informed Notices, and Appeals

Appeals. In response to comments, BIS included a provision that allows third parties to submit amicus filings in support of parties undergoing an informal appeals hearing if, for example, their technology is the subject of the appeal. BIS also specified that 45 days is the reasonable amount of time to file an appeal. BIS also included language in the Final Rule that further clarifies the appeals process.

Advisory Opinions. The Final Rule implements a 60-day deadline for advisory opinion requests unless BIS determines that additional time is needed. BIS emphasized that the timely issuance of an advisory opinion will depend upon prompt responses by the requester in the event that BIS requests additional documents or information to inform the advisory opinion.

Is-Informed Notices. BIS received no comments on the proposed “Is-Informed” notice provision and retains the same “Is-Informed” notice provision for the Final Rule.

Recordkeeping and Reporting

In the Final Rule, BIS no longer requires submission of Software Bill of Materials (“SBOMs”) and Hardware Bill of Materials (“HBOMs”), mitigating concerns about the retention of Confidential Business Information (“CBI”) and complexity of reporting requirements.

Phased Timeline

As with the Proposed Rule, in the Final Rule the software-related prohibitions will take effect for Model Year 2027. The hardware-related prohibitions will take effect for Model Year 2030, or January 1, 2029, for units without a model year. Prohibitions on the sale of connected vehicles by manufacturers with a sufficient nexus to China or Russia, even if manufactured in the United States, take effect for Model Year 2027.

Effective Date

The Final Rule will be effective March 17, 2025

Takeaways

Highlighting a fundamental shift in U.S. automotive supply chain oversight, these regulations call for heightened attention and proactive compliance from all relevant industry participants. With its broad reach and likely long-term effects, this Final Rule will profoundly impact the connected vehicle industry, compelling VCS hardware importers and manufacturers to reassess and potentially overhaul their supply chains.

To the extent a company’s software design, development, manufacture, and supply activities support the relevant systems, hardware or software (namely, VCS Hardware or Software, or ADS software), that company should anticipate that its automotive customers will need to understand the extent to which there is any nexus to China or Russia in connection with those design, development, manufacture, and supply activities in connection with their supply chain.  

Affected businesses are encouraged to review the Final Rule closely and consider the associated impacts, including authorization requirements.