Commerce Issues Proposed ICTS Regulations That Would Disrupt Connected Vehicle Supply Chains Involving China and Russia

Key Points

• On September 26, 2024, using its Information and Communications Technology and Services (ICTS) supply chain authority, Commerce published a proposed set of regulations targeting the automotive sector that would prohibit certain transactions involving “connected vehicles” and certain types of connected vehicle hardware or software items tied to China or Russia. Comments are due on October 28, 2024, with a possible effective date as early as the end of 2024.
• As drafted, the regulations would categorically prohibit imports into the United States of vehicle connectivity system hardware and connected vehicles containing “covered software” where such vehicle connectivity system hardware or covered software is designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of China or Russia. The proposed rule would also prohibit the sale in the United States of connected vehicles containing such covered software.
• Significantly, Chinese and Russian carmakers, as well as their subsidiaries, would be prohibited from selling connected vehicles in the United States beginning with model year 2027.
• The proposed rule contemplates phase-in periods for these prohibitions based on vehicle model year and date of import. It also establishes a process to qualify for general authorizations, pursue specific authorizations and seek advisory opinions from Commerce.
• From a compliance perspective, connected vehicle manufacturers and Tier 1 and Tier 2 suppliers of connected vehicle items would be required to annually certify to Commerce that they are in compliance with these rules.
• On a broader note, this is the first time Commerce has used its ICTS authority to target an entire sector and forecasts Commerce’s intent to address ICTS risks on a sector-by-sector basis in the future.

Overview

On September 26, 2024, the Office of Information Communications Technology Services (OICTS) within the Bureau of Industry and Security of the U.S. Department of Commerce published a long-awaited proposed rule to regulate the import and sale of certain “connected vehicles” (CVs) and associated hardware and software: “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles” (“the proposed rule”). The proposed rule follows the related advance notice of proposed rulemaking (ANPRM) issued in March 2024, which provided a preview of the central components of the proposed rule. For additional background, please see our client alert on the ANPRM here.

The proposed rule marks a significant escalation in trade restrictions with respect to China and Russia for the automotive industry. In the proposed rule, Commerce stated that it is very likely that all new vehicles sold in the United States, with few exceptions, will be captured by its definition of “connected vehicles.” As a result, once effective, the regulations will have a significant impact on U.S. automotive supply chains and represents a substantial risk that certain imports and sales may be precluded altogether.  The proposed rule would also impose significant compliance and diligence obligations on automotive manufacturers and Tier 1 and Tier 2 suppliers of Vehicle Connectivity System (VCS) hardware and software as well as Automated Driving System (ADS) software. These compliance obligations are subject to a tiered phase-in period, beginning with model year 2027 for certain prohibitions.

Comments are due on October 28, 2024. Following its review of those comments, Commerce will issue a final rule, with an effective date 30 or 60 days thereafter. It remains possible that Commerce could issue a final rule that becomes effective prior to the end of 2024.

Prohibited Transactions

The following transactions would be prohibited absent a general or specific authorization from Commerce:

1. The import of VCS hardware into the United States that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. This includes the import of VCS hardware in completed CVs. This prohibition would become effective starting with model year 2030 or January 1, 2029 for VCS hardware not associated with a model year.
2. The import or sale of “completed” CVs in the United States that contain VCS software or ADS software (collectively referred to in the proposed rule as “covered software”) that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. This prohibition would become effective starting with model year 2027.
3. The sale of completed CVs that incorporate any VCS hardware or covered software by CV manufacturers that are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. This prohibition would also become effective starting with model year 2027.

Key Definitions

What are “connected vehicles” or “CVs”?

• CV means any vehicle driven or drawn by mechanical power and manufactured primarily for use on public streets, roads and highways, that integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication, cellular telecommunications connectivity, satellite communication or other wireless spectrum connectivity with any other network or device.
• As it noted in the proposed rule, Commerce believes, with very few exceptions, all new vehicles sold in the United States will be captured by this definition.

What specific CV systems does the proposed rule target?

• The proposed rule focuses on VCS hardware and software and ADS software, which Commerce describes as the CV systems that “most directly facilitate the transmission of data both into and from the vehicle.” Commerce ultimately chose to narrow the scope of the CV regulations, initially considering including vehicle operating systems (OS), telematics systems, Advanced Driver-Assistance Systems (ADAS), satellite or cellular telecommunications systems, and battery management systems (BMS) within scope under the ANPRM.
• VCS means a hardware or software item for a completed CV that has the function of enabling the transmission, receipt, conversion or processing of radio frequency communications at a frequency over 450 megahertz.
• ADS means hardware and software that, collectively, are capable of performing the entire dynamic driving task for a completed connected vehicle on a sustained basis, regardless of whether it is limited to a specific operational design domain (ODD). This definition corresponds to automation Levels 3, 4 and 5 as defined by SAE International standard J3016.¹
• “VCS hardware” means the following software-enabled or programmable components and subcomponents that support the function of Vehicle Connectivity Systems or are part of an item that supports the function of Vehicle Connectivity Systems: microcontroller, microcomputers or modules, systems on a chip, networking or telematics units, cellular modem/modules, Wi-Fi microcontrollers or modules, Bluetooth microcontrollers or modules, satellite navigation systems, satellite communication systems, other wireless communication microcontrollers or modules, and external antennas.
  • VCS hardware does not include component parts that do not contribute to the communication function of VCS hardware (e.g., brackets, fasteners, plastics and passive electronics).

• “VCS software” means the software-based components, in which there is a foreign interest, executed by the primary processing unit of the respective systems that are part of an item that supports the function of Vehicle Connectivity Systems at the vehicle level.
  • VCS software does not include firmware, i.e., “software specifically programmed for a hardware device with a primary purpose of controlling, configuring, and communicating with that hardware device” or open-source software.

• “ADS software” means the software-based components, in which there is a foreign interest, executed by the primary processing unit of the respective systems that are part of an item that supports the function of ADS at the vehicle level.
  • Like VCS software, ADS software does not include firmware or open-source software.

What does it mean to be a person “owned by, controlled by, or subject to the jurisdiction or direction” of China or Russia?

This definition includes the following individuals and entities:

1. Chinese or Russian government entities or agents: Any person, wherever located, who acts as an agent, representative, or employee, or any person who acts in any other capacity at the order, request, or under the direction or control, of a foreign adversary or of a person whose activities are directly or indirectly supervised, directed, controlled, financed, or subsidized in whole or in majority part by a foreign adversary.
2. Chinese or Russian citizens or residents: Any person, wherever located, who is a citizen or resident of a foreign adversary or a country controlled by a foreign adversary, and is not a United States citizen or permanent resident of the United States.
3. Entities organized or having a principal place of business in China or Russia: Any corporation, partnership, association, or other organization with a principal place of business in, headquartered in, incorporated in, or otherwise organized under the laws of a foreign adversary or a country controlled by a foreign adversary.
4. Entities owned or controlled by the Chinese or Russian government, Chinese or Russian citizens, or Chinese or Russian entities: Any corporation, partnership, association, or other organization, wherever organized or doing business, that is owned or controlled by a foreign adversary, to include circumstances in which any person identified in the foregoing categories possesses the power, direct or indirect, whether or not exercised, through the ownership of a majority or a dominant minority of the total outstanding voting interest in an entity, board representation, proxy voting, a special share, contractual arrangements, formal or informal arrangements to act in concert, or other means, to determine, direct, or decide important matters affecting an entity.

Accordingly, even U.S. or third-country subsidiaries of Chinese or Russian original equipment manufacturers (OEMs) are covered by the proposed rule. Such companies will be subject to the prohibition on the sale of any CV in the United States beginning with model year 2027.

New Compliance Obligations

Even automotive manufacturers and Tier 1 and 2 suppliers who are not engaged in any of the identified prohibited transactions would be required to annually certify to Commerce that they have not engaged in a prohibited transaction. Specifically, prior to importing any VCS hardware or completed CVs containing VCS hardware or covered software into the United States or selling any completed CV in the United States, VCS hardware importers and CV manufacturers must submit “declarations of conformity” to Commerce.

What information must Declarations of Conformity contain?

• Prior to engaging in the relevant transaction, and at least once per calendar year or model year (or whenever material changes occur), the importer or CV manufacturer must submit Declarations of Conformity to Commerce containing the following information, as applicable:
  • Identifying information of the importer or CV manufacturer
  • FCC ID number(s) of the VCS hardware, and, if applicable, any subcomponents in the VCS hardware that also have an FCC ID number
  • A list of third-party external endpoints to which the VCS hardware connects, including the country where each endpoint is located and/or the identity and location of the service provider
  • Make, model, trim and Vehicle Identification Number (VIN) series applicable to the completed CVs
  • Software bill of materials (SBOM) or hardware bill of materials (HBOM)
  • Documentation of due diligence efforts
  • A certification that the submitter has not knowingly engaged in any prohibited transaction.

The proposed rule also establishes an advisory opinion process that will enable VCS hardware importers and CV manufacturers to obtain guidance from Commerce on whether a prospective transaction may be prohibited. An advisory opinion request must relate to an actual (as opposed to hypothetical) transaction and must disclose the identities of the parties to the transaction.

General and Specific Authorizations

For transactions that would be prohibited, the proposed rule establishes a process to exempt certain transactions based on general authorizations issued by Commerce or specific authorizations granted by Commerce regarding specific transactions.

General Authorizations

If a transaction qualifies for a general authorization, VCS hardware importers and CV manufacturers would be allowed to proceed with the transaction without receiving specific authorization from Commerce, though they would be subject to audit and inspection by Commerce and would be required to maintain relevant records for a period of 10 years.

The proposed rule would allow the following types of otherwise prohibited transactions subject to a self-certified general authorization: (i) the importer/manufacturer produces less than 1,000 units in total model year production; (ii) the completed CV is used for fewer than 30 days on public roadways; (iii) the completed CV is used solely for display, testing or research and will not be used on public roadways; and (iv) the completed CV is imported solely for repair, alteration or competition off public roads, and will be re-exported within one year of import.

Specific Authorizations

The proposed rule would also establish a process for companies to apply for and obtain specific authorizations for otherwise prohibited transactions not covered by a general authorization. Commerce would require applications to include (among other things) information on the parties to the transaction, the VCS hardware or covered software at issue, and details as to how the applicant intends to mitigate any undue or unacceptable risk the transaction may pose to U.S. national security. Although Commerce declined to adopt specific cybersecurity standards or best practices as part of the proposed rule, these may be considered as part of the specific authorization process.

Commerce would review applications on a case-by-case basis and may impose certain requirements and mitigation measures as a condition to granting a specific authorization. Companies receiving a specific authorization would be required to maintain relevant records for a period of 10 years.

Conclusion

Commerce’s ICTS CV regulations are expected to have a substantial impact on the global automotive supply chain. The regulations also impose significant supply chain diligence requirements on automakers and suppliers selling into the U.S. market. As drafted, the proposed rule threatens to exclude any Chinese or Russian OEMs—including any carmakers that are subsidiaries of Chinese and Russian carmakers—from selling any new vehicles in the United States beginning with model year 2027.

Given the considerable disruption to the U.S. automotive market and to the supply chains and business operations of connected vehicle manufacturers and their suppliers more broadly, we strongly recommend affected stakeholders consider submitting comments to Commerce. In addition, once effective, affected stakeholders should consider utilizing the advisory opinion process to obtain clarity on whether a proposed transaction is prohibited under the regulations.

Finally, as noted, this set of categorical ICTS restrictions represents a significant development in how OICTS intends to exercise its ICTS supply chain authority and suggests that they are moving away from a approach targeting specific companies in favor of sector-wide applications that, if applied to additional ICTS sectors, could have a material impact on such ICTS sectors moving forward.

^{1 (i) Level 3 “Conditional Driving Automation”: vehicles perform dynamic driving tasks autonomously but still require human driver Fallback within a defined ODD.}

^{(ii)  Level 4 “High Driving Automation”: vehicles can maintain sustained performance throughout the entire DDT (dynamic driving task) and Fallback within a defined ODD.}

^{(iii) Level 5 “Full Driving Automation”: fully autonomous vehicles capable of handling all driving tasks under all conditions with no human involvement, or in other words, unlimited ODD.}