Connected Vehicles Rule to Disrupt Supply Chain and Impose Compliance Obligations

Key Points

• On January 16, 2025, BIS published a Final Rule titled “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles.” Once effective, this rulemaking will have a significant impact on the U.S. automotive supply chain and will impose compliance and diligence obligations on automotive manufacturers and suppliers of VCS hardware and software as well as ADS software.
• Absent any interventions by the Trump administration, the rule will become effective on March 17, 2025. In an Executive Order titled “America First Trade Policy,” President Trump directed the Secretary of Commerce to review the Final Rule and recommend “appropriate action,” including whether controls should be expanded. For updates on that and other Trump administration executive actions, please see Akin’s Trump Executive Order Tracker here.
• The Final Rule prohibits imports into the United States of VCS hardware and the import or sale of connected vehicles containing VCS or ADS software (“covered software”) where such VCS hardware or covered software is designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia.
• The rule also bans the sale of connected vehicles in the United States by connected vehicle manufacturers that are owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia. This prohibition applies regardless of whether the vehicle’s VCS hardware or covered software is itself tied to the PRC or Russia.
• From a compliance perspective, prior to the import of VCS hardware or import and/or sale of connected vehicles containing covered software, as applicable, VCS importers and connected vehicle manufacturers must submit Declarations of Conformity to Commerce certifying that the import or sale, as applicable, does not involve any VCS hardware or covered software designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia.
• Although the Final Rule will become effective on March 17, 2025, there will be a phase-in for the specific prohibitions beginning with Model Year 2027 in some cases. Specifically, the software-related prohibitions will take effect for Model Year 2027. The hardware-related prohibitions will take effect for Model Year 2030, or January 1, 2029, for VCS hardware units not associated with a model year. The prohibition on car sales by PRC or Russia-related manufacturers will apply to Model Year 2027 vehicles.
• Based on the far-reaching application of these new regulations, OEMs whose vehicles are sold in the United States and suppliers whose products are incorporated into vehicles that are sold in the United States must be aware of these new requirements and have plans in place to comply.

Background

On January 16, 2025, the Bureau of Industry and Security (BIS) published the Final Rule, prohibiting the import of “vehicle connectivity system” (VCS) hardware (including connected vehicles integrating that hardware) and the import or sale of connected vehicles that incorporate software related to vehicle connectivity or automated driving systems (ADS) where that hardware and/or software has a sufficient nexus to the People’s Republic of China (PRC) or Russia. The Final Rule will take effect on March 17, 2025, barring intervention from the Trump administration. In an Executive Order titled “America First Trade Policy,” President Trump directed the Secretary of Commerce to review the Final Rule and recommend “appropriate action,” including whether controls should be expanded.

The Final Rule follows an advance notice of proposed rulemaking (ANPRM) published in March 2024 and a notice of proposed rulemaking (NPRM) in September 2024. For additional background, please see our client alerts on the NPRM and the ANPRM.

The Final Rule marks a significant escalation in trade restrictions with respect to the PRC and Russia for the automotive industry. Commerce stated that it is very likely that all new vehicles sold in the U.S., with few exceptions, will be captured by its definition of “connected vehicles.” As a result, once effective, the regulations will have a significant impact on U.S. automotive supply chains and represents a substantial risk that certain imports and sales may be precluded altogether. The Final Rule imposes significant compliance and diligence obligations on automotive manufacturers and suppliers of VCS hardware and software as well as ADS software. These compliance obligations are subject to a tiered phase-in period, beginning with Model Year 2027 for certain prohibitions.

Prohibited Transactions

The framework of prohibitions remains the same in the Final Rule as in the NPRM. Specifically, the following transactions are prohibited absent an authorization:

• VCS hardware importers may not knowingly import into the United States VCS hardware that is designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia.
• Connected vehicle (CV) manufacturers may not knowingly import into the United States completed connected vehicles that incorporate covered software that is designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia.
• Connected vehicle manufacturers may not knowingly sell within the United States completed connected vehicles that incorporate covered software that is designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia.
• Connected vehicle manufacturers who are owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia may not knowingly sell in the United States completed connected vehicles that incorporate VCS hardware or covered software regardless of whether such VCS hardware or covered software is designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia.

Key Definitions

Although BIS kept several key definitions unchanged from the NPRM—e.g., ADS; foreign interest; and person owned by, controlled by or subject to the jurisdiction or direction of a foreign adversary—the following are the most significant revisions BIS made to key definitions in the Final Rule:

• Connected Vehicle – the definition now excludes vehicles with a gross vehicle weight rating of more than 4,536 kilograms or 10,000 pounds, which has the effect of excluding commercial vehicles from the scope of the regulations. BIS noted it may address commercial vehicles in a separate rule.
• Connected Vehicle Manufacturer – the definition now captures entities who purchase otherwise completed (and compliant) connected vehicles from a third party and then integrate their proprietary ADS on the vehicle to enable autonomous driving.
• Covered Software – the definition now clarifies that “software” includes application, middleware and systems software. Most significantly, BIS excluded from the definition software designed, developed, manufactured or supplied prior to March 17, 2026, which has the effect of creating a carve out for so-called “legacy” software.
• Vehicle Connectivity System – the definition now adds carve outs for an item that exclusively (1) enables the transmission, receipt, conversion or processing of automotive sensing (e.g., LiDAR, radar, video, ultrawideband); (2) enables the transmission, receipt, conversion or processing of ultrawideband communications to directly enable physical vehicle access (e.g., key fobs); (3) enables the receipt, conversion or processing of unidirectional radio frequency bands (e.g., global navigation satellite systems (GNSS), satellite radio, AM/FM radio); or (4) supplies or manages power for the VCS.

Declarations of Conformity

The Final Rule retains the requirement that VCS hardware importers and connected vehicle manufacturers submit annual Declarations of Conformity but made revisions aimed at streamlining compliance. Specifically, while entities will be required to certify to BIS that they have conducted due diligence in analyzing their VCS hardware and covered software supply chains and maintain documentation in support of this certification, BIS removed many document submission requirements, such as the requirement to submit Software Bill of Materials (SBOMs) and Hardware Bill of Materials (HBOMs), and will permit applicants to rely on certifications of conformity provided by their suppliers regarding individual components or parts. Entities must also certify that documentation supporting those third-party certifications can be made available to BIS upon request.

General Authorizations

Rather than include general authorizations as part of the regulations, thus requiring formal rulemaking to add to or amend existing general authorizations, BIS now intends to issue general authorizations via its public website and the Federal Register. As a result, the Final Rule removes the enumerated general authorizations included in the NPRM, though BIS noted that it intends to issue substantially similar general authorizations following publication of the Final Rule. If a transaction qualifies for a general authorization, VCS hardware importers and CV manufacturers would be allowed to proceed with the transaction without receiving specific authorization from BIS. Note that persons owned by, controlled by or subject to the jurisdiction or direction of the PRC or Russia are not eligible to rely on general authorizations, but instead must obtain specific authorizations to engage in the same set of activities.

Specific Authorizations

In the Final Rule, BIS modified the process for seeking specific authorizations, most notably requiring that BIS must issue a decision on applications within 90 days unless BIS determines additional time is needed. In addition, authorizations will be granted for no less than one model year or calendar year unless certain exceptions apply. Review of applications for specific authorizations will be done on a case-by-case basis. Applications must provide: the identities of the parties engaged in the transaction, including relevant corporate identifiers and information sufficient to identify the ultimate beneficial ownership of the transacting parties; an overview of the relevant VCS hardware or covered software; information on the make and model of the relevant vehicle; the intended function of the VCS hardware or covered software; supporting documentation; an assessment of the applicant’s ability to limit PRC/Russia government access to or influence over the relevant items; security standards; and any other actions or proposal to mitigate risk.

Phase Out/Exemptions

The Final Rule includes the following phase out periods/exemptions, which mirror the NPRM exemptions with one exception, called out in red below:

• Prior to January 1, 2029, VCS hardware importers may import VCS hardware units not associated with a vehicle model year.
• VCS hardware importers may import VCS hardware associated with a vehicle model year prior to 2030, that is imported as part of a connected vehicle with a model year prior to 2030, or the VCS hardware is imported for purposes of repair or warranty for a connected vehicle with a model year prior to 2030.
• CV manufacturers may import and sell in the United States completed CVs that incorporate covered software if the completed CV was manufactured prior to model year 2027.
• CV manufactures who are owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia may sell completed CVs in the United States that incorporate VCS hardware or covered software if the completed CV was manufactured prior to model year 2027.

In addition, as noted above, the definition of “covered software” excludes any software designed, developed, manufactured or supplied by persons owned by controlled by or subject to the jurisdiction or direction of the PRC or Russia prior to March 17, 2026. This effectively creates a one-year grace period for impacted stakeholders to relocate and restructure their software research and development operations to avoid application of the rule to software developed after that date.

“Is-Informed” Notices

The Final Rule retains the “Is-Informed” notice provision from the NPRM with no change. Specifically, BIS may inform VCS hardware importers or connected vehicle manufacturers either individually by specific notice or, for larger groups, through a separate notice published in the Federal Register, that a specific authorization is required because an activity could constitute a prohibited transaction. In that case, proceeding with the identified transaction(s) without first obtaining a specific authorization would be a violation of the regulations.

Advisory Opinions

The Final Rule retains the provisions allowing for submission of advisory opinions, largely as proposed in the NPRM. Revisions include the addition of a 60-day deadline for BIS to respond to advisory opinion requests unless BIS determines it needs additional time. BIS declined to allow advisory opinions for hypothetical scenarios, though clarified that advisory opinions could be submitted for proposed or prospective transactions.

Conclusion

The Final Rule requires that stakeholders in the connected vehicle supply chain conduct a diligent examination of the application of these new requirements to their activities. In some cases, this diligence will result in stakeholders needing to adjust supply chains or seek guidance or authorization from Commerce in order to continue ongoing sales involving the U.S. market. Furthermore, many affected stakeholders will need to establish new compliance processes and procedures to comply with these rules. It is incumbent upon connected vehicle stakeholders that sell into the U.S. market to carefully assess the implications of these requirements and plan accordingly to avoid violations of these new rules.