Connected Vehicles

Overview

On January 14, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) released a rule prohibiting specific transactions involving the import or sale of connected vehicles and certain hardware and software with a sufficient nexus to the People’s Republic of China (PRC) or Russian Federation (Russia).

BIS has found that the provision of connected vehicles by PRC or Russian companies poses an unacceptable risk to the safety and security of the U.S. population. BIS has also identified the provision of connectivity hardware and software as well as autonomous driving software by PRC and Russian companies as a threat to U.S. national security.

Both the PRC and Russia have strict legal regimes that require companies to cooperate with their state intelligence and security services. This means that an automaker or a part supplier from the PRC or Russia could be forced to turn over sensitive data or even allow these governments to remotely access U.S. vehicles. BIS has issued this rule so that the connected vehicle industry in the United States can properly manage this risk.

In addition to restricting the import and sale of certain finished vehicles, the rule also places restrictions on two systems: Vehicle Connectivity Systems (VCS) and Automated Driving Systems (ADS). For this rule, VCS is all of the hardware components and software in a vehicle that allow it to communicate offboard. ADS is the software that allows an autonomous vehicle to operate without a driver’s input.

This rule applies to companies that are selling vehicles or importing vehicles for sale in the United States when those vehicles weigh less than 10,001 pounds. It does not apply to vehicles that are already on the road. Furthermore, the restrictions have a delayed effect, as outlined below.

BIS is implementing three categories of prohibitions:

1. Sale of completed connected vehicles by PRC or Russian companies – starting for Model Year 2027, companies with a sufficient nexus to the PRC or Russia will not be permitted to sell certain connected vehicles in the United States. This includes companies that are not based in the PRC or Russia but are owned and controlled by PRC or Russian companies.
2. Import or sale of completed connected vehicles that incorporate PRC or Russian covered software - also starting for Model Year 2027, manufacturers will not be permitted to import for sale or sell in the United States connected vehicles that incorporate VCS and/or ADS software from companies with a sufficient nexus to the PRC or Russia.
3. Import of PRC or Russian VCS hardware – beginning in Model Year 2030, or January 1, 2029, for components that don’t have a model year, importers will not be permitted to import VCS hardware or components that are designed, developed, manufactured, or supplied by companies with a sufficient nexus to the PRC or Russia.

Compliance requirements

The final rule requires importers of VCS hardware and importers and manufacturers of completed connected vehicles to submit annual Declarations of Conformity to BIS to attest that they are complying with the rule. These Declarations provide basic information about the company, the transactions it is engaging in, and its suppliers.

The final rule contains several other compliance mechanisms relevant for regulated entities: 

1. General Authorizations allow importers and manufacturers to engage in certain low-risk transactions without the need to notify BIS; 
2. Specific Authorizations enable importers and manufacturers to apply to BIS for permission to engage in a transaction that is otherwise prohibited by the rule; and  
3. Advisory Opinions allow importers and manufacturers to ask BIS for a formal determination if a specific transaction would be subject to the rule’s prohibitions.