On January 14, 2025, BIS released the final rule for Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles (Connected Vehicle Rule). The Connected Vehicle Rule prohibits imports and sales of certain hardware or connected vehicles containing that certain hardware or software if there is a sufficient nexus to China (PRC) or Russia. BIS had previously published a Notice of Proposed Rulemaking in September 2024 and an Advance Notice of Proposed Rulemaking in March 2024 prior to this final rule.
The Connected Vehicle Rule is scheduled to go into effect March 17, 2025. However, one of the first “Presidential Actions” taken by the Trump Administration was to give federal agencies discretion to issue a 60-day regulatory freeze of any rules that have not taken effect. As of the date of this alert, the Trump Administration has not announced any delay related to this rule. In addition, the America First Trade Policy Memorandum has tasked the Secretary of Commerce “to consider whether controls on ICTS transactions should be expanded to account for additional connected products” by April 1, 2025.
Below we provide a brief summary of the Connected Vehicle Rule as it currently stands.
Covered Systems
The Connected Vehicle Rule places restrictions on two types of connected systems:
- Vehicle Connectivity Systems (VCS): the hardware or software installed in or on a completed connected vehicle that directly enables the function of transmission, receipt, conversation, or processing of certain radio frequency communications.
- Automated Driving Systems (ADS): the hardware and software that, collectively, are capable of performing the entire dynamic driving task for a completed connected vehicle on a sustained basis.
Restricted Activities
The final Connected Vehicle Rule prohibits (1) from knowingly importing Chinese or Russian VCS hardware into the United States, (2) connected vehicle manufacturers from importing or selling connected vehicles that contain Chinese or Russian VCS or ADS software into the United States; and (3) connected vehicle manufacturers with a China- or Russia-nexus from importing or selling any connected vehicle into the United States, regardless of whether the VCS or ADS are Chinese or Russian. The first prohibition applies to VCS hardware intended for vehicles in Model Year 2030, or January 1, 2029, for components that don’t have a model year. The second and third prohibitions apply to connected vehicles in Model Year 2027.
These restrictions only apply to passenger vehicles that are less than 10,000 pounds and exclude vehicles that are already on the road. BIS intends to issue separate rules governing commercial vehicles, which are currently excluded from the scope of the Connected Vehicle Rule.
Further, the restrictions pertaining to software do not apply to software that was designed, developed, manufactured, or supplied before March 17, 2026, unless the software was maintained or altered by an entity owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary after that date. Treasury has characterized this as the "legacy code" exception.
Restricted Suppliers
Persons with a sufficient nexus to the PRC or Russia are those “owned by, controlled by, or subject to the jurisdiction or direction of” the PRC or Russia. This includes:
- Any person who acts as an agent, representative, employee, or is otherwise acting under the direction or control of either the PRC or Russia or a person whose activities are directed or subsidized, in whole or majority part, by the PRC or Russia;
- Any person who is the citizen or resident of the PRC or Russia and is not a U.S. citizen or permanent resident;
- Any entity headquartered in or incorporated under the laws of the PRC or Russia; or
- Any entity that is owned or controlled by any person identified in any of the above.
BIS declined to create a whitelist of vendors that do not require additional due diligence and expects companies to “do their homework” on supply chain components to verify their compliance with export controls.
Declaration of Conformity
To ensure compliance with the new rule, VCS hardware importers and connected vehicle manufacturers are required to submit a Declarations of Conformity, which certifies that the VCS hardware or ADS/VCS software was not designed, developed, manufactured, or supplied by a Chinese or Russian person.
Authorizations
General authorization may be issued authorizing certain transactions that would otherwise be prohibited. BIS anticipates that general authorizations will be available only in a narrow set of circumstances and will be published on BIS’ website and the Federal Register. Absent applicable general authorizations, companies can apply for specific authorizations to engage in otherwise prohibited transactions. BIS’ authorization-related decisions can be appealed to the BIS Under Secretary and industry can seek guidance on prospective transactions through BIS advisory opinions.
Statute of Limitations
In April 2024, Congress extended the statute of limitations for International Economic Emergency Powers Act (IEEPA) from 5 years to 10 years. This means that, if the Connected Vehicles Rule, which was promulgated under IEEPA, goes into effect, BIS will have 10 years from the date of a violation to bring an enforcement action. OEMs or connected vehicle manufacturers should be prepared to adjust their recordkeeping practices accordingly.
