The US Department of Commerce’s Bureau of Industry and Security (BIS) has announced a final rule prohibiting certain transactions involving the sale or import of connected vehicles integrating specific pieces of hardware and software, or those components sold separately, with a sufficient nexus to the People’s Republic of China (PRC) or Russia.
BIS and its Office of Information and Communications Technology and Services (OICTS) have found that certain technologies originating from the PRC or Russia present an undue and unacceptable risk to US national security.
The final rule represents the culmination of a months-long regulatory process to design, seek public input on, and ultimately finalize a measure to protect drivers and passengers on American roads.
“Cars today aren’t just steel on wheels – they’re computers. They have cameras, microphones, GPS tracking, and other technologies that are connected to the internet. Through this rule, the Commerce Department is taking a necessary step to safeguard US national security and protect Americans’ privacy by keeping foreign adversaries from manipulating these technologies to access sensitive or personal information,” said US Secretary of Commerce Gina Raimondo.
“This is a targeted approach to ensure we keep PRC and Russian-manufactured technologies off American roads and protect our nation’s connected vehicle supply chains,” Raimondo added.
The final rule establishes that hardware and software integrated into the Vehicle Connectivity System (VCS) and software integrated into the Automated Driving System (ADS), the systems in vehicles that allow for external connectivity and autonomous driving capabilities, present an undue and unacceptable risk to national security when designed, developed, manufactured, or supplied by persons with a sufficient nexus to the PRC or Russia.
Malicious access to these critical supply chains could allow foreign adversaries to extract sensitive data, including personal information about vehicle drivers or owners, and remotely manipulate vehicles.
At this time, given the complexity of the commercial vehicle supply chain, the final rule applies only to passenger vehicles (defined as those under 10,001 lbs). BIS recognizes the acute national security threat presented by foreign adversary involvement in the commercial vehicle supply chain and intends to issue a separate rulemaking addressing the technologies present in connected commercial vehicles – including in trucks and buses – in the near future.
The final rule prohibits the import of VCS hardware or connected vehicles containing such hardware, and the import and sale of vehicles containing VCS or ADS software, with a sufficient nexus to the PRC or Russia. VCS is defined as the set of systems that allow the vehicle to communicate externally, including telematics control units, Bluetooth, cellular, satellite, and Wi-Fi modules. ADS includes the components that collectively allow a highly autonomous vehicle to operate without a driver.
The rule also prohibits manufacturers with a sufficient nexus to the PRC or Russia from selling new connected vehicles that incorporate VCS hardware or software or ADS software in the US, even if the vehicle was made in the country.
The software-related prohibitions will take effect for model year 2027. The hardware-related prohibitions will take effect for model year 2030, or January 1, 2029, for units without a model year. Prohibitions on the sale of connected vehicles by manufacturers with a sufficient nexus to the PRC or Russia, even if manufactured in the US, take effect for model year 2027.
The rule also requires certain importers and manufacturers to submit annual Declarations of Conformity to certify their compliance with the prohibitions. The final rule allows Commerce to issue General Authorizations for certain types of transactions posing lower risk.
It also allows regulated parties to seek Specific Authorizations permitting them to engage in otherwise prohibited transactions, as well as advisory opinions to ask BIS for a determination if a prospective transaction may fall within the scope of the rule.
