New BIS rule on connected cars: Prohibitions on technology from Russia and China

• The rule seeks to mitigate the national security risks posed by vehicle systems that foreign adversaries could exploit as a vector for cyber attacks, to collect sensitive information on U.S. persons and critical infrastructure, or to disrupt or disable the vehicles themselves.
• The rule applies to certain hardware and software used in Vehicle Connectivity Systems (VCS), as well as to certain software used in Automated Driving Systems (ADS). It requires anyone seeking to sell or import on-road vehicles under 10,001 lbs. equipped with such systems to provide a Declaration of Conformity certifying compliance with the rule; to explain how their use case falls within a published General Authorization; or to seek a Specific Authorization from BIS, which may entail meeting certain security requirements.
• The rule would also prohibit, without Specific Authorization, the sale in the United States of a connected vehicle by any entity “owned by, controlled by, or subject to the jurisdiction or direction of” Russia or China, even if the entire vehicle was manufactured in the United States. Absent Specific Authorization, it likewise prohibits such persons from using connected vehicles for rideshare or robotaxi services in the United States.
• The rule is intended to reach not just automotive original equipment manufacturers (OEMs), but their Tier 1 and Tier 2 suppliers as well. It may lead companies to relocate some manufacturing operations outside Russia or China, and will result in compliance, reporting, and record-keeping responsibilities that cascade down from OEMs through the supply chain.
• The rule’s software-related prohibitions will take effect for Model Year 2027, while hardware-related prohibitions will take effect for Model Year 2030, or on January 1, 2029, for VCS hardware not associated with a specific model year. The rule includes provisions for maintaining legacy software, provided such software is maintained free from Russian or Chinese access, and for manufacturing hardware to repair vehicles through Model Year 2030.
• Finally, the rule includes a specific provision that allows for the employment of Russian and Chinese nationals outside Russia or China by entities not otherwise owned by, controlled by, or subject to the jurisdiction or direction of Russia or China.

Although the final published rule applies only to passenger vehicles under 10,001 pounds, BIS has indicated that it intends to consider a second rule that would apply to commercial vehicles over 10,001 pounds, including trucks and buses.

The published final rule includes an exhaustive commentary explaining both how the final rule differs from the proposed rule, published in September 2024, and which specific types of hardware and software the rule covers. The commentary also provides 43 hypothetical scenarios that illustrate the rule’s application across different ownership structures and manufacturing operations, as well as its diligence, reporting, and record-keeping requirements.

Both OEMs and their suppliers would be well advised to understand in detail how this new rule may apply to their own manufacturing operations and to their supply chains. While a proposed requirement for a Hardware Bill of Materials or Software Bill of Materials does not appear in the final rule, companies should still ensure that they understand and can meet the diligence and record-keeping requirements necessary to provide or support each vehicle model’s Declaration of Conformity. Finally, companies seeking to take advantage of a General Authorization or to apply for a Specific Authorization would be equally well advised to consider the national security risks that the rule seeks to address and the circumstances in which BIS may grant an authorization.

As with all pending rulemakings during this period of transition, there remains a possibility that the Department of Commerce will pause or revisit this new regulation. As the final rule appears to align with the new Trump Administration’s policy priorities, however, that appears a less likely possibility in this instance.

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.